Quiz
NSE 4
Questions in this quiz (110)
1Which of the following regular expression patterns make the terms "confidential data" case
insensitive?- A[confidential data]
- B/confidential data/i
- Ci/confidential data/
- D"confidential data"/
2Which statements are correct regarding virtual domains (VDOMs)? (Choose two.)
- AVDOMs divide a single FortiGate unit into two or more virtual units that each have dedicated
memory and CPUs. - BA management VDOM handles SNMP, logging, alert email, and FDN-based updates.)
- CVDOMs share firmware versions, as well as antivirus and IPS databases.
- DDifferent time zones can be configured in each VDOM.
- AVDOMs divide a single FortiGate unit into two or more virtual units that each have dedicated
3Which statements are true regarding IPv6 anycast addresses? (Choose two.)
- AMultiple interfaces can share the same anycast address.
- BThey are allocated from the multicast address space.ss.
- CDifferent nodes cannot share the same anycast address.
- DAn anycast packet is routed to the nearest interface.
4In HA, the option Reserve Management Port for Cluster Member is selected as shown in the
exhibit below.
Which statements are correct regarding this setting? (Choose two.)
- AInterface settings on port7 will not be synchronized with other cluster members.
- BThe IP address assigned to this interface must not overlap with the IP address subnet assigned to
another interface. - CWhen connecting to port7 you always connect to the master device.
- DA gateway address may be configured for port7.
5Which tasks fall under the responsibility of the SSL proxy in a typical HTTPS connection?
(Choose two.)- AThe web client SSL handshake.
- BThe web server SSL handshake.
- CFile buffering.
- DCommunication with the URL filter process.
6Which statements are true regarding traffic shaping that is applied in an application sensor, and
associated with a firewall policy? (Choose two.)- AShared traffic shaping cannot be used.
- BOnly traffic matching the application control signature is shaped.
- CCan limit the bandwidth usage of heavy traffic applications.
- DPer-IP traffic shaping cannot be used.
7The FortiGate port1 is connected to the Internet. The FortiGate port2 is connected to the internal network. Examine the firewall configuration shown in the exhibit; then answer the question below.
Based on the firewall configuration illustrated in the exhibit, which statement is correct?
- AA user that has not authenticated can access the Internet using any protocol that does not trigger
an authentication challenge. - BA user that has not authenticated can access the Internet using any protocol except HTTP, HTTPS,
Telnet, and FTP. - CA user must authenticate using the HTTP, HTTPS, SSH, FTP, or Telnet protocol before they can
access all Internet services. - DDNS Internet access is always allowed, even for users that has not authenticated.
- AA user that has not authenticated can access the Internet using any protocol that does not trigger
8Review the IPsec phase 2 configuration shown in the exhibit; then answer the question below.
Which statements are correct regarding this configuration? (Choose two.).
- AThe Phase 2 will re-key even if there is no traffic.
- BThere will be a DH exchange for each re-key.
- CThe sequence number of ESP packets received from the peer will not be checked.
- DQuick mode selectors will default to those used in the firewall policy.
9Which of the following statements are correct about the HA command diagnose sys ha resetuptime?
(Choose two.)- AThe device this command is executed on is likely to switch from master to slave status if override is
disabled. - BThe device this command is executed on is likely to switch from master to slave status if override is
enabled. - CThis command has no impact on the HA algorithm.
- DThis command resets the uptime variable used in the HA algorithm so it may cause a
new master to become elected.
- AThe device this command is executed on is likely to switch from master to slave status if override is
10When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP
address is used as the source of the HTTP request?- AThe remote user's virtual IP address.
- BThe FortiGate unit's internal IP address.
- CThe remote user's public IP address.
- DThe FortiGate unit's external IP address.rithm.
11Which two web filtering inspection modes inspect the full URL? (Choose two.)
- ADNS-based.
- BProxy-based.
- CFlow-based.
- DURL-based.
12Which statement correctly describes the output of the command diagnose ips anomaly list?
- ALists the configured DoS policy.
- BList the real-time counters for the configured DoS policy.
- CLists the errors captured when compiling the DoS policy.
- DLists the IPS signature matches.
13Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit.
Which statements is correct regarding this output? (Select one answer).
- AOne tunnel is rekeying.
- BTwo tunnels are rekeying.
- CTwo tunnels are up.
- DOne tunnel is up.
14Which statement describes what the CLI command diagnose debug authd fsso list is used for?
- AMonitors communications between the FSSO collector agent and FortiGate unit.
- BDisplays which users are currently logged on using FSSO.
- CDisplays a listing of all connected FSSO collector agents.
- DLists all DC Agents installed on all domain controllers.
15Which statements are correct properties of a partial mesh VPN deployment. (Choose two.
- AVPN tunnels interconnect between every single location.
- BVPN tunnels are not configured between every single location.
- CSome locations are reached via a hub location.
- DThere are no hub locations in a partial mesh.
16Examine the exhibit below; then answer the question following it.
In this scenario, the FortiGate unit in Ottawa has the following routing table:
S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2
C 172.20.167.0/24 is directly connected, port1
C 172.20.170.0/24 is directly connected, port2
Sniffer tests show that packets sent from the source IP address 172.20.168.2 to the destination IP
address 172.20.169.2 are being dropped by the FortiGate located in Ottawa. Which of the following correctly describes the cause for the dropped packets?
- AThe forward policy check
- BThe reverse path forwarding check.
- CThe subnet 172.20.169.0/24 is NOT in the Ottawa FortiGate's routing table.
- DThe destination workstation 172.20.169.2 does NOT have the subnet 172.20.168.0/24 in its routing table.
17Which statements are correct regarding application control? (Choose two.).
- AIt is based on the IPS engine.
- BIt is based on the AV engine.
- CIt can be applied to SSL encrypted traffic.
- DApplication control cannot be applied to SSL encrypted traffic.
18Which statement regarding the firewall policy authentication timeout is true?
- AIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
coming from the user's source IP. - BIt is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address
after this timer has expired. - CIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
coming from the user's source MAC. - DIt is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address
after this timer has expired.
- AIt is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets
19An administrator wants to create an IPsec VPN tunnel between two FortiGate devices.
Which three configuration steps must be performed on both units to support this scenario? (Choose
three.)- ACreate firewall policies to allow and control traffic between the source and destination IP
addresses.) - BConfigure the appropriate user groups to allow users access to the tunnel.
- CSet the operating mode to IPsec VPN mode.
- DDefine the phase 2 parameters.
- EDefine the Phase 1 parameters.
- ACreate firewall policies to allow and control traffic between the source and destination IP
20Which statements are correct regarding an IPv6 over IPv4 IPsec configuration? (Choose two.)
- AThe source quick mode selector must be an IPv4 address.
- BThe destination quick mode selector must be an IPv6 address.
- CThe Local Gateway IP must be an IPv4 address.
- DThe remote gateway IP must be an IPv6 address.
21Examine the static route configuration shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.1.0 255.255.255.0
set device port1 set gateway 172.11.12.1
set distance 10
set weight 5
next
edit 2
set dst 172.20.1.0 255.255.255.0
set blackhole enable
set distance 5
set weight 10
next
end
Which of the following statements correctly describes the static routing configuration provided? (Choose two.)- AAll traffic to 172.20.1.0/24 is dropped by the FortiGate.
- BAs long as port1 is up, all traffic to 172.20.1.0/24 is routed by the static route number 1. If the interface port1 is down, the traffic is routed using the blackhole route.
- CThe FortiGate unit does NOT create a session entry in the session table when the traffic is being routed by the blackhole route.
- DThe FortiGate unit creates a session entry in the session table when the traffic is being routed by the blackhole route.
22Which network protocols are supported for administrative access to a FortiGate unit? (Choose
three.)- ASNMP
- BWINS
- CHTTP
- DTelnet
- ESSH
23Which header field can be used in a firewall policy for traffic matching?
- AICMP type and code.
- BDSCP.
- CTCP window size.
- DTCP sequence number.
24Which statements are correct for port pairing and forwarding domains? (Choose two.)
- AThey both create separate broadcast domains.
- BPort Pairing works only for physical interfaces.
- CForwarding Domain only applies to virtual interfaces.
- DThey may contain physical and/or virtual interfaces.
25An administrator has formed a high availability cluster involving two FortiGate units.
[ Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer2 switches ]
The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster.
Which of the following options describes the best step the administrator can take?
The administrator should _____________________.- AIncrease the number of FortiGate units in the cluster and configure HA in active-active mode.
- BEnable monitoring of all active interfaces.
- CSet up a full-mesh design which uses redundant interfaces.
- DConfigure the HA ping server feature to allow for HA failover in the event that a path is disrupted.
26When the SSL proxy is NOT doing man-in-the-middle interception of SSL traffic, which certificate field can be used to determine the rating of a website?
- AOrganizational Unit.
- BCommon Name.
- CSerial Number.
- DValidity.
27A user logs into a SSL VPN portal and activates the tunnel mode. The administrator has enabled split tunneling. The exhibit shows the firewall policy configuration:
Which static route is automatically added to the client's routing table when the tunnel mode is activated?- AA route to a destination subnet matching the Internal_Servers address object.
- BA route to the destination subnet configured in the tunnel mode widget.
- CA default route.
- DA route to the destination subnet configured in the SSL VPN global settings.
28Examine the following output from the diagnose sys session list command:
session info: proto=6 proto_state=65 duration=3 expire=9 timeout=3600
flags=00000000 sockflag=00000000 sockport=443 av_idx=9 use=5
origin-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic13895Bps
reply-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic 13895Bps
state=redir local may_dirty ndr npu nlb os rs
statistic(bytes/packets/allow_err): org=864/8/1 reply=2384/7/1 tuples=3
orgin->sink: org pre->post, reply pre->post dev=7->6/6->7 gwy=172.17.87.3/10.1.10.1
hook=post dir=org act=snat 192.168.1.110:57999->74.201.86.29:443(172.17.87.16:57999)
hook=pre dir=reply act=dnat 74.201.86.29:443->172.17.87.16:57999(192.168.1.110:57999)
hook=post dir=reply act=noop 74.201.86.29:443->192.168.1.110:57999(0.0.0.0:0)
misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=0
npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0/0
Which statements are true regarding the session above? (Choose two.)- ASession Time-To-Live (TTL) was configured to 9 seconds.
- BFortiGate is doing NAT of both the source and destination IP addresses on all packets coming from
the 192.168.1.110 address. - CThe IP address 192.168.1.110 is being translated to 172.17.87.16.
- DThe FortiGate is not translating the TCP port numbers of the packets in this session.
29Review the static route configuration for IPsec shown in the exhibit; then answer the question below.
Which statements are correct regarding this configuration? (Choose two.)
- AInterface remote is an IPsec interface.
- BA gateway address is not required because the interface is a point-to-point connection.
- CA gateway address is not required because the default route is used.
- DInterface remote is a zone.
30Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing
security profile (UTM) inspection over all the user traffic. What statements are true regarding the
sessions that the master unit is offloading to the slave unit for inspection? (Choose two.)- AThey are accelerated by hardware in the master unit.nit.
- BThey are not accelerated by hardware in the master unit.
- CThey are accelerated by hardware in the slave unit.unit.
- DThey are not accelerated by hardware in the slave unit.
31In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate operating in NAT/Route mode, when searching for a suitable gateway?)
- AA lookup is done only when the first packet coming from the client (SYN) arrives.
- BA lookup is done when the first packet coming from the client (SYN) arrives, and a second one is
performed when the first packet coming from the server (SYN/ACK) arrives. - CThree lookups are done during the TCP 3-way handshake (SYN, SYN/ACK, ACK).
- DA lookup is always done each time a packet arrives, from either the server or the client side.
32In which process states is it impossible to interrupt/kill a process? (Choose two.)
- AS - Sleep
- BR - Running
- CD - Uninterruptable Sleep
- DZ - Zombie
33The order of the firewall policies is important. Policies can be re-ordered from either the GUI or the CLI.
Which CLI command is used to perform this function?- Aset order
- Bedit policy
- Creorder
- Dmove
34Which statements are correct regarding URL filtering on a FortiGate unit? (Choose two.)
- AThe allowed actions for URL filtering include allow, block, monitor and exempt.
- BThe allowed actions for URL filtering are Allow and Block only.
- CURL filters may be based on patterns using simple text, wildcards and regular expressions.
- DURL filters are based on simple text only and require an exact match.
35Regarding the header and body sections in raw log messages, which statement is correct?
- AThe header and body section layouts change depending on the log type.
- BThe header section layout is always the same regardless of the log type. The body section layout
changes depending on the log type. - CSome log types include multiple body sections.
- DSome log types do not include a body section.
36Which statements correctly describe transparent mode operation? (Choose three.)
- AThe FortiGate acts as transparent bridge and forwards traffic at Layer-2.
- BEthernet packets are forwarded based on destination MAC addresses, NOT IP addresses.
- CThe transparent FortiGate is clearly visible to network hosts in an IP trace route.
- DPermits inline traffic inspection and firewalling without changing the IP scheme of the network.
- EAll interfaces of the transparent mode FortiGate device must be on different IP subnets.
37Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 10
set device port1
next
edit 2
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 20
set device port2
next
end
Which of the following statements correctly describes the static routing configuration provided above?- AThe FortiGate evenly shares the traffic to 172.20.168.0/24 through both routes.
- BThe FortiGate shares the traffic to 172.20.168.0/24 through both routes, but the port2 route will carry approximately twice as much of the traffic.
- CThe FortiGate sends all the traffic to 172.20.168.0/24 through port1.
- DOnly the route that is using port1 will show up in the routing table.
38When creating FortiGate administrative users, which configuration objects specify the account rights??
- ARemote access profiles.
- BUser groups.
- CAdministrator profiles.
- DLocal-in policies.iles.
39FSSO provides a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows active directory.
Which of the following statements are correct regarding FSSO in a Windows domain environment when agent mode is used? (Choose two.))- AAn FSSO collector agent must be installed on every domain controller.
- BAn FSSO domain controller agent must be installed on every domain controller.
- CThe FSSO domain controller agent will regularly update user logon information on the FortiGate
unit. - DThe FSSO collector agent will receive user logon information from the domain controller agent and
will send it to the FortiGate unit.
40A FortiGate is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.
Which of the following settings will this administrator be able to configure? (Choose two.)- AFirewall addresses.
- BDHCP servers.
- CFortiGuard Distribution Network configuration.
- DSystem hostname.
41Which statement is an advantage of using a hub and spoke IPsec VPN configuration instead of a fully-meshed set of IPsec tunnels?
- AUsing a hub and spoke topology provides full redundancy.
- BUsing a hub and spoke topology requires fewer tunnels.
- CUsing a hub and spoke topology uses stronger encryption protocols.
- DUsing a hub and spoke topology requires more routes.
42Bob wants to send Alice a file that is encrypted using public key cryptography.
Which of the following statements is correct regarding the use of public key cryptography in this scenario?- ABob will use his private key to encrypt the file and Alice will use her private key to decrypt the file.
- BBob will use his public key to encrypt the file and Alice will use Bob's private key to decrypt the file.
- CBob will use Alice's public key to encrypt the file and Alice will use her private key to decrypt the file.
- DBob will use his public key to encrypt the file and Alice will use her private key to decrypt the file.
43What is a valid reason for using session based authentication instead of IP based authentication in a FortiGate web proxy solution?
- AUsers are required to manually enter their credentials each time they connect to a different web site.
- BProxy users are authenticated via FSSO.
- CThere are multiple users sharing the same IP address.
- DProxy users are authenticated via RADIUS.
44Which two methods are supported by the web proxy auto-discovery protocol (WPAD) to automatically learn the URL where a PAC file is located? (Choose two.)
- ADHCP
- BBOOTP
- CDNS
- DIPv6 autoconfiguration
45The exhibit shows the Disconnect Cluster Member command in a FortiGate unit that is part of a HA cluster with two HA members.
What is the effect of the Disconnect Cluster Member command as given in the exhibit. (Choose two.)
- APort3 is configured with an IP address for management access.
- BThe firewall rules are purged on the disconnected unit.
- CThe HA mode changes to standalone.FSSO.
- DThe system hostname is set to the unit serial number.
46What capabilities can a FortiGate provide? (Choose three.)
- AMail relay.
- BEmail filtering.
- CFirewall.
- DVPN gateway.
- EMail server.
47With FSSO, a domain user could authenticate either against the domain controller running the collector agent and domain controller agent, or a domain controller running only the domain controller agent.
- AThe login event is sent to the collector agent.
- BThe FortiGate receives the user information directly from the receiving domain controller agent of the secondary domain controller.
- CThe domain collector agent may perform a DNS lookup for the authenticated client's IP address.
- DThe user cannot be authenticated with the FortiGate in this manner because each domain
controller agent requires a dedicated collector agent.
48What functions can the IPv6 Neighbor Discovery protocol accomplish? (Choose two.)
- ANegotiate the encryption parameters to use.
- BAuto-adjust the MTU setting.
- CAutoconfigure addresses and prefixes.
- DDetermine other nodes reachability.
49Review the configuration for FortiClient IPsec shown in the exhibit.
Which statement is correct regarding this configuration?
- AThe connecting VPN client will install a route to a destination corresponding to the student_internal address object.
- BThe connecting VPN client will install a default route.
- CThe connecting VPN client will install a route to the 172.20.1.[1-5] address range.
- DThe connecting VPN client will connect in web portal mode and no route will be installed.
50For data leak prevention, which statement describes the difference between the block and quarantine actions?
- AA block action prevents the transaction. A quarantine action blocks all future transactions,
regardless of the protocol. - BA block action prevents the transaction. A quarantine action archives the data.
- CA block action has a finite duration. A quarantine action must be removed by an administrator.
- DA block action is used for known users. A quarantine action is used for unknown users.
- AA block action prevents the transaction. A quarantine action blocks all future transactions,
51Examine at the output below from the diagnose sys top command:
# diagnose sys top 1
RunTime: 11 days, 3 hours and 29 minutes
0U, 0N, 1S, 99I; 971T, 528F, 160KF
sshd 123 S 1.9 1.2
ipsengine 61 S < 0.0 5.2
miglogd 45 S 0.0 4.9
pyfcgid 75 S 0.0 4.5
pyfcgid 73 S 0.0 3.9
Which statements are true regarding the output above?- AThe sshd process is the one consuming most CPU.
- BThe sshd process is using 123 pages of memory.
- CThe command diagnose sys kill miglogd will restart the miglogd process.
- DAll the processes listed are in sleeping state.
52A static route is configured for a FortiGate unit from the CLI using the following commands:
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions are required for this static default route to be displayed in
the FortiGate unit's routing table?- AThe administrative status of the wan1 interface is displayed as down.
- BThe link status of the wan1 interface is displayed as up.
- CAll other default routes should have a lower distance.
- DThe wan1 interface address and gateway address are on the same subnet.
53Which IPsec mode includes the peer id information in the first packet?
- AMain mode.
- BQuick mode.
- CAggressive mode.
- DIKEv2 mode.mode.
54Review the IPsec phase 1 configuration in the exhibit; then answer the question below.
Which statements are correct regarding this configuration? (Choose two.)
- AThe remote gateway address on 10.200.3.1
- BThe local IPsec interface address is 10.200.3.1
- CThe local gateway IP is the address assigned to port1.
- DThe local gateway IP address is 10.200.3.1
55Data leak prevention archiving gives the ability to store files and message data onto a FortiAnalyzer unit for which of the following types of network traffic? (Choose three.)
- APOP3
- BSNMP
- CIPsec
- DSMTP
- EHTTP
56Review the IPS sensor filter configuration shown in the exhibit
Based on the information in the exhibit, which statements are correct regarding the filter? (Choose two.)
- AIt does not log attacks targeting Linux servers.
- BIt matches all traffic to Linux servers.
- CIts action will block traffic matching these signatures.
- DIt only takes effect when the sensor is applied to a policy.
57How is the FortiGate password recovery process?
- AInterrupt boot sequence, modify the boot registry and reboot. After changing the password, reset the boot registry.
- BLog in through the console port using the "maintainer" account within several seconds of physically
power cycling the FortiGate. - CHold down the CTRL + Esc (Escape) keys during reboot, then reset the admin password.
- DInterrupt the boot sequence and restore a configuration file for which the password has been modified.
58Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit below.
Which statements are correct regarding this output? (Choose two.)
- AThe connecting client has been allocated address 172.20.1.1
- BIn the Phase 1 settings, dead peer detection is enabled.
- CThe tunnel is idle.
- DThe connecting client has been allocated address 10.200.3.1.
59Which firewall objects can be included in the Destination Address field of a firewall policy? (Choose three.)
- AIP address pool.
- BVirtual IP address.
- CIP address
- DIP address group.
- EMAC address.
60A FortiGate is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received.
Which are two reasons for this problem? (Choose two.)- AThe FortiGate is connected to multiple ISPs.
- BThere is a NAT device between the FortiGate and the FortiGuard Distribution Network.
- CThe FortiGate is in Transparent mode.
- DThe external facing interface of the FortiGate is configured to get the IP address from a DHCP server.
61In transparent mode, forward-domain is an CLI setting associate with ______________.
- Aa static route.
- Ba firewall policy.
- Can interface.
- Da virtual domain.
62A FortiGate is configured with three virtual domains (VDOMs).
Which of the following statements is correct regarding multiple VDOMs?- AThe FortiGate must be a model 1000 or above to support multiple VDOMs.
- BA license has to be purchased and applied to the FortiGate before VDOM mode could be enabled.
- CChanging the operational mode of a VDOM requires a reboot of the FortiGate.
- DThe FortiGate supports any combination of VDOMs in NAT/Route and transparent modes.
63How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent?
- AApply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a
firewall policy. - BEnable the shape option in a firewall policy with service set to BitTorrent.
- CDefine a DLP rule to match against BitTorrent traffic and include the rule in a DLP sensor with
traffic shaping enabled. - DApply a traffic shaper to a protocol options profile.
- AApply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a
64Review the output of the command get router info routing-table database shown in the
exhibit below; then answer the question following it.
Which two statements are correct regarding this output? (Choose two.)
- AThere will be six routes in the routing table.
- BThere will be seven routes in the routing table.
- CThere will be two default routes in the routing table.
- DThere will be two routes for the 10.0.2.0/24 subnet in the routing table.
65What is the maximum number of FortiAnalyzer/FortiManager devices a FortiGate unit can be
configured to send logs to?- A1
- B2
- C3
- D4
66Which antivirus inspection mode must be used to scan SMTP, FTP, POP3 and SMB protocols?
- AProxy-based.
- BDNS-based.
- CFlow-based.
- DMan-in-the-middle.
67Which statements are true regarding the factory default configuration? (Choose three.)?
- AThe default web filtering profile is applied to the first firewall policy.
- BThe 'Port1' or 'Internal' interface has the IP address 192.168.1.99.
- CThe implicit firewall policy action is ACCEPT.
- DThe 'Port1' or 'Internal' interface has a DHCP server set up and enabled (on device models that
support DHCP servers). - EDefault login uses the username: admin (all lowercase) and no password.
68Which statement is correct regarding virus scanning on a FortiGate unit?
- AVirus scanning is enabled by default.
- BFortinet customer support enables virus scanning remotely for you. unit?
- CVirus scanning must be enabled in a security profile, which must be applied to a firewall policy.
- DEnabling virus scanning in a security profile enables virus protection for all traffic flowing through
the FortiGate.
69Examine the following FortiGate web proxy configuration; then answer the question below:
config web-proxy explicit
set pac-file-server-status enable
set pac-file-server-port 8080
set pac-filename wpad.dat
end
Assuming that the FortiGate proxy IP address is 10.10.1.1, which URL must an Internet browser use to download the PAC file?- Ahttps://10.10.1.1:8080
- Bhttps://10.10.1.1:8080/wpad.dat
- Chttp://10.10.1.1:8080/
- Dhttp://10.10.1.1:8080/wpad.dat
70In a high availability cluster operating in active-active mode, which of the following correctly
describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?- ARequest: internal host; slave FortiGate; master FortiGate; Internet; web server.
- BRequest: internal host; slave FortiGate; Internet; web server.
- CRequest: internal host; slave FortiGate; master FortiGate; Internet; web server
- DRequest: internal host; master FortiGate; slave FortiGate; Internet; web server.
71For traffic that does match any configured firewall policy, what is the default action taken by the FortiGate?
- AThe traffic is allowed and no log is generated.
- BThe traffic is allowed and logged.
- CThe traffic is blocked and no log is generated.
- DThe traffic is blocked and logged.
72Which are two requirements for DC-agent mode FSSO to work properly in a Windows AD environment? [Choose two.]?
- ADNS server must properly resolve all workstation names.
- BThe remote registry service must be running in all workstations.
- CThe collector agent must be installed in one of the Windows domain controllers.
- DA same user cannot be logged in into two different workstations at the same time.
73What logging options are supported on a FortiGate unit? (Choose two.)
- ALDAP
- BSyslog
- CFortiAnalyzer
- DSNMP
74In which order are firewall policies processed on a FortiGate unit?
- AFrom top to down, according with their sequence number.
- BFrom top to down, according with their policy ID number.
- CBased on best match.
- DBased on the priority value.
75Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE.
Exhibit A shows the command output of diagnose sys session stat for the STUDENT device.
Exhibit B shows the command output of diagnose sys session stat for the REMOTE device.
Exhibit B: Given the information provided in the exhibits, which of the following statements are correct? (Choose two.)
- ASTUDENT is likely to be the master device.
- BSession-pickup is likely to be enabled.
- CThe cluster mode is active-passive.
- DThere is not enough information to determine the cluster mode.
76What are the requirements for a HA cluster to maintain TCP connections after device or link failover? (Choose two.)
- AEnable session pick-up.
- BEnable override.
- CConnections must be UDP or ICMP.
- DConnections must not be handled by a proxy.
77Examine the following CLI configuration:
config system session-ttl
set default 1800
end
What statement is true about the effect of the above configuration line?- ASessions can be idle for no more than 1800 seconds.
- BThe maximum length of time a session can be open is 1800 seconds.
- CAfter 1800 seconds, the end user must re-authenticate.
- DAfter a session has been open for 1800 seconds, the FortiGate sends a keepalive packet to both
client and server.
78Which statements regarding banned words are correct? (Choose two.)
- AContent is automatically blocked if a single instance of a banned word appears.
- BThe FortiGate updates banned words on a periodic basis.
- CThe FortiGate can scan web pages and email messages for instances of banned words.
- DBanned words can be expressed as simple text, wildcards and regular expressions.
79What methods can be used to access the FortiGate CLI? (Choose two.)
- AUsing SNMP.
- BA direct connection to the serial console port.
- CUsing the CLI console widget in the GUI.
- DUsing RCP.
80When firewall policy authentication is enabled, which protocols can trigger an authentication challenge? (Choose two.)
- ASMTP
- BPOP3
- CHTTP
- DFTP
81A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
Which one of the following statements is correct regarding the VLAN IDs in this scenario?- AThe two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different
subnets. - BThe two VLAN sub-interfaces must have different VLAN IDs.
- CThe two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs.
- DThe two VLAN sub-interfaces can have the same VLAN ID if they are connected to different L2 IEEE
802.1Q compliant switches.
- AThe two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different
82Which two statements are true regarding firewall policy disclaimers? (Choose two.)
- AThey cannot be used in combination with user authentication.
- BThey can only be applied to wireless interfaces.
- CUsers must accept the disclaimer to continue.
- DThe disclaimer page is customizable.
83Which statements are true regarding local user authentication? (Choose two.)
- ATwo-factor authentication can be enabled on a per user basis.
- BLocal users are for administration accounts only and cannot be used to authenticate network
users. - CAdministrators can create the user accounts is a remote server and store the user passwords
locally in the FortiGate. - DBoth the usernames and passwords can be stored locally on the FortiGate
84You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route-based mode.
Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route.
Which two configuration steps are required to achieve these objectives? (Choose two.)- ACreate one firewall policy.
- BCreate two firewall policies.
- CAdd a route to the remote subnet.
- D Add two IPsec phases 2.
85Examine the exhibit; then answer the question below.
The Vancouver FortiGate initially had the following information in its routing table: S 172.20.0.0/16 [10/0] via 172.21.1.2, port2 C 172.21.0.0/16 is directly connected, port2 C 172.11.11.0/24 is directly connected, port1
Afterwards, the following static route was added:
config router static edit 6
set dst 172.20.1.0 255.255.255.0
set pririoty 0
set device port1
set gateway 172.11.12.1
next
end
Since this change, the new static route is NOT showing up in the routing table.
Given the information provided, which of the following describes the cause of this problem?
- AThe subnet 172.20.1.0/24 is overlapped with the subnet of one static route that is already in the
routing table (172.20.0.0/16), so, we need to enable allow-subnet-overlap first. - BThe 'gateway' IP address is NOT in the same subnet as the IP address of port1.
- CThe priority is 0, which means that the route will remain inactive.
- DThe static route configuration is missing the distance setting.
- AThe subnet 172.20.1.0/24 is overlapped with the subnet of one static route that is already in the
86Regarding the use of web-only mode SSL VPN, which statement is correct?
- AIt supports SSL version 3 only.
- BIt requires a Fortinet-supplied plug-in on the web client.
- CIt requires the user to have a web browser that supports 64-bit cipher length.
- DThe JAVA run-time environment must be installed on the client.
87Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.)
- ASplit tunneling is supported.
- BIt requires the installation of a VPN client.
- CIt requires the use of an Internet browser.
- DIt does not support traffic from third-party network applications.
- EAn SSL VPN IP address is dynamically assigned to the client by the FortiGate unit.
88What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.)
- AConditional-forward.
- BForward-only.
- CNon-recursive.
- DIterative.
- ERecursive.
89Which statements are true regarding the use of a PAC file to configure the web proxy settings in an Internet browser? (Choose two.)
- AOnly one proxy is supported.
- BCan be manually imported to the browser.
- CThe browser can automatically download it from a web server.
- DCan include a list of destination IP subnets where the browser can connect directly to without
using a proxy.
90Which of the following sequences describes the correct order of criteria used for the selection of a master unit within a FortiGate high availability (HA) cluster when override is disabled?
- A1. port monitor, 2. unit priority, 3. up time, 4. serial number.
- B1. port monitor, 2. up time, 3. unit priority, 4. serial number.
- C1. unit priority, 2. up time, 3. port monitor, 4. serial number.
- D1. up time, 2. unit priority, 3. port monitor, 4. serial number.
91Which is one of the conditions that must be met for offloading the encryption and decryption of IPsec traffic to an NP6 processor?
- ANo protection profile can be applied over the IPsec traffic.
- BPhase-2 anti-replay must be disabled.
- CBoth the phase 1 and phases 2 must use encryption algorithms supported by the NP6.
- Dsec traffic must not be inspected by any FortiGate session helper.
92Which is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying a FortiGate unit?
- AMIB-based report uploads.
- BSNMP access limited by access lists.
- CPacket encryption.
- DRunning SNMP service on a non-standard port is possible.
93Examine the following log message for IPS:
2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly pri=alert vd=root
severity="critical" src="192.168.3.168" dst="192.168.3.170" src_int="port2" serial=0
status="detected" proto=1 service="icmp" count=1 attack_name="icmp_flood" icmp_id="0xa8a4"
icmp_type="0x08" icmp_code="0x00" attack_id=16777316 sensor="1"
ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold 50"
Which statement is correct about the above log? (Choose two.)- AThe target is 192.168.3.168.
- BThe target is 192.168.3.170.
- CThe attack was NOT blocked.
- DThe attack was blocked.
94Which antivirus and attack definition update options are supported by FortiGate units? (Choose two.)
- AManual update by downloading the signatures from the support site.
- BPull updates from the FortiGate.
- CPush updates from a FortiAnalyzer.
- Dexecute fortiguard-AV-AS command from the CLI.
95Review the IKE debug output for IPsec shown in the exhibit below.
Which statements is correct regarding this output?
- AThe output is a phase 1 negotiation.
- BThe output is a phase 2 negotiation.
- CThe output captures the dead peer detection messages.
- DThe output captures the dead gateway detection packets.
96Which IPsec configuration mode can be used for implementing GRE-over-IPsec VPNs?
- APolicy-based only.
- BRoute-based only.
- CEither policy-based or route-based VPN.
- DGRE-based only.
97What is IPsec Perfect Forwarding Secrecy (PFS)?
- AA phase-1 setting that allows the use of symmetric encryption.
- BA phase-2 setting that allows the recalculation of a new common secret key each time the session
key expires. - CA 'key-agreement' protocol.
- DA 'security-association-agreement' protocol.
98Which web filtering inspection mode inspects DNS traffic?
- ADNS-based
- BFQDN-based
- CFlow-based
- DURL-based
99A FortiGate administrator with the super_admin profile configures a virtual domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in the GUI in the management VDOM.
What would be a possible cause for this problem?- AThe administrator does not have the proper permissions to reassign the dmz interface.
- BThe dmz interface is referenced in the configuration of another VDOM.
- CNon-management VDOMs cannot reference physical interfaces.
- DThe dmz interface is in PPPoE or DHCP mode.
100What methods can be used to deliver the token code to a user that is configured to use two factor authentication? (Choose three.)
- ABrowser pop-up window.
- BFortiToken.
- CEmail.
- DCode books.
- ESMS phone message
101Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.)
- AFragmented packet.
- BMulticast packet.
- CSCTP packet
- DGRE packet
102When does a FortiGate load-share traffic between two static routes to the same destination subnet?
- AWhen they have the same cost and distance.
- BWhen they have the same distance and the same weight.
- CWhen they have the same distance and different priority.
- DWhen they have the same distance and same priority.
103Which statements are true about offloading antivirus inspection to a Security Processor (SP)? (Choose two.)
- ABoth proxy-based and flow-based inspection are supported.
- BA replacement message cannot be presented to users when a virus has been detected.
- CIt saves CPU resources.
- DThe ingress and egress interfaces can be in different SPs
104Examine the exhibit; then answer the question below.
Which statement describes the green status indicators that appear next to the different FortiGuard Distribution Network services as illustrated in the exhibit?
- AThey indicate that the FortiGate has the latest updates available from the FortiGuard Distribution
Network. - BThey indicate that updates are available and should be downloaded from the FortiGuard
Distribution Network to the FortiGate unit - CThey indicate that the FortiGate is in the process of downloading updates from the FortiGuard
Distribution Network. - DThey indicate that the FortiGate is able to connect to the FortiGuard Distribution Network.
- AThey indicate that the FortiGate has the latest updates available from the FortiGuard Distribution
105Which statement is one disadvantage of using FSSO NetAPI polling mode over FSSO Security Event Log (WinSecLog) polling mode?
- AIt requires a DC agent installed in some of the Windows DC
- BIt runs slower.
- CIt might miss some logon events
- DIt requires access to a DNS server for workstation name resolution.
106A FortiGate unit is configured with three Virtual Domains (VDOMs) as illustrated in the exhibit.
Which of the following statements are true if the network administrator wants to route traffic between all the VDOMs? (Choose three.)
- AThe administrator can configure inter-VDOM links to avoid using external interfaces and routers.
- BAs with all FortiGate unit interfaces, firewall policies must be in place for traffic to be allowed to
pass through any interface, including inter-VDOM links. - CThis configuration requires a router to be positioned between the FortiGate unit and the Internet
for proper routing. - DInter-VDOM routing is automatically provided if all the subnets that need to be routed are locally
attached. - EAs each VDOM has an independent routing table, routing rules need to be set (for example, static
routing, OSPF) in each VDOM to route traffic between VDOMs.
107An administrator has configured a route-based site-to-site IPsec VPN.
Which statement is correct regarding this IPsec VPN configuration?- AThe IPsec firewall policies must be placed at the top of the list
- BThis VPN cannot be used as part of a hub and spoke topology.
- CRoutes are automatically created based on the quick mode selectors.
- DA virtual IPsec interface is automatically created after the Phase 1 configuration is completed.
108Which two statements are true about IPsec VPNs and SSL VPNs? (Choose two.)
- ASSL VPN creates a HTTPS connection. IPsec does not.
- BBoth SSL VPNs and IPsec VPNs are standard protocols.
- CEither a SSL VPN or an IPsec VPN can be established between two FortiGate devices.
- DEither a SSL VPN or an IPsec VPN can be established between an end-user workstation and a
FortiGate device.
109Examine the following spanning tree configuration on a FortiGate in transparent mode:
config system interface
edit <interface name>
set stp-forward enable
end- AThe FortiGate participates in spanning tree.
- BThe FortiGate device forwards received spanning tree messages.
- CEthernet layer-2 loops are likely to occur.
- DThe FortiGate generates spanning tree BPDU frames.
110Two FortiGate devices fail to form an HA cluster, the device hostnames are STUDENT and
REMOTE. Exhibit A shows the command output of show system ha for the STUDENT device. Exhibit B
shows the command output of show system ha for the REMOTE device.
Which one of the following is the most likely reason that the cluster fails to form?
- APassword
- BHA mode
- CHearbeat
- DOverride
Information
- Description
- Quiz on NSE 4, created by rhughes07 on 15/09/2015.
- Author
- rhughes07
- Language
- English
- Views
- 639
- History
- Created on 15 Sep 2015 · updated on 28 Feb 2017
- Rating
- 5.0 out of 5 · 3 ratings Rate this quiz