Practica NSE4

Este test está cronometrado.

Tienes 1 hora para completar 89 preguntas de este test.

Iniciar Test

Por favor espera - en proceso…

Pregunta 1 de 89

A FortiGate interface is configured with the following commands:

What statements about the configuration are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.
FortiGate can provide DNS settings to IPv6 clients.
FortiGate can send IPv6 router advertisements (RAs.)
FortiGate can provide IPv6 addresses to DHCPv6 client.

Explicación

Pregunta 2 de 89

Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 89

Under what circumstance would you enable LEARN as the Action on a firewall policy?

Selecciona una de las siguientes respuestas posibles:

You want FortiGate to compile security feature activity from various security-related logs, such as virus and attack logs.
You want FortiGate to monitor a specific security profile in a firewall policy, and provide recommendations for that profile.
You want to capture data across all traffic and security vectors, and receive learning logs and a report with recommendations.
You want FortiGate to automatically modify your firewall policies as it learns your networking behavior.

Explicación

Pregunta 4 de 89

What methods can be used to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Code blocks
SMS phone message
FortiToken
Browser pop-up window
Email

Explicación

Pregunta 5 de 89

You are tasked to architect a new IPsec deployment with the following criteria:
- There are two HQ sites that all satellite offices must connect to.
- The satellite offices do not need to communicate directly with other satellite offices.
- No dynamic routing will be used.
- The design should minimize the number of tunnels being configured.
Which topology should be used to satisfy all of the requirements?

Selecciona una de las siguientes respuestas posibles:

Redundant
Hub-and-spoke
Partial mesh
Fully meshed

Explicación

Pregunta 6 de 89

View the exhibit.
Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

This is a redundant IPsec setup.
The TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
This setup requires at least two firewall policies with action set to IPsec.
Dead peer detection must be disabled to support this type of IPsec setup.

Explicación

Pregunta 7 de 89

What is FortiGate’s behavior when local disk logging is disabled?

Selecciona una de las siguientes respuestas posibles:

Only real-time logs appear on the FortiGate dashboard.
No logs are generated.
Alert emails are disabled.
Remote logging is automatically enabled.

Explicación

Pregunta 8 de 89

What traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Traffic to inappropriate web sites
SQL injection attacks
Server information disclosure attacks
Credit card data leaks
Traffic to botnet command and control (C&C) servers

Explicación

Pregunta 9 de 89

Which statements about One-to-One IP pool are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It allows configuration of ARP replies.
It allows fixed mapping of an internal address range to an external address range.
It is used for destination NAT.
It does not use port address translation.

Explicación

Pregunta 10 de 89

Which statements correctly describe transparent mode operation? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

All interfaces of the transparent mode FortiGate device must be on different IP subnets.
The transparent FortiGate is visible to network hosts in an IP traceroute.
It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
The FortiGate acts as transparent bridge and forwards traffic at Layer-2.

Explicación

Pregunta 11 de 89

View the exhibit.
What is the effect of the Disconnect Cluster Member operation as shown in the exhibit? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The HA mode changes to standalone.
The firewall policies are deleted on the disconnected member.
The system hostname is set to the FortiGate serial number.
The port3 is configured with an IP address for management access.

Explicación

Pregunta 12 de 89

What step is required an SSL VPN to access to an internal server using port forward mode?

Selecciona una de las siguientes respuestas posibles:

Configure the virtual IP addresses to be assigned to the SSL VPN users.
Install FortiClient SSL VPN client
Create a SSL VPN realm reserved for clients using port forward mode.
Configure the client application to forward IP traffic to a Java applet proxy.

Explicación

Pregunta 13 de 89

View the exhibit.
This is a sniffer output of a telnet connection request from 172.20.120.186 to the port1 interface of FGT1.
In this scenario. FGT1 has the following routing table:
Assuming telnet service is enabled for port1, which of the following statements correctly describes why FGT1 is not responding?

Selecciona una de las siguientes respuestas posibles:

The port1 cable is disconnected.
The connection is dropped due to reverse path forwarding check.
The connection is denied due to forward policy check.
FGT1’s port1 interface is administratively down.

Explicación

Pregunta 14 de 89

An administrator needs to be able to view logs for application usage on your network. What configurations are required to ensure that FortiGate generates logs for application usage activity? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enable a web filtering profile on the firewall policy.
Create an application control policy.
Enable logging on the firewall policy.
Enable an application control security profile on the firewall policy.

Explicación

Pregunta 15 de 89

A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups. What is required in the SSL VPN configuration to meet these requirements?

Selecciona una de las siguientes respuestas posibles:

Two separated SSL VPNs in different interfaces of the same VDOM
Different SSL VPN realms for each group
Different virtual SSLVPN IP addresses for each group
Two firewall policies with different captive portals

Explicación

Pregunta 16 de 89

Examine the routing database.
Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The port3 default route has the lowest metric, making it the best route.
There will be eight routes active in the routing table.
The port3 default has a higher distance than the port1 and port2 default routes.
Both port1 and port2 default routers are active in the routing table.

Explicación

Pregunta 17 de 89

View the exhibit.
When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

Selecciona una de las siguientes respuestas posibles:

The user is required to authenticate before accessing sites with untrusted SSL certificates.
The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).

Explicación

Pregunta 18 de 89

View the exhibit.
When Role is set to Undefined, which statement is true?

Selecciona una de las siguientes respuestas posibles:

The GUI provides all the configuration options available for the port1 interface.
You cannot configure a static IP address for the port1 interface because it allows only DHCP addressing mode.
Firewall policies can be created from only the port1 interface to any interface.
The port1 interface is reserved for management only.

Explicación

Pregunta 19 de 89

Which statement is true regarding the policy ID numbers of firewall policies?

Selecciona una de las siguientes respuestas posibles:

Change when firewall policies are re-ordered.
Defined the order in which rules are processed.
Are required to modify a firewall policy from the CLI.
Represent the number of objects used in the firewall policy.

Explicación

Pregunta 20 de 89

An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?

Selecciona una de las siguientes respuestas posibles:

Disabling split tunneling
Configuring web bookmarks
Assigning public IP addresses to SSL VPN clients
Using web-only mode

Explicación

Pregunta 21 de 89

Which traffic inspection features can be executed by a security processor (SP)? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

TCP SYN proxy
SIP session helper
Proxy-based antivirus
Attack signature matching
Flow-based web filtering

Explicación

Pregunta 22 de 89

An administrator has configured two VLAN interfaces:

A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

Selecciona una de las siguientes respuestas posibles:

Both interfaces must be in different VDOMs
Both interfaces must have the same VLAN ID.
The role of the VLAN10 interface must be set to server.
Both interfaces must belong to the same forward domain.

Explicación

Pregunta 23 de 89

View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting.Games). Based on this configuration, which statement is true?

Selecciona una de las siguientes respuestas posibles:

Addicting.Games is allowed based on the Application Overrides configuration.
Addicting.Games is blocked based on the Filter Overrides configuration.
Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
Addicting.Games is allowed based on the Categories configuration.

Explicación

Pregunta 24 de 89

What are the purposes of NAT traversal in IPsec? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

To detect intermediary NAT devices in the tunnel path.
To encapsulate ESP packets in UDP packets using port 4500.
To force a new DH exchange with each phase 2 re-key
To dynamically change phase 1 negotiation mode to Aggressive.

Explicación

Pregunta 25 de 89

Which statements about application control are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enabling application control profile in a security profile enables application control for all the traffic flowing through the FortiGate.
It cannot take an action on unknown applications.
It can inspect encrypted traffic.
It can identify traffic from known applications, even when they are using non-standard TCP/UDP ports.

Explicación

Pregunta 26 de 89

View the exhibit.
The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:

What should be done next to troubleshoot the problem?

Selecciona una de las siguientes respuestas posibles:

Execute another sniffer in the FortiGate, this time with the filter “host 10.0.1.10”.
Run a sniffer in the web server.
Capture the traffic using an external sniffer connected to port1.
Execute a debug flow.

Explicación

Pregunta 27 de 89

Which of the following statements about NTLM authentication are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It is useful when users log in to DCs that are not monitored by a collector agent.
It takes over as the primary authentication method when configured alongside FSSO.
Multi-domain environments require DC agents on every domain controller.
NTLM-enabled web browsers are required.

Explicación

Pregunta 28 de 89

What FortiGate feature can be used to allow IPv6 clients to connect to IPv4 servers?

Selecciona una de las siguientes respuestas posibles:

IPv6-over-IPv4 IPsec
NAT64
IPv4-over-IPv6 IPsec
NAT66

Explicación

Pregunta 29 de 89

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
ADVPN is only supported with IKEv2.
Tunnels are negotiated dynamically between spokes.
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Explicación

Pregunta 30 de 89

View the exhibit.
Which statements about the exhibit are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
port1-VLAN1 is the native VLAN for the port1 physical interface.
Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

Explicación

Pregunta 31 de 89

Which statement about the firewall policy authentication timeout is true?

Selecciona una de las siguientes respuestas posibles:

It is a hard timeout. The FortiGate removes the temporary policy for a user’s source IP address after this times expires.
It is a hard timeout. The FortiGate removes the temporary policy for a user’s source MAC address after this times expires.
It is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user’s source MAC address.
It is an idle timeout. The FortiGate considers a user to be idle if it does not see any packets coming from the user’s source IP.

Explicación

Pregunta 32 de 89

Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Trusted host
HTTPS
Trusted authentication
SSH
FortiTelemetry

Explicación

Pregunta 33 de 89

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does the FortiGate take?

Selecciona una de las siguientes respuestas posibles:

It blocks all future traffic for that IP address for a configured interval.
It archives the data for that IP address.
It provides a DLP block replacement page with a link to download the file.
It notifies the administrator by sending an email.

Explicación

Pregunta 34 de 89

How can a browser trust a web-server certificate signed by a third party CA?

Selecciona una de las siguientes respuestas posibles:

The browser must have the CA certificate that signed the web-server certificate installed.
The browser must have the web-server certificate installed.
The browser must have the private key of CA certificate that signed the web-browser certificate installed.
The browser must have the public key of the web-server certificate installed.

Explicación

Pregunta 35 de 89

How does FortiGate verify the login credentials of a remote LDAP user?

Selecciona una de las siguientes respuestas posibles:

FortiGate sends the user entered credentials to the LDAP server for authentication.
FortiGate re-generates the algorithm based on the login credentials and compares it against the algorithm stored on the LDAP server.
FortiGate queries its own database for credentials.
FortiGate queries the LDAP server for credentials.

Explicación

Pregunta 36 de 89

An administrator has enabled proxy-based antivirus scanning and configured the following settings:

Which statement about the above configuration is true?

Selecciona una de las siguientes respuestas posibles:

Files bigger than 10 MB are not scanned for viruses and will be blocked.
FortiGate scans only the first 10 MB of any file.
Files bigger than 10 MB are sent to the heuristics engine for scanning.
FortiGate scans the files in chunks of 10 MB.

Explicación

Pregunta 37 de 89

Examine this output from the diagnose sys top command:

Which statements about the output are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

sshd is the process consuming most memory
sshd is the process consuming most CPU
All the processes listed are in sleeping state
The sshd process is using 123 pages of memory

Explicación

Pregunta 38 de 89

An administrator has created a custom IPS signature. Where does the custom IPS signature have to be applied?

Selecciona una de las siguientes respuestas posibles:

In an IPS sensor
In an interface.
In a DoS policy.
In an application control profile.

Explicación

Pregunta 39 de 89

An administrator wants to configure a FortiGate as a DNS server. The FortiGate must use its DNS database first, and then relay all irresolvable queries to an external DNS server. Which of the following DNS method must you use?

Selecciona una de las siguientes respuestas posibles:

Non-recursive
Recursive
Forward to primary and secondary DNS
Forward to system DNS

Explicación

Pregunta 40 de 89

What information is flushed when the chunk-size value is changed in the config dlp settings?

Selecciona una de las siguientes respuestas posibles:

The database for DLP document fingerprinting
The supported file types in the DLP filters
The archived files and messages
The file name patterns in the DLP filters

Explicación

Pregunta 41 de 89

How does FortiGate select the central SNAT policy that is applied to a TCP session?

Selecciona una de las siguientes respuestas posibles:

It selects the SNAT policy specified in the configuration of the outgoing interface.
It selects the first matching central-SNAT policy from top to bottom.
It selects the central-SNAT policy with the lowest priority.
It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

Explicación

Pregunta 42 de 89

When using WPAD DNS method, what is the FQDN format that browsers use to query the DNS server?

Selecciona una de las siguientes respuestas posibles:

wpad.<local-domain>
srv_tcp.wpad.<local-domain>
srv_proxy.<local-domain>/wpad.dat
proxy.<local-domain>.wpad

Explicación

Pregunta 43 de 89

An administrator is using the FortiGate built-in sniffer to capture HTTP traffic between a client and a server, however, the sniffer output shows only the packets related with TCP session setups and disconnections. Why?

Selecciona una de las siguientes respuestas posibles:

The administrator is running the sniffer on the internal interface only.
The filter used in the sniffer matches the traffic only in one direction.
The FortiGate is doing content inspection.
TCP traffic is being offloaded to an NP6.

Explicación

Pregunta 44 de 89

Which of the following statements about advanced AD access mode for FSSO collector agent are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

It is only supported if DC agents are deployed.
FortiGate can act as an LDAP client configure the group filters.
It supports monitoring of nested groups.
It uses the Windows convention for naming, that is, Domain\Username.

Explicación

Pregunta 45 de 89

Which configuration objects can be selected for the Source filed of a firewall policy? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

FQDN address
IP pool
User or user group
Firewall service

Explicación

Pregunta 46 de 89

Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Selecciona una de las siguientes respuestas posibles:

10.200.1.1
10.0.1.254
Any available IP address in the WAN(port1) subnet 10.200.1.0/24
10.200.1.10

Explicación

Pregunta 47 de 89

Which statement about data leak prevention (DLP) on a FortiGate is true?

Selecciona una de las siguientes respuestas posibles:

Traffic shaping can be applied to DLP sensors.
It can be applied to a firewall policy in a flow-based VDOM.
Files can be sent to FortiSandbox for detecting DLP threats.
It can archive files and messages.

Explicación

Pregunta 48 de 89

Which statements about an IPv6-over-IPv4 IPsec configuration are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The remote gateway IP must be an IPv6 address.
The source quick mode selector must be an IPv4 address.
The local gateway IP must an IPv4 address.
The destination quick mode selector must be an IPv6 address.

Explicación

Pregunta 49 de 89

Which statements about DNS filter profiles are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

They can inspect HTTP traffic.
They must be applied in firewall policies with SSL inspection enabled.
They can block DNS request to known botnet command and control servers.
They can redirect blocked requests to a specific portal.

Explicación

Pregunta 50 de 89

An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Logs must be stored on FortiGate first, before transmitting to FortiAnalyzer
FortiGate uses port 8080 for log transmission
Log messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).
FortiGate can encrypt communications using SSL encrypted OFTP traffic.

Explicación

Pregunta 51 de 89

Which of the following statements describe WMI polling mode for FSSO collector agent? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The collector agent does not need to search any security event logs.
WMI polling can increase bandwidth usage with large networks.
The NetSessionEnum function is used to track user logoffs.
The collector agent uses a Windows API to query DCs for user logins.

Explicación

Pregunta 52 de 89

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

The interface has been configured for one-arm sniffer.
The interface is a member of a virtual wire pair.
The operation mode is transparent.
The interface is a member of a zone.
Captive portal is enabled in the interface.

Explicación

Pregunta 53 de 89

When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

Selecciona una de las siguientes respuestas posibles:

The FortiGate unit’s public IP address
The FortiGate unit’s internal IP address
The remote user’s virtual IP address
The remote user’s public IP address

Explicación

Pregunta 54 de 89

View the example routing table.
Which route will be selected when trying to reach 10.20.30.254?

Selecciona una de las siguientes respuestas posibles:

10.20.30.0/26 [10/0] via 172.20.168.254, port2
The traffic will be dropped because it cannot be routed.
10.20.30.0/24 [10/0] via 172.20.167.254, port3
0.0.0.0/0 [10/0] via 172.20.121.2, port1

Explicación

Pregunta 55 de 89

Which statements about IP-based explicit proxy authentication are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IP-based authentication is best suited to authenticating users behind a NAT device.
Sessions from the same source address are treated as a single user.
IP-based authentication consumes less FortiGate’s memory than session-based authentication.
FortiGate remembers authenticated sessions using browser cookies.

Explicación

Pregunta 56 de 89

Which statements about high availability (HA) for FortiGates are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Virtual clustering can be configured between two FortiGate devices with multiple VDOM.
Heartbeat interfaces are not required on the primary device.
HA management interface settings are synchronized between cluster members.
Sessions handled by UTM proxy cannot be synchronized.

Explicación

Pregunta 57 de 89

Which statement about the FortiGuard services for the FortiGate is true?

Selecciona una de las siguientes respuestas posibles:

Antivirus signatures are downloaded locally on the FortiGate.
FortiGate downloads IPS updates using UDP port 53 or 8888.
FortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.
The web filtering database is downloaded locally on the FortiGate.

Explicación

Pregunta 58 de 89

Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The antivirus engine starts scanning a file after the last packet arrives.
It does not support FortiSandbox inspection.
FortiGate can insert the block replacement page during the first connection attempt only if a virus is detected at the start of the TCP stream.
It uses the compact antivirus database.

Explicación

Pregunta 59 de 89

An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?

Selecciona una de las siguientes respuestas posibles:

A phase 2 configuration is not required.
This VPN cannot be used as part of a hub and spoke topology.
The IPsec firewall policies must be placed at the top of the list.
A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

Explicación

Pregunta 60 de 89

The administrator needs to confirm that FortiGate 2 is properly routing that traffic to the 10.0.1.0/24 subnet. The administrator needs to confirm it by sending ICMP pings to FortiGate 2 from the CLI of FortiGate 1. What ping option needs to be enabled before running the ping?

Selecciona una de las siguientes respuestas posibles:

Execute ping-options source port1
Execute ping-options source 10.200.1.1.
Execute ping-options source 10.200.1.2
Execute ping-options source 10.0.1.254

Explicación

Pregunta 61 de 89

How can you format the FortiGate flash disk?

Selecciona una de las siguientes respuestas posibles:

Load the hardware test (HQIP) image.
Execute the CLI command execute formatlogdisk.
Load a debug FortiOS image.
Select the format boot device option from the BIOS menu.

Explicación

Pregunta 62 de 89

How do you configure inline SSL inspection on a firewall policy? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Enable one or more flow-based security profiles on the firewall policy.
Enable the SSL/SSH Inspection profile on the firewall policy.
Execute the inline ssl inspection CLI command.
Enable one or more proxy-based security profiles on the firewall policy.

Explicación

Pregunta 63 de 89

Which traffic sessions can be offloaded to a NP6 processor? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IPv6
RIP
GRE
NAT64

Explicación

Pregunta 64 de 89

Based on this output, which statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

FortiGate generated an event log for system conserve mode.
FortiGate has entered in to system conserve mode.
By default, the FortiGate blocks new sessions.
FortiGate changed the global av-failopen settings to idledrop.

Explicación

Pregunta 65 de 89

An administrator has blocked Netflix login in a cloud access security inspection (CASI) profile. The administrator has also applied the CASI profile to a firewall policy. What else is required for the CASI profile to work properly?

Selecciona una de las siguientes respuestas posibles:

You must enable logging for security events on the firewall policy.
You must activate a FortiCloud account.
You must apply an application control profile to the firewall policy.
You must enable SSL inspection on the firewall policy.

Explicación

Pregunta 66 de 89

How does FortiGate look for a matching firewall policy to process traffic?

Selecciona una de las siguientes respuestas posibles:

From top to bottom, based on the sequence numbers.
Based on best match.
From top to bottom, based on the policy ID numbers.
From lower to higher, based on the priority value.

Explicación

Pregunta 67 de 89

How do you configure a FortiGate to do traffic shaping of P2P traffic, such as BitTorrent?

Selecciona una de las siguientes respuestas posibles:

Apply an application control profile allowing BitTorrent to a firewall policy and configure a traffic shaping policy.
Enable the shape option in a firewall policy with service set to BitTorrent.
Apply a traffic shaper to a BitTorrent entry in the SSL/SSH inspection profile.
Apply a traffic shaper to a protocol options profile.

Explicación

Pregunta 68 de 89

Which file names will match the *.tiff file name pattern configured in a data leak prevention filter? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

tiff.tiff
tiff.png
tiff.jpeg
gif.tiff

Explicación

Pregunta 69 de 89

An administrator has configured a dialup IPsec VPN with XAuth. Which method statement best describes this scenario?

Selecciona una de las siguientes respuestas posibles:

Only digital certificates will be accepted as an authentication method in phase 1.
Dialup clients must provide a username and password for authentication.
Phase 1 negotiations will skip pre-shared key exchange.
Dialup clients must provide their local ID during phase 2 negotiations.

Explicación

Pregunta 70 de 89

Examine this output from a debug flow

Which statements about the output are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

FortiGate received a TCP SYN/ACK packet.
The source IP address of the packet was translated to 10.0.1.10.
FortiGate routed the packet through port 3.
The packet was allowed by the firewall policy with the ID 00007fc0.

Explicación

Pregunta 71 de 89

Which component of FortiOS performs application control inspection?

Selecciona una de las siguientes respuestas posibles:

Kernel
Antivirus engine
IPS engine
Application control engine

Explicación

Pregunta 72 de 89

Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

They support GRE-over-IPsec.
They can be configured in both NAT/Route and transparent operation modes.
They require two firewall policies: one for each direction of traffic flow.
They support L2TP-over-IPsec.

Explicación

Pregunta 73 de 89

What statement describes what DNS64 does?

Selecciona una de las siguientes respuestas posibles:

Converts DNS A record lookups to AAAA record lookups.
Translates the destination IPv6 address of the DNS traffic to an IPv4 address.
Synthesizes DNS AAAA records from A records.
Translates the destination IPv4 address of the DNS traffic to an IPv6 address.

Explicación

Pregunta 74 de 89

What does the command diagnose debuf fsso-polling refresh-user do?

Selecciona una de las siguientes respuestas posibles:

It refreshes user group information form any servers connected to the FortiGate using a collector agent.
It refreshes all users learned through agentless polling.
It displays status information and some statistics related with the polls done by FortiGate on each DC.
It enables agentless polling mode real-time debug.

Explicación

Pregunta 75 de 89

Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?

Selecciona una de las siguientes respuestas posibles:

The FortiGate is able to handle NATed connections only with aggressive mode.
FortiClient supports aggressive mode.
The remote peers are able to provide their peer IDs in the first message with aggressive mode.
Main mode does not support XAuth for user authentication.

Explicación

Pregunta 76 de 89

An administrator has configured the following settings:

What does the configuration do? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Reduces the amount of logs generated by denied traffic.
Enforces device detection on all interfaces for 30 minutes.
Blocks denied users for 30 minutes.
Creates a session for traffic being denied.

Explicación

Pregunta 77 de 89

Which statements about FortiGate inspection modes are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The default inspection mode is proxy based.
Switching from proxy-based mode to flow-based, then back to proxy-based mode, will not result in the original configuration.
Proxy-based inspection is not available in VDOMs operating in transparent mode.
Flow-based profiles must be manually converted to proxy-based profiles before changing the inspection mode from flow based to proxy based.

Explicación

Pregunta 78 de 89

Examine the following interface configuration on a FortiGate in transparent mode:

Which statement about this configuration is correct?

Selecciona una de las siguientes respuestas posibles:

The FortiGate generates spanning tree BPDU frames.
The FortiGate device forwards received spanning tree BPDU frames.
The FortiGate can block an interface if a layer-2 loop is detected.
Ethernet layer-2 loops are likely to occur.

Explicación

Pregunta 79 de 89

Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Browsers can be configured to retrieve this PAC file from the FortiGate.
Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
Any web request fortinet.com is allowed to bypass the proxy.

Explicación

Pregunta 80 de 89

In a high availability (HA) cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a secondary FortiGate?

Selecciona una de las siguientes respuestas posibles:

Client > primary FortiGate> secondary FortiGate> primary FortiGate> web server.
Client > secondary FortiGate> web server.
Client >secondary FortiGate> primary FortiGate> web server.
Client> primary FortiGate> secondary FortiGate> web server.

Explicación

Pregunta 81 de 89

A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. Which statement about the VLAN IDs in this scenario is true?

Selecciona una de las siguientes respuestas posibles:

The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs.
The two VLAN sub-interfaces must have different VLAN IDs.
The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in the same subnet.
The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets.

Explicación

Pregunta 82 de 89

Which of the following statements are true when using Web Proxy Auto-discovery Protocol (WPAD) with the DHCP discovery method? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The browser sends a DHCPINFORM request to the DHCP server.
The browser will need to be preconfigured with the DHCP server’s IP address.
The DHCP server provides the PAC file for download.
If the DHCP method fails, browsers will try the DNS method.

Explicación

Pregunta 83 de 89

What inspections are executed by the IPS engine? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Application control
Flow-based data leak prevention
Proxy-based antispam
Flow-based web filtering
Proxy-based antivirus

Explicación

Pregunta 84 de 89

Examine the exhibit.
A client workstation is connected to FortiGate port2. The Fortigate port1 is connected to an ISP router. Port2 and port3 are both configured as a software switch. What IP address must be configured in the workstation as the default gateway?

Selecciona una de las siguientes respuestas posibles:

The port2’s IP address
The router’s IP address.
The FortiGate’s management IP address.
The software switch interface’s IP address.

Explicación

Pregunta 85 de 89

Which of the following statements about central NAT are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

IP tool references must be removed from existing firewall policies before enabling central NAT.
Central NAT can be enabled or disabled from the CLI only.
Source NAT, using central NAT, requires at least one central SNAT policy.
Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall policy.

Explicación

Pregunta 86 de 89

Which of the following statements about the FSSO collector agent timers is true?

Selecciona una de las siguientes respuestas posibles:

The dead entry timeout interval is used to age out entries with an unverified status.
The workstation verify interval is used to periodically check if a workstation is still a domain member.
The user group cache expiry is used to age out the monitored groups.
The IP address change verify interval monitors the server IP address where the collector agent is installed, and updates the collector agent configuration if it changes.

Explicación

Pregunta 87 de 89

An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.
Which statement is correct based on this configuration?

Selecciona una de las siguientes respuestas posibles:

The MAC address 00:0c:29:29:38:da belongs to the port1 interface.
Access to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.
00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.
The IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.

Explicación

Pregunta 88 de 89

An administrator wants to create a policy-based IPsec VPN tunnel between two FortiGate devices.
Which configuration steps must be performed on both units to support this scenario? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Define the phase 2 parameters.
Set the phase 2 encapsulation method to transport mode.
Define at least one firewall policy, with the action set to IPsec.
Define a route to the remote network over the IPsec tunnel.
Define the phase 1 parameters, without enabling IPsec interface mode.

Explicación

Pregunta 89 de 89

View the Exhibit.

Which statements are correct based on this output? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

The global configuration is synchronized between the primary and secondary FortiGate.
The all VDOM is not synchronized between the primary and secondary FortiGate.
The root VDOM is not synchronized between the primary and secondary FortiGate.
The FortiGates have three VDOMs.

Explicación

["https://examtimeassets.s3.amazonaws.com/uploads/media/image/12704582/desktop_71470bd2-c0d3-455d-89d2-7586910689ba.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12704831/desktop_80058e7f-9787-4af4-82cd-bbd4029354e2.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12704932/desktop_3ddf2a9c-855c-46c1-9ca2-227f564b3a9b.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12704974/desktop_b710c6d7-60fd-43d1-8040-3a2d5978d7db.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705069/desktop_c5423e11-c783-462d-af2b-4b19c62b5442.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705094/desktop_29650900-de33-461e-aed0-76c0cc1fc1d2.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705116/desktop_2ee89edc-9f20-4150-89a2-a63f30b3df4b.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705381/desktop_9f335584-e7fd-4479-b3f7-af0c50904c5e.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705405/desktop_184eeba8-c4f0-4e47-adbf-1bad41f4d81b.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705507/desktop_159fdb6e-8f83-40fc-97e7-23f2c83304f5.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705587/desktop_ca2b9ee2-854e-4a61-883b-1e86a59b0b0b.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705680/desktop_829d4e07-995b-46eb-bf2c-64dc75d2ba17.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/12705696/desktop_5862ba69-2a0c-4e00-bbca-3392c15c7cd0.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16264707/desktop_7e88cf31-4581-4982-8e84-2b8fba51a446.png","https://examtimeassets.s3.amazonaws.com/uploads/media/image/14387028/desktop_db4ad893-2911-46f1-8e88-fce8f78f53d5.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16267009/desktop_5e066229-fa15-4f28-a8d2-091737389c65.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16269014/desktop_1f4dcf93-1a3f-4159-b861-827b8c26630d.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16271248/desktop_717f2309-dd79-472a-b446-23ffdac4592b.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16276867/desktop_062fdecb-40a1-4272-8dba-b462379a05c6.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16276920/desktop_8209f301-3497-4341-be6b-d7250e0cffe7.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16277024/desktop_2d2ac789-995b-477c-a8c4-c0d08a2fbb5c.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16278298/desktop_3fe19ad9-70e5-4679-9370-e5f21f7670d2.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16278427/desktop_936b3cbb-cc01-4218-b65c-183f1cba880f.PNG","https://examtimeassets.s3.amazonaws.com/uploads/media/image/16278661/desktop_e4fe8811-262f-49e7-9bf9-787937426f27.PNG"]

	Creado por Mauricio Gutierrez hace más de 8 años

Historia Test sobre Practica NSE4, creado por Mauricio Gutierrez el 02/11/2017.

Practica NSE4

Practica NSE4

Pregunta 1 de 89

A FortiGate interface is configured with the following commands: What statements about the configuration are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 89

Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 89

Under what circumstance would you enable LEARN as the Action on a firewall policy?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 89

What methods can be used to deliver the token code to a user who is configured to use two-factor authentication? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 89

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 89

View the exhibit. Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 89

What is FortiGate’s behavior when local disk logging is disabled?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 89

What traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 89

Which statements about One-to-One IP pool are true? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 89

Which statements correctly describe transparent mode operation? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 89

View the exhibit. What is the effect of the Disconnect Cluster Member operation as shown in the exhibit? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 89

What step is required an SSL VPN to access to an internal server using port forward mode?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 89

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 89

An administrator needs to be able to view logs for application usage on your network. What configurations are required to ensure that FortiGate generates logs for application usage activity? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 89

A company needs to provide SSL VPN access to two user groups. The company also needs to display different welcome messages on the SSL VPN login screen for both user groups. What is required in the SSL VPN configuration to meet these requirements?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 89

Examine the routing database. Which of the following statements are correct? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 89

View the exhibit. When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 89

View the exhibit. When Role is set to Undefined, which statement is true?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 89

Which statement is true regarding the policy ID numbers of firewall policies?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 89

An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?

Selecciona una de las siguientes respuestas posibles:

A FortiGate interface is configured with the following commands:

What statements about the configuration are correct? (Choose two.)

View the exhibit.
Which of the following statements are correct? (Choose two.)

View the exhibit.
What is the effect of the Disconnect Cluster Member operation as shown in the exhibit? (Choose two.)

Examine the routing database.
Which of the following statements are correct? (Choose two.)

View the exhibit.
When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

View the exhibit.
When Role is set to Undefined, which statement is true?

An administrator has configured two VLAN interfaces:

A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting.Games). Based on this configuration, which statement is true?

View the exhibit.
The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:

What should be done next to troubleshoot the problem?

View the exhibit.
Which statements about the exhibit are true? (Choose two.)

An administrator has enabled proxy-based antivirus scanning and configured the following settings:

Which statement about the above configuration is true?

Examine this output from the diagnose sys top command:

Which statements about the output are true? (Choose two.)