Fortinet NSE4_FGT-5.6 Fortinet NSE 4 - FortiOS 5.6 Online Training

Exam4Training is the best webpage forgiving on the web preparing material to Fortinet NSE4_FGT-5.6 exam. You can find related Fortinet NSE4_FGT-5.6 Fortinet NSE 4 – FortiOS 5.6 Online Training on Exam4Training that will help you with clearing your NSE4 NSE4_FGT-5.6 exam on the vital undertaking.Exam4Training is the best source where you can get all the available online exam material. You can without quite a bit of a stretch get Fortinet NSE4_FGT-5.6 Fortinet NSE 4 – FortiOS 5.6 Online Training and can pass your NSE4_FGT-5.6 Fortinet NSE 4 – FortiOS 5.6 exam with comfort.

Page 1 of 5

1. Which of the following statements about advanced AD access mode for the FSSO collector agent are true?

(Choose two.)

Response:

FortiGate can act as an LDAP client to configure the group filters.

It is only supported if DC agents are deployed.

It supports monitoring of nested groups.

It uses the Windows convention for naming; that is, DomainUsername.

2. Which of the following IPsec parameters is a phase 2 configuration setting?

Response:

Peer ID

eXtended Authentication (XAuth)

Quick mode selectors

Authentication method

3. Which of the following actions are available under the System Information widget for system configuration?

(Choose two.)

Response:

Backup

Upload

Checkpoint

Configuration Recovery

Restore

4. Which of the following are differences between IPsec main mode and IPsec aggressive mode?

(Choose two.)

Response:

Aggressive mode supports XAuth, while main mode does not.

Six packets are usually exchanged during main mode, while only three packets are exchanged during aggressive mode.

The first packet of aggressive mode contains the peer ID, while the first packet of main mode does not.

Main mode cannot be used for dialup VPNs, while aggressive mode can.

5. Which ways can FortiGate deliver one-time passwords (OTPs) to two-factor authentication users in your network?

(Choose three.)

Response:

Hardware FortiToken

Web portal

SMS

USB FortiToken

FortiToken Mobile

6. Which file names will match the *.tiff file name pattern configured in a DLP filter?

(Choose two.)

Response:

tiff.jpeg

tiff.tiff

gif.tiff

tiff.png

7. An administrator needs to inspect all web traffic (including Internet web traffic) coming from users connecting to SSL VPN. How can this be achieved?

Response:

Disabling split tunneling

Configuring web bookmarks

Assigning public IP addresses to SSL VPN clients

Using web-only mode

8. What step is required to configure an SSL VPN to access to an internal server using port forward mode?

Response:

Configure the virtual IP addresses to be assigned to the SSL VPN users.

Install FortiClient SSL VPN client

Create a SSL VPN realm reserved for clients using port forward mode.

Configure the client application to forward IP traffic to a Java applet proxy.

9. Examine the exhibit, which shows a FortiGate device with two VDOMs: VDOM1 and VDOM2. Both VDOMs are operating in NAT/route mode. The subnet 10.0.1.0/24 is connected to VDOM1.

The subnet 10.0.2.0/24 is connected to VDOM2. There is an inter-VDOM link between VDOM1 and VDOM2.

https://www.nwexam.com/files/nwexam/download/NSE%204%20-%20FGT%205.6_sam35.png

What is required in the FortiGate configuration to route traffic between both subnets through an inter-VDOM link?

Response:

A firewall policy in VDOM1 to allow the traffic from 10.0.1.0/24 to 10.0.2.0/24 with port1 as the source interface and port2 as the destination interface.

A static route in VDOM1 for the destination subnet of 10.0.1.0/24.

A static route in VDOM2 with the destination subnet matching the subnet assigned to the inter-VDOM link.

A static route in VDOM2 for the destination subnet 10.0.1.0/24.

10. Which of the following configuration settings are global settings?

(Choose two.)

Response:

FortiGuard settings

HA settings

Firewall policies

Security profiles

Page 2 of 5

11. An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers. What must they configure on their FortiGate to accomplish this?

(Choose two.)

Response:

An application control profile and set all application signatures to monitor.

A DoS policy, and log all UDP and TCP scan attempts.

An IPS sensor to monitor all signatures applicable to the server.

A web application firewall profile to check protocol constraints.

12. Why must you use aggressive mode when a local FortiGate IPsec gateway hosts multiple dialup tunnels?

Response:

The FortiGate is able to handle NATed connections only with aggressive mode.

FortiClient supports aggressive mode.

The remote peers are able to provide their peer IDs in the first message with aggressive mode.

Main mode does not support XAuth for user authentication.

13. Which statements about the firmware upgrade process on an active-active high availability (HA) cluster are true?

(Choose two.)

Response:

The firmware image must be manually uploaded to each FortiGate.

Only secondary FortiGate devices are rebooted.

Uninterruptable upgrade is enabled by default.

Traffic load balancing is temporally disabled while upgrading the firmware.

14. Examine this output from the diagnose sys top command:

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_43.png

Which statements about the output are true?

(Choose two.)

Response:

sshd is the process consuming most memory

sshd is the process consuming most CPU

All the processes listed are in sleeping state

The sshd process is using 123 pages of memory

15. If antivirus, grayware, and heuristic scans are enabled on FortiGate, in which order does FortiGate apply the scanning?

Response:

heuristics -> grayware -> antivirus

antivirus -> grayware -> heuristics

antivirus -> heuristics -> grayware

grayware -> antivirus -> heuristics

16. Which of the following statements about the FortiGate application control database are true?

(Choose two.)

Response:

The application control database uses TCP port 53 for downloads.

The application control database uses a hierarchical structure to organize application signatures.

The application control database is part of the IPS signatures database.

The application control database updates are included in the free FortiGuard service.

17. Which statement about the HA override setting in FortiGate HA clusters is true?

Response:

Configuring the HA override will reboot the FortiGate device.

It synchronizes device priority on all cluster members.

It is used to enable monitored ports.

You must configure override settings manually and separately for each cluster member.

18. When does the FortiGate enter into fail-open session mode?

Response:

When CPU usage goes above the red threshold.

When a proxy (for proxy-based inspection) runs out of connections.

When memory usage goes above the red threshold.

When memory usage goes above the extreme threshold.

19. Which statement is true about split tunneling in SSL VPN?

Response:

It is supported in web-only mode.

It can be enabled by the SSL VPN user, after connecting to the SSL VP

If enabled, Internet traffic uses the local gateway of the connecting host.

If disabled, SSL VPN users must authenticate using FortiToken.

20. LDAP and RADIUS are both remote authentication servers that FortiGate can tie into for authentication. What is a key difference between these servers?

Response:

Only LDAP can have a secure connection with FortiGate using a server certificate.

Only LDAP can be configured to authenticate groups as defined on the LDAP server.

Only LDAP provides authentication, authorization, and accounting (AAA) services.

Only RADIUS requires a distinguished name (i h.) to locate user records.

Page 3 of 5

21. Examine this output from a debug flow:

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_71.png

Which statements about the output are correct?

(Choose two.)

Response:

FortiGate received a TCP SYN/ACK packet.

The source IP address of the packet was translated to 10.0.1.10.

FortiGate routed the packet through port 3.

The packet was allowed by the firewall policy with the ID 00007fc0.

22. How does FortiGate select the central SNAT policy that is applied to a TCP session?

Response:

It selects the SNAT policy specified in the configuration of the outgoing interface.

It selects the first matching central-SNAT policy from top to bottom.

It selects the central-SNAT policy with the lowest priority.

It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

23. Which of the following settings and protocols can be used to provide secure and restrictive administrative access to FortiGate?

(Choose three.)

Response:

Trusted host

HTTPS

Trusted authentication

SSH

FortiTelemetry

24. A FortiGate interface is configured with the following commands:

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_1.png

What statements about the configuration are correct?

(Choose two.)

Response:

IPv6 clients connected to port1 can use SLAAC to generate their IPv6 addresses.

FortiGate can provide DNS settings to IPv6 clients.

FortiGate can send IPv6 router advertisements (RAs.)

FortiGate can provide IPv6 addresses to DHCPv6 client.

25. Which statements correctly describe transparent mode operation?

(Choose three.)

Response:

All interfaces of the transparent mode FortiGate device must be on different IP subnets.

The transparent FortiGate is visible to network hosts in an IP traceroute.

It permits inline traffic inspection and firewalling without changing the IP scheme of the network.

Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.

The FortiGate acts as transparent bridge and forwards traffic at Layer-2.

26. How can you format the FortiGate flash disk?

Response:

Load the hardware test (HQIP) image.

Execute the CLI command execute formatlogdisk.

Load a debug FortiOS image.

Select the format boot device option from the BIOS menu.

27. Which of the following statements are true regarding the SD-WAN feature on FortiGate?

(Choose two.)

Response:

An SD-WAN static route does not require a next-hop gateway IP address.

Each member interface requires its own firewall policy to allow traffic.

SD-WAN provides route failover protection, but cannot load-balance traffic.

FortiGate supports only one SD-WAN interface per VDO

28. An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?

Response:

A phase 2 configuration is not required.

This VPN cannot be used as part of a hub and spoke topology.

The IPsec firewall policies must be placed at the top of the list.

A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

29. Which of the following protocols is used to encrypt the user data payload in an IPsec tunnel?

Response:

IKE

ISAKMP

ESP

30. Examine the exhibit, which contains a virtual IP and a firewall policy configuration.

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_57.png

The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address.

Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Response:

10.200.1.1

10.0.1.254

Any available IP address in the WAN(port1) subnet 10.200.1.0/24

10.200.1.10

Page 4 of 5

31. Examine the log message attributes. Which statements are correct?

(Choose two.)

hostname=www.youtube.com profiletype="Webfilter_Profile"

profile="default"

status="passthrough"

msg="URL belongs to a category with warnings enabled"

Response:

The website was allowed on the first attempt

The user failed authentication

The category action was set to warning.

The user was prompted whether to proceed or go back.

32. Examine the following log message attributes and select two correct statements from the list below.

(Choose two.)

Response:

The category action was set to warning.

The website was allowed on the first attempt.

The user was prompted to decide whether to proceed or go back.

The user failed authentication.

33. You have configured the following log settings on the Log Settings page. Which configurations are now required to generate log messages on traffic coming through your network?

(Choose two.)

Response:

Enable Log Allowed Traffic on your firewall policy.

Enable Local Traffic Log on the Log Settings page.

Enable Historical FortiView on the Log Settings page.

Enable a security profile on your firewall policy.

Enable Capture Packets on your firewall policy.

34. How do you configure inline SSL inspection on a firewall policy?

(Choose two.)

Response:

Enable one or more flow-based security profiles on the firewall policy.

Enable the SSL/SSH Inspection profile on the firewall policy.

Execute the inline ssl inspection CLI command.

Enable one or more proxy-based security profiles on the firewall policy.

35. What methods can you use to back up logs?

(Choose three.)

Response:

SNMP

USB

SFTP

TFTP

FTP

36. Which of the following protocols can you use for secure administrative access to a FortiGate?

(Choose two.)

Response:

HTTPS

Telnet

SSH

FortiTelemetry

37. Under which circumstance is the IPsec ESP traffic encapsulated over UDP?

Response:

When using IKE version 2 (IKEv2)

When the phase 1 is configured to use aggressive mode

When the IPsec VPN is configured as dial-up

When NAT-T detects there is a device between both IPsec peers doing NAT over the IPsec traffic

38. You have enabled a web filter security profile in a firewall policy to log all blocked websites. What options do you have to either actively or passively monitor these logs?

(Choose two.)

Response:

Alert Message console

FortiView menu

Alert email

Monitor menu

39. Which statements about an IPv6-over-IPv4 IPsec configuration are correct?

(Choose two.)

Response:

The remote gateway IP must be an IPv6 address.

The source quick mode selector must be an IPv4 address.

The local gateway IP must an IPv4 address.

The destination quick mode selector must be an IPv6 address.

40. Which of the following statements are true about route-based IPsec VPNs?

(Choose two.)

Response:

A virtual IPsec interface is automatically created after a phase 1 is added to the configuration

They require firewall policies with the Action set to IPsec

They support L2TP-over-IPsec tunnels

They can be created in transparent mode VDOMs

Page 5 of 5

41. Which statements are true of public key infrastracture (PKI) users on FortiGate?

(Choose two.)

Response:

FortiGate must include the CA certificate that issued the PKI peer user certificate.

PKI users can belong to firewall user groups.

PKI users must authenticate with both a certificate and a password.

The first PKI user must be added to FortiGate through the GU

42. Which statements about IP-based explicit proxy authentication are true?

(Choose two.)

Response:

IP-based authentication is best suited to authenticating users behind a NAT device.

Sessions from the same source address are treated as a single user.

IP-based authentication consumes less FortiGate’s memory than session-based authentication.

FortiGate remembers authenticated sessions using browser cookies.

43. View the exhibit.

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_23.png

When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?

Response:

The user is required to authenticate before accessing sites with untrusted SSL certificates.

The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.

The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.

The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).

44. Which statement best describes the role of a DC agent in an FSSO DC agent mode solution?

Response:

Captures the logon events and forwards them to FortiGate.

Captures the logon events and forwards them to the collector agent.

Captures the logon and logoff events and forwards them to the collector agent.

Captures the user IP address and workstation name and forwards them to FortiGate.

45. What FortiGate feature can be used to block a ping sweep scan from an attacker?

Response:

Web application firewall (WAF)

Rate based IPS signatures

One-arm sniffer

DoS policies

46. An administrator has enabled the DHCP Server on the port1 interface and configured the following based on the exhibit.

https://www.nwexam.com/files/nwexam/download/NSE4-5.4_87.png

Which statement is correct based on this configuration?

Response:

The MAC address 00:0c:29:29:38:da belongs to the port1 interface.

Access to the network is blocked for the devices with the MAC address 00:0c:29:29:38:da and the IP address 10.0.1.254.

00:0c:29:29:38:da is the virtual MAC address assigned to the secondary IP address (10.0.1.254) of the port1 interface.

The IP address 10.0.1.254 is reserves for the device with the MAC address 00:0c:29:29:38:da.

Latest NSE4_FGT-5.6 Dumps Valid Version with 114 Q&As

Latest And Valid Q&A | Instant Download | Once Fail, Full Refund

Instant Download NSE4_FGT-5.6 PDF