Fortinet NSE4_FGT-6.0 Courses 2021

NEW QUESTION 1
Examine this explicit web proxy configuration:

What filter can be used u, the command diagnose sniffer packet to capture the traffic between the client and the explicit web pray?

• A. ‘host 10.0.0.50 and port 80’
• B. ‘host 192.168.0.1 and port 80’
• C. ‘host 192.168.0.2 and port 8080’
• D. ‘host 10.0.50.1 and port 8080’

Answer: B

NEW QUESTION 2
What settings must you configure to ensure FortiGate generates logs for web filter activity on a firewall policy called Full Access? (Choose two.)

• A. Enable Event Logging.
• B. Enable a web filter security profile on the Full Access firewall policy.
• C. Enable Log Allowed Traffic on the Full Access firewall policy.
• D. Enable disk logging.

Answer: BC

NEW QUESTION 3
Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

• A. It is allowed, but with no inspection
• B. It is allowed and inspected as long as the inspection is flow based
• C. It is dropped.
• D. It is allowed and inspected, as long as the only inspection required is antivirus.

Answer: C

NEW QUESTION 4
What FortiGate components are tested during the hardware test? (Choose three.)

• A. Administrative access
• B. HA heartbeat
• C. CPU
• D. Hard disk
• E. Network interfaces

Answer: CDE

NEW QUESTION 5
Which Statements about virtual domains (VDOMs) arc true? (Choose two.)

• A. Transparent mode and NAT/Route mode VDOMs cannot be combined on the same FortiGate.
• B. Each VDOM can be configured with different system hostnames.
• C. Different VLAN sub-interfaces of the same physical interface can be assigned to different VDOMs.
• D. Each VDOM has its own routing table.

Answer: CD

NEW QUESTION 6
Which statement about DLP on FortiGate is true?

• A. It can archive files and messages.
• B. It can be applied to a firewall policy in a flow-based VDOM
• C. Traffic shaping can be applied to DLP sensors.
• D. Files can be sent to FortiSandbox for detecting DLP threats.

Answer: A

NEW QUESTION 7
When override is enabled, which of the following shows the process and selection criteria that are used to elect the primary FortiGate in an HA cluster?

• A. Connected monitored ports > HA uptime > priority > serial number
• B. Priority > Connected monitored ports > HA uptime > serial number
• C. Connected monitored ports > priority > HA uptime > serial number
• D. HA uptime > priority > Connected monitored ports > serial number

Answer: C

NEW QUESTION 8
Examine the network diagram and the existing FGTI routing table shown in the exhibit, and then answer the following question:

An administrator has added the following static route on FGTI.

Since the change, the new static route is not showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

• A. The new route’s destination subnet overlaps an existing route.
• B. The new route’s Distance value should be higher than 10.
• C. The Gateway IP address is not in the same subnet as port1.
• D. The Priority is 0, which means that this route will remain inactive.

Answer: C

NEW QUESTION 9
What is the limitation of using a URL list and application control on the same firewall policy, in NCFW policy-based mode?

• A. It limits the scope of application control to the browser-based technology category only.
• B. It limits the scope of application control to scan application traffic based on application category only.
• C. It limits the scope of application control to scan application traffic using parent signatures only
• D. It limits the scope of application control to scan application traffic on DNS protocol only.

Answer: D

NEW QUESTION 10
When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?

• A. It must be configured in a static route using the sdwan virtual interface.
• B. It must be provided in the SD-WAN member interface configuration.
• C. It must be configured in a policy-route using the sdwan virtual interface.
• D. It must be learned automatically through a dynamic routing protocol.

Answer: A

NEW QUESTION 11
Which statement regarding the firewall policy authentication timeout is true?

• A. It is an idle timeou
• B. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.
• C. It is a hard timeou
• D. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.
• E. It is an idle timeou
• F. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.
• G. It is a hard timeou
• H. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

Answer: A

NEW QUESTION 12
An administrator wants to create a policy-based IPsec VPN tunnel between two FortiGate devices Winch configuration steps must be performed on both devices to support this scenario? (Choose three.)

• A. Define the phase 1 parameters, without enabling IPsec interface mode
• B. Define the phase 2 parameters.
• C. Set the phase 2 encapsulation method to transport mode
• D. Define at least one firewall policy, with the action set to IPsec.
• E. Define a route to the remote network over the IPsec tunnel.

Answer: CDE

NEW QUESTION 13
How does FortiGate verify the login credentials of a remote LDAP user?

• A. FortiGate regenerates the algorithm based on the login credentials and compares it to the algorithm stored on the LDAP server.
• B. FortiGate sends the user-entered credentials to the LDAP server for authentication.
• C. FortiGate queries the LDAP server for credentials.
• D. FortiGate queries its own database for credentials.

Answer: B

NEW QUESTION 14
How do you format the FortiGate flash disk?

• A. Load a debug FortiOS image.
• B. Load the hardware test (HQIP) image.
• C. Execute the CLI command execute formatlogdisk.
• D. Select the format boot device option from the BIOS menu.

Answer: D

NEW QUESTION 15
Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

What are the expected actions if traffic matches this IPS sensor? (Choose two.)

• A. The sensor will gather a packet log for all matched traffic.
• B. The sensor will not block attackers matching the A32S.Botnet signature.
• C. The sensor will block all attacks for Windows servers.
• D. The sensor will reset all connections that match these signatures.

Answer: AC

NEW QUESTION 16
Which of the following conditions roust be met in order for a web browser to trust a web server certificate signed by a third-party CA?

• A. The web-server certificate DM be installed on the browser
• B. The public key of the web server certificate must be installed on die browser
• C. The CA certificate that signed the web-server certificate inutile installed on the browser
• D. The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Answer: C

NEW QUESTION 17
Which of the following statements about central NAT are true? (Choose two.)

• A. IP tool references must be removed from existing firewall policies before enabling central NAT.
• B. Central NAT can be enabled or disabled from the CLI only.
• C. Source NAT, using central NAT, requires at least one central SNAT policy.
• D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall policy.

Answer: AB

NEW QUESTION 18
Examine the exhibit, which shows the output of a web filtering real time debug.

Why is the site www.bing.com being blocked?

• A. The web site www.bing.com is categorized by FortiGuard as Malicious Websites.
• B. The user has not authenticated with the FortiGate yet.
• C. The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
• D. The rating for the web site www.bing.com has been locally overridden to a category that is being blocked.

Answer: D

NEW QUESTION 19
An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

• A. Phase 1 negotiations will skip preshared key exchange.
• B. Only digital certificates will be accepted as an authentication method in phase 1.C
• C. Dialup clients must provide a username and password for authentication.
• D. Dialup clients must provide their local ID during phase 2 negotiations.

Answer: C

NEW QUESTION 20
View the exhibit.

Which users and user groups are allowed access to the network through captive portal?

• A. Users and groups defined in the firewall policy.
• B. Only individual users – not groups – defined in the captive portal configuration
• C. Groups defined in the captive portal configuration
• D. All users

Answer: C

NEW QUESTION 21
What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

• A. Traffic to botnet servers
• B. Traffic to inappropriate web sites
• C. Server information disclosure attacks
• D. Credit card data leaks
• E. SQL injection attacks

Answer: ACE

NEW QUESTION 22
NGFW mode allows policy-based configured for most impaction rules. Which security profile’s configuration does not change when you enable policy-based impaction?

• A. Antivirus
• B. Web proxy
• C. Web filtering
• D. Application control

Answer: D

NEW QUESTION 23
......