Free Fortinet NSE4_FGT-6.4 Dumps with Questions Answers

test2021-10-18T08:35:01+00:00

By test Fortinet NSE 4—FortiOS 6.4, NSE4_FGT-6.4, NSE4_FGT-6.4 dumps, NSE4_FGT-6.4 exam questions, NSE4_FGT-6.4 free dumps, NSE4_FGT-6.4 free questions, NSE4_FGT-6.4 study guide 0 Comments

Fortinet NSE 4—FortiOS 6.4 exam is part of the NSE 4 Network Security Professional program, and recognizes the successful candidate’s knowledge of and expertise with FortiGate devices. The exam tests applied knowledge of FortiGate configuration, operation, and day-to-day administration, and includes operational scenarios, configuration extracts, and troubleshooting captures.

The best way to pass the Fortinet NSE4_FGT-6.4 exam is to challenge and improve your knowledge. To test your learning and identify areas for improvement through the actual exam format, you recommend using the FreeTestShare Fortinet NSE4_FGT-6.4 Dumps with Questions Answers for practice. It can discover your strengths and weaknesses, improve your time management skills, and gain you expect score ideas.

Free Test Share Fortinet NSE4_FGT-6.4 Dumps with Questions Answers

Page 1 of 4

1. Examine the two static routes shown in the exhibit, then answer the following question.

Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

FortiGate will load balance all traffic across both routes.

FortiGate will use the port1 route as the primary candidate.

FortiGate will route twice as much traffic to the port2 route

FortiGate will only actuate the port1 route in the routing table

2. An administrator has configured outgoing Interface any in a firewall policy.

Which statement is true about the policy list view?

Policy lookup will be disabled.

By Sequence view will be disabled.

Search option will be disabled

Interface Pair view will be disabled.

3. Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

System event logs

Forward traffic logs

Local traffic logs

Security logs

4. Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.

How does FortiGate process the traffic sent to http://www.fortinet.com?

Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.

Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.

Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.

Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.

5. Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10 .0.1.254. /24.

The first firewall policy has NAT enabled using IP Pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

10.200.1.1

10.200.3.1

10.200.1.100

10.200.1.10

6. Refer to the exhibit to view the application control profile.

Users who use Apple FaceTime video conferences are unable to set up meetings.

In this scenario, which statement is true?

Apple FaceTime belongs to the custom monitored filter.

The category of Apple FaceTime is being monitored.

Apple FaceTime belongs to the custom blocked filter.

The category of Apple FaceTime is being blocked.

7. Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

This is known as many-to-one NA

Source IP is translated to the outgoing interface I

Connections are tracked using source port and source MAC address.

Port address translation is not used.

8. Which two statements are true when FortiGate is in transparent mode? (Choose two.)

By default, all interfaces are part of the same broadcast domain.

The existing network IP schema must be changed when installing a transparent mode.

Static routes are required to allow traffic to the next hop.

FortiGate forwards frames without changing the MAC address.

9. Refer to the exhibits.

The SSL VPN connection fails when a user attempts to connect to it.

What should the user do to successfully connect to SSL VPN?

Change the SSL VPN port on the client.

Change the Server IP address.

Change the idle-timeout.

Change the SSL VPN portal to the tunnel.

10. A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

The browser requires a software update.

FortiGate does not support full SSL inspection when web filtering is enabled.

The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.

There are network connectivity issues.

Page 2 of 4

11. Refer to the exhibit to view the firewall policy.

Which statement is correct if well-known viruses are not being blocked?

The firewall policy does not apply deep content inspection.

The firewall policy must be configured in proxy-based inspection mode.

The action on the firewall policy must be set to deny.

Web filter should be enabled on the firewall policy to complement the antivirus profile.

12. If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

The Services field prevents SNAT and DNAT from being combined in the same policy.

The Services field is used when you need to bundle several VIPs into VIP groups.

The Services field removes the requirement to create multiple VIPs for different services.

The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.

13. Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

To delete intermediary NAT devices in the tunnel path.

To dynamically change phase 1 negotiation mode aggressive mode.

To encapsulation ESP packets in UDP packets using port 4500.

To force a new DH exchange with each phase 2 rekey.

14. Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

A local FortiManager is one of the servers FortiGate communicates with.

One server was contacted to retrieve the contract information.

There is at least one server that lost packets consecutively.

FortiGate is using default FortiGuard communication settings.

15. View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

Addicting.Games is allowed based on the Application Overrides configuration.

Addicting.Games is blocked on the Filter Overrides configuration.

Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

Addcting.Games is allowed based on the Categories configuration.

16. Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

17. Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

18. Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet. The To_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.

Which two statements are true? (Choose two.)

Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

A static route is required on the To_Internet VDOM to allow LAN users to access the internet.

Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.

Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDO

19. Consider the topology:

Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.

An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.

The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.

What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Set the maximum session TTL value for the TELNET service object.

Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Create a new service object for TELNET and set the maximum session TT

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

20. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

The keyUsage extension must be set to keyCertSign.

The common name on the subject field must use a wildcard name.

The issuer must be a public C

The CA extension must be set to TRU

Page 3 of 4

21. In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies.

Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

22. Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

diagnose sys top

execute ping

execute traceroute

diagnose sniffer packet any

get system arp

23. Examine this output from a debug flow:

Why did the FortiGate drop the packet?

The next-hop IP address is unreachable.

It failed the RPF check.

It matched an explicitly configured firewall policy with the action DEN

It matched the default implicit firewall policy.

24. Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

Central NAT is enabled, so NAT settings from matching Central SNAT policies will be

applied.

Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.149

10.200.1.1

10.200.1.49

10.200.1.99

25. Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

FortiGuard web filter cache

FortiGate hostname

NTP

DNS

26. Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.

The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

10.200.1.10

Any available IP address in the WAN (port1) subnet 10.200.1.0/24

10.200.1.1

10.0.1.254

27. An administrator has configured two-factor authentication to strengthen SSL VPN access.

Which additional best practice can an administrator implement?

Configure Source IP Pools.

Configure split tunneling in tunnel mode.

Configure different SSL VPN realms.

Configure host check.

28. Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLA

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

29. Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The subject field in the server certificate

The serial number in the server certificate

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The host field in the HTTP header

30. Examine the network diagram shown in the exhibit, then answer the following question:

Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?

172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]

0.0.0.0/0 [20/0] via 10.4.200.2, port2

10.4.200.0/30 is directly connected, port2

172.16.32.0/24 is directly connected, port1

Page 4 of 4

31. Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

The firmware image must be manually uploaded to each FortiGate.

Only secondary FortiGate devices are rebooted.

Uninterruptable upgrade is enabled by default.

Traffic load balancing is temporally disabled while upgrading the firmware.

32. Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Log downloads from the GUI are limited to the current filter view

Log backups from the CLI cannot be restored to another FortiGate.

Log backups from the CLI can be configured to upload to FTP as a scheduled time

Log downloads from the GUI are stored as LZ4 compressed files.

33. Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

Both the phase 1 SA and phase 2 SA are bidirectional.

34. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

35. Refer to the exhibit.

The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.

An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.

The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database.

Users will be prompted for authentication.

How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)

If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.

If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.

If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.

If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.

36. Which two types of traffic are managed only by the management VDOM? (Choose two.)

FortiGuard web filter queries

PKI

Traffic shaping

DNS