Quiz
Practica NSE4
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (89)
1A FortiGate interface is configured with the following commands:
What statements about the configuration are correct? (Choose two.)
- AIPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.
- BFortiGate can provide DNS settings to IPv6 clients.
- CFortiGate can send IPv6 router advertisements (RAs.)
- DFortiGate can provide IPv6 addresses to DHCPv6 client.
2Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)
- ASP3
- BCP8
- CNP4
- DNP6
3Under what circumstance would you enable LEARN as the Action on a firewall policy?
- AYou want FortiGate to compile security feature activity from various security-related logs, such as virus and attack logs.
- BYou want FortiGate to monitor a specific security profile in a firewall policy, and provide recommendations for that profile.
- CYou want to capture data across all traffic and security vectors, and receive learning logs and a report with recommendations.
- DYou want FortiGate to automatically modify your firewall policies as it learns your networking behavior.
4What methods can be used to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)
- ACode blocks
- BSMS phone message
- CFortiToken
- DBrowser pop-up window
- EEmail
5You are tasked to architect a new IPsec deployment with the following criteria:
- There are two HQ sites that all satellite offices must connect to.
- The satellite offices do not need to communicate directly with other satellite offices.
- No dynamic routing will be used.
- The design should minimize the number of tunnels being configured.
Which topology should be used to satisfy all of the requirements?- ARedundant
- BHub-and-spoke
- CPartial mesh
- DFully meshed
6View the exhibit.
Which of the following statements are correct? (Choose two.)
- AThis is a redundant IPsec setup.
- BThe TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
- CThis setup requires at least two firewall policies with action set to IPsec.
- DDead peer detection must be disabled to support this type of IPsec setup.
7What is FortiGate’s behavior when local disk logging is disabled?
- AOnly real-time logs appear on the FortiGate dashboard.
- BNo logs are generated.
- CAlert emails are disabled.
- DRemote logging is automatically enabled.
8What traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)
- ATraffic to inappropriate web sites
- BSQL injection attacks
- CServer information disclosure attacks
- DCredit card data leaks
- ETraffic to botnet command and control (C&C) servers
9Which statements about One-to-One IP pool are true? (Choose two.)
- AIt allows configuration of ARP replies.
- BIt allows fixed mapping of an internal address range to an external address range.
- CIt is used for destination NAT.
- DIt does not use port address translation.
10Which statements correctly describe transparent mode operation? (Choose three.)
- AAll interfaces of the transparent mode FortiGate device must be on different IP subnets.
- BThe transparent FortiGate is visible to network hosts in an IP traceroute.
- CIt permits inline traffic inspection and firewalling without changing the IP scheme of the network.
- DEthernet packets are forwarded based on destination MAC addresses, not IP addresses.
- EThe FortiGate acts as transparent bridge and forwards traffic at Layer-2.
11View the exhibit.
What is the effect of the Disconnect Cluster Member operation as shown in the exhibit? (Choose two.)
- AThe HA mode changes to standalone.
- BThe firewall policies are deleted on the disconnected member.
- CThe system hostname is set to the FortiGate serial number.
- DThe port3 is configured with an IP address for management access.
12What step is required an SSL VPN to access to an internal server using port forward mode?
- AConfigure the virtual IP addresses to be assigned to the SSL VPN users.
- BInstall FortiClient SSL VPN client
- CCreate a SSL VPN realm reserved for clients using port forward mode.
- DConfigure the client application to forward IP traffic to a Java applet proxy.
13View the exhibit.
This is a sniffer output of a telnet connection request from 172.20.120.186 to the port1 interface of FGT1.
In this scenario. FGT1 has the following routing table:
Assuming telnet service is enabled for port1, which of the following statements correctly describes why FGT1 is not responding?
- AThe port1 cable is disconnected.
- BThe connection is dropped due to reverse path forwarding check.
- CThe connection is denied due to forward policy check.
- DFGT1’s port1 interface is administratively down.
14An administrator needs to be able to view logs for application usage on your network. What configurations are required to ensure that FortiGate generates logs for application usage activity? (Choose two.)
- AEnable a web filtering profile on the firewall policy.
- BCreate an application control policy.
- CEnable logging on the firewall policy.
- DEnable an application control security profile on the firewall policy.
15A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups. What is required in the SSL VPN configuration to meet these requirements?
- ATwo separated SSL VPNs in different interfaces of the same VDOM
- BDifferent SSL VPN realms for each group
- CDifferent virtual SSLVPN IP addresses for each group
- DTwo firewall policies with different captive portals
16Examine the routing database.
Which of the following statements are correct? (Choose two.)
- AThe port3 default route has the lowest metric, making it the best route.
- BThere will be eight routes active in the routing table.
- CThe port3 default has a higher distance than the port1 and port2 default routes.
- DBoth port1 and port2 default routers are active in the routing table.
17View the exhibit.
When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?
- AThe user is required to authenticate before accessing sites with untrusted SSL certificates.
- BThe user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
- CThe user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
- DThe user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).
18View the exhibit.
When Role is set to Undefined, which statement is true?
- AThe GUI provides all the configuration options available for the port1 interface.
- BYou cannot configure a static IP address for the port1 interface because it allows only DHCP addressing mode.
- CFirewall policies can be created from only the port1 interface to any interface.
- DThe port1 interface is reserved for management only.
19Which statement is true regarding the policy ID numbers of firewall policies?
- AChange when firewall policies are re-ordered.
- BDefined the order in which rules are processed.
- CAre required to modify a firewall policy from the CLI.
- DRepresent the number of objects used in the firewall policy.
20An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?
- ADisabling split tunneling
- BConfiguring web bookmarks
- CAssigning public IP addresses to SSL VPN clients
- DUsing web-only mode
21Which traffic inspection features can be executed by a security processor (SP)? (Choose three.)
- ATCP SYN proxy
- BSIP session helper
- CProxy-based antivirus
- DAttack signature matching
- EFlow-based web filtering
22An administrator has configured two VLAN interfaces:
A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?
- ABoth interfaces must be in different VDOMs
- BBoth interfaces must have the same VLAN ID.
- CThe role of the VLAN10 interface must be set to server.
- DBoth interfaces must belong to the same forward domain.
23View the exhibit.
A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting.Games). Based on this configuration, which statement is true?
- AAddicting.Games is allowed based on the Application Overrides configuration.
- BAddicting.Games is blocked based on the Filter Overrides configuration.
- CAddicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
- DAddicting.Games is allowed based on the Categories configuration.
24What are the purposes of NAT traversal in IPsec? (Choose two.)
- ATo detect intermediary NAT devices in the tunnel path.
- BTo encapsulate ESP packets in UDP packets using port 4500.
- CTo force a new DH exchange with each phase 2 re-key
- DTo dynamically change phase 1 negotiation mode to Aggressive.
25Which statements about application control are true? (Choose two.)
- AEnabling application control profile in a security profile enables application control for all the traffic flowing through the FortiGate.
- BIt cannot take an action on unknown applications.
- CIt can inspect encrypted traffic.
- DIt can identify traffic from known applications, even when they are using non-standard TCP/UDP ports.
26View the exhibit.
The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:
What should be done next to troubleshoot the problem?
- AExecute another sniffer in the FortiGate, this time with the filter “host 10.0.1.10”.
- BRun a sniffer in the web server.
- CCapture the traffic using an external sniffer connected to port1.
- DExecute a debug flow.
27Which of the following statements about NTLM authentication are correct? (Choose two.)
- AIt is useful when users log in to DCs that are not monitored by a collector agent.
- BIt takes over as the primary authentication method when configured alongside FSSO.
- CMulti-domain environments require DC agents on every domain controller.
- DNTLM-enabled web browsers are required.
28What FortiGate feature can be used to allow IPv6 clients to connect to IPv4 servers?
- AIPv6-over-IPv4 IPsec
- BNAT64
- CIPv4-over-IPv6 IPsec
- DNAT66
29Which statements best describe auto discovery VPN (ADVPN). (Choose two.)
- AIt requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
- BADVPN is only supported with IKEv2.
- CTunnels are negotiated dynamically between spokes.
- DEvery spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
30View the exhibit.
Which statements about the exhibit are true? (Choose two.)
- Aport1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
- Bport1-VLAN1 is the native VLAN for the port1 physical interface.
- CTraffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
- DBroadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
31Which statement about the firewall policy authentication timeout is true?
- AIt is a hard timeout. The FortiGate removes the temporary policy for a user’s source IP address after this times expires.
- BIt is a hard timeout. The FortiGate removes the temporary policy for a user’s source MAC address after this times expires.
- CIt is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user’s source MAC address.
- DIt is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user’s source IP.
32Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)
- ATrusted host
- BHTTPS
- CTrusted authentication
- DSSH
- EFortiTelemetry
33If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?
- AIt blocks all future traffic for that IP address for a configured interval.
- BIt archives the data for that IP address.
- CIt provides a DLP block replacement page with a link to download the file.
- DIt notifies the administrator by sending an email.
34How can a browser trust a web-server certificate signed by a third party CA?
- AThe browser must have the CA certificate that signed the web-server certificate installed.
- BThe browser must have the web-server certificate installed.
- CThe browser must have the private key of CA certificate that signed the web-browser certificate installed.
- DThe browser must have the public key of the web-server certificate installed.
35How does FortiGate verify the login credentials of a remote LDAP user?
- AFortiGate sends the user entered credentials to the LDAP server for authentication.
- BFortiGate re-generates the algorithm based on the login credentials and compares it against the algorithm stored on the LDAP server.
- CFortiGate queries its own database for credentials.
- DFortiGate queries the LDAP server for credentials.
36An administrator has enabled proxy-based antivirus scanning and configured the following settings:
Which statement about the above configuration is true?
- AFiles bigger than 10 MB are not scanned for viruses and will be blocked.
- BFortiGate scans only the first 10 MB of any file.
- CFiles bigger than 10 MB are sent to the heuristics engine for scanning.
- DFortiGate scans the files in chunks of 10 MB.
37Examine this output from the diagnose sys top command:
Which statements about the output are true? (Choose two.)
- Asshd is the process consuming most memory
- Bsshd is the process consuming most CPU
- CAll the processes listed are in sleeping state
- DThe sshd process is using 123 pages of memory
38An administrator has created a custom IPS signature. Where does the custom IPS signature have to be applied?
- AIn an IPS sensor
- BIn an interface.
- CIn a DoS policy.
- DIn an application control profile.
39An administrator wants to configure a FortiGate as a DNS server. The FortiGate must use its DNS database first, and then relay all irresolvable queries to an external DNS server. Which of the following DNS method must you use?
- ANon-recursive
- BRecursive
- CForward to primary and secondary DNS
- DForward to system DNS
40What information is flushed when the chunk-size value is changed in the config dlp settings?
- AThe database for DLP document fingerprinting
- BThe supported file types in the DLP filters
- CThe archived files and messages
- DThe file name patterns in the DLP filters
41How does FortiGate select the central SNAT policy that is applied to a TCP session?
- AIt selects the SNAT policy specified in the configuration of the outgoing interface.
- BIt selects the first matching central-SNAT policy from top to bottom.
- CIt selects the central-SNAT policy with the lowest priority.
- DIt selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.
42When using WPAD DNS method, what is the FQDN format that browsers use to query the DNS server?
- Awpad.<local-domain>
- Bsrv_tcp.wpad.<local-domain>
- Csrv_proxy.<local-domain>/wpad.dat
- Dproxy.<local-domain>.wpad
43An administrator is using the FortiGate built-in sniffer to capture HTTP traffic between a client and a server, however, the sniffer output shows only the packets related with TCP session setups and disconnections. Why?
- AThe administrator is running the sniffer on the internal interface only.
- BThe filter used in the sniffer matches the traffic only in one direction.
- CThe FortiGate is doing content inspection.
- DTCP traffic is being offloaded to an NP6.
44Which of the following statements about advanced AD access mode for FSSO collector agent are true? (Choose two.)
- AIt is only supported if DC agents are deployed.
- BFortiGate can act as an LDAP client configure the group filters.
- CIt supports monitoring of nested groups.
- DIt uses the Windows convention for naming, that is, Domain\Username.
45Which configuration objects can be selected for the Source filed of a firewall policy? (Choose two.)
- AFQDN address
- BIP pool
- CUser or user group
- DFirewall service
46Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
- A10.200.1.1
- B10.0.1.254
- CAny available IP address in the WAN(port1) subnet 10.200.1.0/24
- D10.200.1.10
47Which statement about data leak prevention (DLP) on a FortiGate is true?
- ATraffic shaping can be applied to DLP sensors.
- BIt can be applied to a firewall policy in a flow-based VDOM.
- CFiles can be sent to FortiSandbox for detecting DLP threats.
- DIt can archive files and messages.
48Which statements about an IPv6-over-IPv4 IPsec configuration are correct? (Choose two.)
- AThe remote gateway IP must be an IPv6 address.
- BThe source quick mode selector must be an IPv4 address.
- CThe local gateway IP must an IPv4 address.
- DThe destination quick mode selector must be an IPv6 address.
49Which statements about DNS filter profiles are true? (Choose two.)
- AThey can inspect HTTP traffic.
- BThey must be applied in firewall policies with SSL inspection enabled.
- CThey can block DNS request to known botnet command and control servers.
- DThey can redirect blocked requests to a specific portal.
50An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)
- ALogs must be stored on FortiGate first, before transmitting to FortiAnalyzer
- BFortiGate uses port 8080 for log transmission
- CLog messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).
- DFortiGate can encrypt communications using SSL encrypted OFTP traffic.
51Which of the following statements describe WMI polling mode for FSSO collector agent? (Choose two.)
- AThe collector agent does not need to search any security event logs.
- BWMI polling can increase bandwidth usage with large networks.
- CThe NetSessionEnum function is used to track user logoffs.
- DThe collector agent uses a Windows API to query DCs for user logins.
52An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)
- AThe interface has been configured for one-arm sniffer.
- BThe interface is a member of a virtual wire pair.
- CThe operation mode is transparent.
- DThe interface is a member of a zone.
- ECaptive portal is enabled in the interface.
53When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?
- AThe FortiGate unit’s public IP address
- BThe FortiGate unit’s internal IP address
- CThe remote user’s virtual IP address
- DThe remote user’s public IP address
54View the example routing table.
Which route will be selected when trying to reach 10.20.30.254?
- A10.20.30.0/26 [10/0] via 172.20.168.254, port2
- BThe traffic will be dropped because it cannot be routed.
- C10.20.30.0/24 [10/0] via 172.20.167.254, port3
- D0.0.0.0/0 [10/0] via 172.20.121.2, port1
55Which statements about IP-based explicit proxy authentication are true? (Choose two.)
- AIP-based authentication is best suited to authenticating users behind a NAT device.
- BSessions from the same source address are treated as a single user.
- CIP-based authentication consumes less FortiGate’s memory than session-based authentication.
- DFortiGate remembers authenticated sessions using browser cookies.
56Which statements about high availability (HA) for FortiGates are true? (Choose two.)
- AVirtual clustering can be configured between two FortiGate devices with multiple VDOM.
- BHeartbeat interfaces are not required on the primary device.
- CHA management interface settings are synchronized between cluster members.
- DSessions handled by UTM proxy cannot be synchronized.
57Which statement about the FortiGuard services for the FortiGate is true?
- AAntivirus signatures are downloaded locally on the FortiGate.
- BFortiGate downloads IPS updates using UDP port 53 or 8888.
- CFortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.
- DThe web filtering database is downloaded locally on the FortiGate.
58Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)
- AThe antivirus engine starts scanning a file after the last packet arrives.
- BIt does not support FortiSandbox inspection.
- CFortiGate can insert the block replacement page during the first connection attempt only if a virus is detected at the start of the TCP stream.
- DIt uses the compact antivirus database.
59An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?
- AA phase 2 configuration is not required.
- BThis VPN cannot be used as part of a hub and spoke topology.
- CThe IPsec firewall policies must be placed at the top of the list.
- DA virtual IPsec interface is automatically created after the phase 1 configuration is completed.
60The administrator needs to confirm that FortiGate 2 is properly routing that traffic to the 10.0.1.0/24 subnet. The administrator needs to confirm it by sending ICMP pings to FortiGate 2 from the CLI of FortiGate 1. What ping option needs to be enabled before running the ping?
- AExecute ping-options source port1
- BExecute ping-options source 10.200.1.1.
- CExecute ping-options source 10.200.1.2
- DExecute ping-options source 10.0.1.254
61How can you format the FortiGate flash disk?
- ALoad the hardware test (HQIP) image.
- BExecute the CLI command execute formatlogdisk.
- CLoad a debug FortiOS image.
- DSelect the format boot device option from the BIOS menu.
62How do you configure inline SSL inspection on a firewall policy? (Choose two.)
- AEnable one or more flow-based security profiles on the firewall policy.
- BEnable the SSL/SSH Inspection profile on the firewall policy.
- CExecute the inline ssl inspection CLI command.
- DEnable one or more proxy-based security profiles on the firewall policy.
63Which traffic sessions can be offloaded to a NP6 processor? (Choose two.)
- AIPv6
- BRIP
- CGRE
- DNAT64
64Based on this output, which statements are correct? (Choose two.)
- AFortiGate generated an event log for system conserve mode.
- BFortiGate has entered in to system conserve mode.
- CBy default, the FortiGate blocks new sessions.
- DFortiGate changed the global av-failopen settings to idledrop.
65An administrator has blocked Netflix login in a cloud access security inspection (CASI) profile. The administrator has also applied the CASI profile to a firewall policy. What else is required for the CASI profile to work properly?
- AYou must enable logging for security events on the firewall policy.
- BYou must activate a FortiCloud account.
- CYou must apply an application control profile to the firewall policy.
- DYou must enable SSL inspection on the firewall policy.
66How does FortiGate look for a matching firewall policy to process traffic?
- AFrom top to bottom, based on the sequence numbers.
- BBased on best match.
- CFrom top to bottom, based on the policy ID numbers.
- DFrom lower to higher, based on the priority value.
67How do you configure a FortiGate to do traffic shaping of P2P traffic, such as BitTorrent?
- AApply an application control profile allowing BitTorrent to a firewall policy and configure a traffic shaping policy.
- BEnable the shape option in a firewall policy with service set to BitTorrent.
- CApply a traffic shaper to a BitTorrent entry in the SSL/SSH inspection profile.
- DApply a traffic shaper to a protocol options profile.
68Which file names will match the *.tiff file name pattern configured in a data leak prevention filter? (Choose two.)
- Atiff.tiff
- Btiff.png
- Ctiff.jpeg
- Dgif.tiff
69An administrator has configured a dialup IPsec VPN with XAuth. Which method statement best describes this scenario?
- AOnly digital certificates will be accepted as an authentication method in phase 1.
- BDialup clients must provide a username and password for authentication.
- CPhase 1 negotiations will skip pre-shared key exchange.
- DDialup clients must provide their local ID during phase 2 negotiations.
70Examine this output from a debug flow
Which statements about the output are correct? (Choose two.)
- AFortiGate received a TCP SYN/ACK packet.
- BThe source IP address of the packet was translated to 10.0.1.10.
- CFortiGate routed the packet through port 3.
- DThe packet was allowed by the firewall policy with the ID 00007fc0.
71Which component of FortiOS performs application control inspection?
- AKernel
- BAntivirus engine
- CIPS engine
- DApplication control engine
72Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)
- AThey support GRE-over-IPsec.
- BThey can be configured in both NAT/Route and transparent operation modes.
- CThey require two firewall policies: one for each direction of traffic flow.
- DThey support L2TP-over-IPsec.
73What statement describes what DNS64 does?
- AConverts DNS A record lookups to AAAA record lookups.
- BTranslates the destination IPv6 address of the DNS traffic to an IPv4 address.
- CSynthesizes DNS AAAA records from A records.
- DTranslates the destination IPv4 address of the DNS traffic to an IPv6 address.
74What does the command diagnose debuf fsso-polling refresh-user do?
- AIt refreshes user group information form any servers connected to the FortiGate using a collector agent.
- BIt refreshes all users learned through agentless polling.
- CIt displays status information and some statistics related with the polls done by FortiGate on each DC.
- DIt enables agentless polling mode real-time debug.
75Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?
- AThe FortiGate is able to handle NATed connections only with aggressive mode.
- BFortiClient supports aggressive mode.
- CThe remote peers are able to provide their peer IDs in the first message with aggressive mode.
- DMain mode does not support XAuth for user authentication.
76An administrator has configured the following settings:
What does the configuration do? (Choose two.)
- AReduces the amount of logs generated by denied traffic.
- BEnforces device detection on all interfaces for 30 minutes.
- CBlocks denied users for 30 minutes.
- DCreates a session for traffic being denied.
77Which statements about FortiGate inspection modes are true? (Choose two.)
- AThe default inspection mode is proxy based.
- BSwitching from proxy-based mode to flow-based, then back to proxy-based mode, will not result in the original configuration.
- CProxy-based inspection is not available in VDOMs operating in transparent mode.
- DFlow-based profiles must be manually converted to proxy-based profiles before changing the inspection mode from flow based to proxy based.
78Examine the following interface configuration on a FortiGate in transparent mode:
Which statement about this configuration is correct?
- AThe FortiGate generates spanning tree BPDU frames.
- BThe FortiGate device forwards received spanning tree BPDU frames.
- CThe FortiGate can block an interface if a layer-2 loop is detected.
- DEthernet layer-2 loops are likely to occur.
79Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
- ABrowsers can be configured to retrieve this PAC file from the FortiGate.
- BAny web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
- CAll requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- DAny web request fortinet.com is allowed to bypass the proxy.
80In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?
- AClient > primary FortiGate> secondary FortiGate> primary FortiGate> web server.
- BClient > secondary FortiGate> web server.
- CClient >secondary FortiGate> primary FortiGate> web server.
- DClient> primary FortiGate> secondary FortiGate> web server.
81A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. Which statement about the VLAN IDs in this scenario is true?
- AThe two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs.
- BThe two VLAN sub-interfaces must have different VLAN IDs.
- CThe two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in the same subnet.
- DThe two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets.
82Which of the following statements are true when using Web Proxy Auto-discovery Protocol (WPAD) with the DHCP discovery method? (Choose two.)
- AThe browser sends a DHCPINFORM request to the DHCP server.
- BThe browser will need to be preconfigured with the DHCP server’s IP address.
- CThe DHCP server provides the PAC file for download.
- DIf the DHCP method fails, browsers will try the DNS method.
83What inspections are executed by the IPS engine? (Choose three.)
- AApplication control
- BFlow-based data leak prevention
- CProxy-based antispam
- DFlow-based web filtering
- EProxy-based antivirus
84Examine the exhibit.
A client workstation is connected to FortiGate port2. The Fortigate port1 is connected to an ISP router. Port2 and port3 are both configured as a software switch. What IP address must be configured in the workstation as the default gateway?
- AThe port2’s IP address
- BThe router’s IP address.
- CThe FortiGate’s management IP address.
- DThe software switch interface’s IP address.
85Which of the following statements about central NAT are true? (Choose two.)
- AIP tool references must be removed from existing firewall policies before enabling central NAT.
- BCentral NAT can be enabled or disabled from the CLI only.
- CSource NAT, using central NAT, requires at least one central SNAT policy.
- DDestination NAT, using central NAT, requires a VIP object as the destination address in a firewall policy.
86Which of the following statements about the FSSO collector agent timers is true?
- AThe dead entry timeout interval is used to age out entries with an unverified status.
- BThe workstation verify interval is used to periodically check if a workstation is still a domain member.
- CThe user group cache expiry is used to age out the monitored groups.
- DThe IP address change verify interval monitors the server IP address where the collector agent is installed, and updates the collector agent configuration if it changes.
87An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.
Which statement is correct based on this configuration?
- AThe MAC address 00:0c:29:29:38:da belongs to the port1 interface.
- BAccess to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.
- C00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.
- DThe IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.
88An administrator wants to create a policy-based IPsec VPN tunnel between two FortiGate devices.
Which configuration steps must be performed on both units to support this scenario? (Choose three.)- ADefine the phase 2 parameters.
- BSet the phase 2 encapsulation method to transport mode.
- CDefine at least one firewall policy, with the action set to IPsec.
- DDefine a route to the remote network over the IPsec tunnel.
- EDefine the phase 1 parameters, without enabling IPsec interface mode.
89View the Exhibit.
Which statements are correct based on this output? (Choose two.)
- AThe global configuration is synchronized between the primary and secondary FortiGate.
- BThe all VDOM is not synchronized between the primary and secondary FortiGate.
- CThe root VDOM is not synchronized between the primary and secondary FortiGate.
- DThe FortiGates have three VDOMs.
Information
- Description
- Historia Quiz on Practica NSE4, created by Mauricio Gutierrez on 02/11/2017.
- Author
- Mauricio Gutierrez
- Language
- Español
- Views
- 500
- Tags
- Rating
- No ratings yet Rate this quiz