Month End Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

Activedumpsnet Logo
  1. Home
  2. Fortinet
  3. NSE4
  4. NSE4_FGT-6.4
  5. NSE4_FGT-6.4 - Fortinet NSE 4 - FortiOS 6.4

Fortinet NSE4_FGT-6.4 Fortinet NSE 4 - FortiOS 6.4 Exam Practice Test

Note! Following NSE4_FGT-6.4 Exam is Retired now. Please select the alternative replacement for your Exam Certification. The new exam code is NSE4_FGT-7.2
Page: 1 / 17
Total 165 questions
Get NSE4_FGT-6.4 Full Access Download NSE4_FGT-6.4 PDF

Fortinet NSE 4 - FortiOS 6.4 Questions and Answers

Question 1

Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

Options:

A.

FortiGate points the collector agent to use a remote LDAP server.

B.

FortiGate uses the AD server as the collector agent.

C.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

D.

FortiGate queries AD by using the LDAP to retrieve user group information.

Question 2

Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)

Options:

A.

FG-traffic

B.

Mgmt

C.

FG-Mgmt

D.

Root

Question 3

Which two statements are true about collector agent advanced mode? (Choose two.)

Options:

A.

Advanced mode uses Windows convention—NetBios: Domain\Username.

B.

FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate

C.

Advanced mode supports nested or inherited groups

D.

Security profiles can be applied only to user groups, not individual users.

Question 4

Refer to the exhibit.

Question # 4

Based on the raw log, which two statements are correct? (Choose two.)

Options:

A.

Traffic is blocked because Action is set to DENY in the firewall policy.

B.

Traffic belongs to the root VDOM.

C.

This is a security log.

D.

Log severity is set to error on FortiGate.

Question 5

Refer to the exhibit.

Question # 5

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.

Which two statements are true? (Choose two.)

Options:

A.

FortiGate SN FGVM010000065036 HA uptime has been reset.

B.

FortiGate devices are not in sync because one device is down.

C.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

D.

FortiGate SN FGVM010000064692 has the higher HA priority.

Question 6

Refer to the exhibit.

Question # 6

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

Options:

A.

There are five devices that are part of the security fabric.

B.

Device detection is disabled on all FortiGate devices.

C.

This security fabric topology is a logical topology view.

D.

There are 19 security recommendations for the security fabric.

Question 7

FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

Options:

A.

www.example.com:443

B.

www.example.com

C.

example.com

D.

www.example.com/index.html

Question 8

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Options:

A.

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

B.

ADVPN is only supported with IKEv2.

C.

Tunnels are negotiated dynamically between spokes.

D.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Question 9

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

Options:

A.

A CRL

B.

A person

C.

A subordinate CA

D.

A root CA

Question 10

Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)

Options:

A.

SSH

B.

HTTPS

C.

FTM

D.

FortiTelemetry

Question 11

Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

Options:

A.

The public key of the web server certificate must be installed on the browser.

B.

The web-server certificate must be installed on the browser.

C.

The CA certificate that signed the web-server certificate must be installed on the browser.

D.

The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Question 12

Refer to the exhibit.

Question # 12

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

Options:

A.

The port3 default route has the highest distance.

B.

The port3 default route has the lowest metric.

C.

There will be eight routes active in the routing table.

D.

The port1 and port2 default routes are active in the routing table.

Question 13

Refer to the exhibit.

Question # 13

Which contains a Performance SLA configuration.

An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

Options:

A.

Participants configured are not SD-WAN members.

B.

There may not be a static route to route the performance SLA traffic.

C.

The Ping protocol is not supported for the public servers that are configured.

D.

You need to turn on the Enable probe packets switch.

Question 14

Refer to the exhibit.

Question # 14

Question # 14

Question # 14

Question # 14

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.

Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

Options:

A.

10.200.1.149

B.

10.200.1.1

C.

10.200.1.49

D.

10.200.1.99

Question 15

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

Options:

A.

The IP version of the sources and destinations in a firewall policy must be different.

B.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

C.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

D.

The IP version of the sources and destinations in a policy must match.

E.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

Question 16

Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

Options:

A.

This is known as many-to-one NAT.

B.

Source IP is translated to the outgoing interface IP.

C.

Connections are tracked using source port and source MAC address.

D.

Port address translation is not used.

Question 17

What is the primary FortiGate election process when the HA override setting is disabled?

Options:

A.

Connected monitored ports > System uptime > Priority > FortiGate Serial number

B.

Connected monitored ports > HA uptime > Priority > FortiGate Serial number

C.

Connected monitored ports > Priority > HA uptime > FortiGate Serial number

D.

Connected monitored ports > Priority > System uptime > FortiGate Serial number

Question 18

Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

Options:

A.

For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote

peer to provide a username and password

B.

FortiGate supports pre-shared key and signature as authentication methods.

C.

Enabling XAuth results in a faster authentication because fewer packets are exchanged.

D.

A certificate is not required on the remote peer when you set the signature as the authentication method.

Question 19

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

Options:

A.

Subject Key Identifier value

B.

SMMIE Capabilities value

C.

Subject value

D.

Subject Alternative Name value

Question 20

Which of the following SD-WAN load –balancing method use interface weight value to distribute traffic? (Choose two.)

Options:

A.

Source IP

B.

Spillover

C.

Volume

D.

Session

Question 21

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Options:

A.

The interface has been configured for one-arm sniffer.

B.

The interface is a member of a virtual wire pair.

C.

The operation mode is transparent.

D.

The interface is a member of a zone.

E.

Captive portal is enabled in the interface.

Question 22

Refer to the exhibit.

Question # 22

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Options:

A.

Traffic between port2 and port2-vlan1 is allowed by default.

B.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

C.

port1 is a native VLAN.

D.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Question 23

Refer to the exhibit.

Question # 23

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

Options:

A.

The signature setting uses a custom rating threshold.

B.

The signature setting includes a group of other signatures.

C.

Traffic matching the signature will be allowed and logged.

D.

Traffic matching the signature will be silently dropped and logged.

Question 24

Which two statements are true when FortiGate is in transparent mode? (Choose two.)

Options:

A.

By default, all interfaces are part of the same broadcast domain.

B.

The existing network IP schema must be changed when installing a transparent mode.

C.

Static routes are required to allow traffic to the next hop.

D.

FortiGate forwards frames without changing the MAC address.

Load More NSE4_FGT-6.4 Questions 
Page: 1 / 17
Total 165 questions
Get NSE4_FGT-6.4 Full Access Download NSE4_FGT-6.4 PDF