NSE4_FGT-6.0 Online Practice Questions and Answers

When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?

A. It must be configured in a static route using the sdwan virtual interface.

B. It must be provided in the SD-WAN member interface configuration.

C. It must be configured in a policy-route using the sdwan virtual interface.

D. It must be learned automatically through a dynamic routing protocol.

An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?

A. Phase 1 negotiations will skip preshared key exchange.

B. Only digital certificates will be accepted as an authentication method in phase 1.C

C. Dialup clients must provide a username and password for authentication.

D. Dialup clients must provide their local ID during phase 2 negotiations.

Examine this FortiGate configuration: How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

A. It always authorizes the traffic without requiring authentication.

B. It drops the traffic.

C. It authenticates the traffic using the authentication scheme SCHEME2.

D. It authenticates the traffic using the authentication scheme SCHEME1.

An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

A. A phase 2 configuration is not required.

B. This VPN cannot be used as part of a hub-and-spoke topology.

C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

D. The IPsec firewall policies must be placed at the top of the list.

If traffic matches a DLP filter with the action set to Quarantine IP Address, what action does FortiGate take?

A. It notifies the administrator by sending an email.

B. It provides a DLP block replacement page with a link to download the file.

C. It blocks all future traffic for that IP address for a configured interval.

D. It archives the data for that IP address.

View the certificate shown to the exhibit, and then answer the following question: The CA issued this certificate to which entity?

A. A root CA

B. A person

C. A bridge CA

D. A subordinate CA

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

A. By default, FortiGate uses WINS servers to resolve names.

B. By default, the SSL VPN portal requires the installation of a client's certificate.

C. By default, split tunneling is enabled.

D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.

Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

A. The firmware image must be manually uploaded to each FortiGate.

B. Only secondary FortiGate devices are rebooted.

C. Uninterruptable upgrade is enabled by default.

D. Traffic load balancing is temporally disabled while upgrading the firmware.

Which statement regarding the firewall policy authentication timeout is true?

A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

An administrator wants to configure a FortiGate as a DNS server. FotiGate must use a DNS database first, and then relay all irresolvable queries to an external DNS server. Which of the following DNS methods must you use?

A. Recursive

B. Non-recursive

C. Forward to primary and secondary DNS

D. Forward to system DNS