NSE4_FGT-6.4 Online Practice Questions and Answers

Refer to the exhibit, which contains a static route configuration.

An administrator created a static route for Amazon Web Services. What CLI command must the administrator use to view the route?

A. get router info routing-table all

B. get internet service route list

C. get router info routing-table database

D. diagnose firewall proute list

An administrator has configured the following settings: What are the two results of this configuration? (Choose two.)

A. Device detection on all interfaces is enforced for 30 minutes.

B. Denied users are blocked for 30 minutes.

C. A session for denied traffic is created.

D. The number of logs generated by denied traffic is reduced.

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

B. ADVPN is only supported with IKEv2.

C. Tunnels are negotiated dynamically between spokes.

D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Which two statements are true about the FGCP protocol? (Choose two.)

A. Not used when FortiGate is in Transparent mode

B. Elects the primary FortiGate device

C. Runs only over the heartbeat links

D. Is used to discover FortiGate devices in different HA groups

Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

A. Traffic between port2 and port2-vlan1 is allowed by default.

B. port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

C. port1 is a native VLAN.

D. port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

How do you format the FortiGate flash disk?

A. Load a debug FortiOS image.

B. Load the hardware test (HQIP) image.

C. Execute the CLI command execute formatlogdisk.

D. Select the format boot device option from the BIOS menu.

Examine this FortiGate configuration: How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

A. It always authorizes the traffic without requiring authentication.

B. It drops the traffic.

C. It authenticates the traffic using the authentication scheme SCHEME2.

D. It authenticates the traffic using the authentication scheme SCHEME1.

Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

A. FortiGuard web filter cache

B. FortiGate hostname

C. NTP

D. DNS

Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.

What is a possible reason for this?

A. The IPS filter is missing the Protocol: HTTPS option.

B. The HTTPS signatures have not been added to the sensor.

C. A DoS policy should be used, instead of an IPS sensor.

D. A DoS policy should be used, instead of an IPS sensor.

E. The firewall policy is not using a full SSL inspection profile.

In which two ways can RPF checking be disabled? (Choose two )

A. Enable anti-replay in firewall policy.

B. Disable the RPF check at the FortiGate interface level for the source check

C. Enable asymmetric routing.

D. Disable strict-arc-check under system settings.