Fortinet NSE 4 - FortiOS 6.0 - NSE4_FGT-6.0 Exam Practice Test

Question 1

Which statement is true regarding SSL VPN timers? (Choose two.)

A. Prevent SSL VPN users from being logged out because of high network latency.

B. Allow to mitigate DoS attacks from partial HTTP requests.

C. Disconnect idle SSL VPN users when a firewall policy authentication timeout occurs.

D. SSL VPN settings do not have customizable timers.

Correct Answer: A,B

Question 2

Examine the following web filtering log.

Which statement about the log message is true?

A. The name of the applied web filter profile is default.

B. The usage quota for the IP address 10.0.1.10 has expired

C. The web site miniclip.com matches a static URL filter whose action is set to Warning.

D. The action for the category Games is set to block.

Correct Answer: A

Question 3

Examine this output from a debug flow:

Why did the FortiGate drop the packet?

A. It failed the RPF check.

B. It matched an explicitly configured firewall policy with the action DENY.

C. It matched the default implicit firewall policy.

D. The next-hop IP address is unreachable.

Correct Answer: C

Question 4

A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

A. The two VLAN sub interfaces must have different VLAN IDs.

B. The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

C. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

D. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

Correct Answer: A

Question 5

A team manager has decided that while some members of the team need access to particular website, the majority of the team does not. Which configuration option is the most effective option to support this request?

A. Implement a web filter category override for the specified website.

B. Implement DNS filter for the specified website.

C. Implement web filter authentication for the specified website

D. Implement web filter quotas for the specified website.

Correct Answer: A

Question 6

You have tasked to design a new IPsec deployment with the following criteria:
Which topology should be used to satisfy all of the requirements?

A. Hub-and-spoke

B. Fully meshed

C. Redundant

D. Partial mesh

Correct Answer: A

Question 7

Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

A. Port address translation is not used.

B. Connections are tracked using source port and source MAC address.

C. This is known as many-to-one NAT.

D. Source IP is translated to the outgoing interface IP.

Correct Answer: C,D

Question 8

An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.

Where must the proxy address be used?

A. As the destination in a firewall policy.

B. As the source in a proxy policy.

C. As the source in a firewall policy.

D. As the destination in a proxy policy.

Correct Answer: B

Question 9

Which of the following route attributes must be equal for static routes to be eligible for equal cost multipath (ECMP) routing? (Choose two.)

A. Cost

B. Distance

C. Metric

D. Priority

Correct Answer: B,D

Fortinet NSE 4 - FortiOS 6.0 - NSE4_FGT-6.0 Exam Practice Test

Latest Update

Useful Links

Contact Us