Fortinet NSE4_FGT-6.2 Guidance 2021

NEW QUESTION 1
An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

• A. A phase 2 configuration is not required.
• B. This VPN cannot be used as part of a hub-and-spoke topology.
• C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
• D. The IPsec firewall policies must be placed at the top of the list.

Answer: C

Explanation:
In a route-based configuration, FortiGate automatically adds a virtual interface eith the VPN name (Infrastructure Study Guide, 206)

NEW QUESTION 2
You have tasked to design a new IPsec deployment with the following criteria: Which topology should be used to satisfy all of the requirements?

• A. Partial mesh
• B. Hub-and-spoke
• C. Fully meshed
• D. Redundant

Answer: B

NEW QUESTION 3
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

• A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
• B. ADVPN is only supported with IKEv2.
• C. Tunnels are negotiated dynamically between spokes.
• D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Answer: AC

NEW QUESTION 4
View the certificate shown to the exhibit, and then answer the following question:

The CA issued this certificate to which entity?

• A. A root CA
• B. A person
• C. A bridge CA
• D. A subordinate CA

Answer: A

NEW QUESTION 5
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

• A. This is known as many-to-one NAT.
• B. Source IP is translated to the outgoing interface IP.
• C. Connections are tracked using source port and source MAC address.
• D. Port address translation is not used.

Answer: AB

NEW QUESTION 6
Which one of the following processes is involved in updating IPS from FortiGuard?

• A. FortiGate IPS update requests are sent using UDP port 443.
• B. Protocol decoder update requests are sent to service.fortiguard.net.
• C. IPS signature update requests are sent to update.fortiguard.net.
• D. IPS engine updates can only be obtained using push updates.

Answer: C

Explanation:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ports-and-protocols-54/07-FortiGuard.htm

NEW QUESTION 7
View the exhibit:

Whichhe FortiGate handle web proxy traffic rue? (Choose two.)

• A. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
• B. port-VLAN1 is the native VLAN for the port1 physical interface.
• C. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
• D. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Answer: AC

NEW QUESTION 8
An administrator needs to strengthen the security for SSL VPN access. Which of the following statements are best practices to do so? (Choose three.)

• A. Configure split tunneling for content inspection.
• B. Configure host restrictions by IP or MAC address.
• C. Configure two-factor authentication using security certificates.
• D. Configure SSL offloading to a content processor (FortiASIC).
• E. Configure a client integrity check (host-check).

Answer: BCE

NEW QUESTION 9
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

• A. To remove the NAT operation.
• B. To generate logs
• C. To finish any inspection operations.
• D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Answer: D

NEW QUESTION 10
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

• A. The firmware image must be manually uploaded to each FortiGate.
• B. Only secondary FortiGate devices are rebooted.
• C. Uninterruptable upgrade is enabled by default.
• D. Traffic load balancing is temporally disabled while upgrading the firmware.

Answer: BD

NEW QUESTION 11
View the exhibit.

Why is the administrator getting the error shown in the exhibit?

• A. The administrator must first enter the command edit global.
• B. The administrator admin does not have the privileges required to configure global settings.
• C. The global settings cannot be configured from the root VDOM context.
• D. The command config system global does not exist in FortiGate.

Answer: C

NEW QUESTION 12
Which of the following statements are best practices for troubleshooting FSSO? (Choose two.)

• A. Include the group of guest users in a policy.
• B. Extend timeout timers.
• C. Guarantee at least 34 Kbps bandwidth between FortiGate and domain controllers.
• D. Ensure all firewalls allow the FSSO required ports.

Answer: AD

NEW QUESTION 13
What criteria does FortiGate use to look for a matching firewall policy to process traffic? (Choose two.)

• A. Services defined in the firewall policy.
• B. Incoming and outgoing interfaces
• C. Highest to lowest priority defined in the firewall policy.
• D. Lowest to highest policy ID number.

Answer: AB

NEW QUESTION 14
Why must you use aggressive mode when a local FortiGate IPSec gateway hosts multiple dialup tunnels?

• A. In aggressive mode, the remote peers are able to provide their peer IDs in the first message.
• B. FortiGate is able to handle NATed connections only in aggressive mode.
• C. FortiClient only supports aggressive mode.
• D. Main mode does not support XAuth for user authentication.

Answer: A

NEW QUESTION 15
Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

• A. The public key of the web server certificate must be installed on the browser.
• B. The web-server certificate must be installed on the browser.
• C. The CA certificate that signed the web-server certificate must be installed on the browser.
• D. The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Answer: C

NEW QUESTION 16
View the exhibit.

Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two.)

• A. Access to all unknown applications will be allowed.
• B. Access to browser-based Social.Media applications will be blocked.
• C. Access to mobile social media applications will be blocked.
• D. Access to all applications in Social.Media category will be blocked.

Answer: AB

NEW QUESTION 17
Which of the following statements are true when using WPAD with the DHCP discovery method? (Choose two.)

• A. If the DHCP method fails, browsers will try the DNS method.
• B. The browser needs to be preconfigured with the DHCP server’s IP address.
• C. The browser sends a DHCPONFORM request to the DHCP server.
• D. The DHCP server provides the PAC file for download.

Answer: AC

NEW QUESTION 18
View the following exhibit, which shows the firewall policies and the object uses in the firewall policies.


The administrator is using the Policy Lookup feature and has entered the search create shown in the following exhibit.

Which of the following will be highlighted based on the input criteria?

• A. Policy with ID1.
• B. Policies with ID 2 and 3.
• C. Policy with ID 5.
• D. Policy with ID 4.

Answer: A

NEW QUESTION 19
An administrator has configured the following settings:

What does the configuration do? (Choose two.)

• A. Reduces the amount of logs generated by denied traffic.
• B. Enforces device detection on all interfaces for 30 minutes.
• C. Blocks denied users for 30 minutes.
• D. Creates a session for traffic being denied.

Answer: AD

NEW QUESTION 20
Examine the routing database shown in the exhibit, and then answer the following question:

Which of the following statements are correct? (Choose two.)

• A. The port3 default route has the highest distance.
• B. The port3 default route has the lowest metric.
• C. There will be eight routes active in the routing table.
• D. The port1 and port2 default routes are active in the routing table.

Answer: AD

NEW QUESTION 21
What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

• A. Traffic to botnetservers
• B. Traffic to inappropriate web sites
• C. Server information disclosure attacks
• D. Credit card data leaks
• E. SQL injection attacks

Answer: ACE

NEW QUESTION 22
Which of the following features is supported by web filter in flow-based inspection mode with NGFW mode set to profile-based?

• A. FortiGuard Quotas
• B. Static URL
• C. Search engines
• D. Rating option

Answer: B

NEW QUESTION 23
......