NSE4_FGT-6.4 Fortinet NSE 4 Exam will Retire on March 31, 2022

dumps2021-12-23T07:14:45+08:00

NSE4_FGT-6.4 exam is one for Fortinet NSE 4 certification. This NSE4_FGT-6.4 exam will be retired on March 31, 2022, and the new replacement test is NSE4_FGT-7.0 Fortinet NSE 4 – FortiOS 7.0. We provide online Fortinet NSE 4 NSE4_FGT-6.4 exam questions, which are helpful in the preparation.

In real Fortinet NSE 4 NSE4_FGT-6.4 exam, there are 60 questions, and you have 105 minutes to write the test. The available languages are English and Japanese. Free Fortinet NSE 4 NSE4_FGT-6.4 exam questions are below.

Page 1 of 5

1. Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

Social networking web filter category is configured with the action set to authenticate.

The action on firewall policy ID 1 is set to warning.

Access to the social networking web filter category was explicitly blocked to all users.

The name of the firewall policy is all_users_web.

2. Refer to the exhibit.

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

A user

A root CA

A bridge CA

A subordinate

3. An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

Device detection on all interfaces is enforced for 30 minutes.

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

4. Which statement about the policy ID number of a firewall policy is true?

It is required to modify a firewall policy using the CL

It represents the number of objects used in the firewall policy.

It changes when firewall policies are reordered.

It defines the order in which rules are processed.

5. A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces must have different VLAN IDs.

The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

6. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

Enable Dead Peer Detection.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

7. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

FortiCache

FortiSIEM

FortiAnalyzer

FortiSandbox

FortiCloud

8. Refer to the exhibit, which contains a static route configuration.

An administrator created a static route for Amazon Web Services.

What CLI command must the administrator use to view the route?

get router info routing-table all

get internet service route list

get router info routing-table database

diagnose firewall proute list

9. Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies.

What does the Administrator account need to access the FortiGate global settings?

Change password

Enable restrict access to trusted hosts

Change Administrator profile

Enable two-factor authentication

10. Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

Both the phase 1 SA and phase 2 SA are bidirectional.

Page 2 of 5

11. Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Firewall policy

Policy rule

Security policy

SSL inspection and authentication policy

12. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

13. Which two statements are true about the RPF check? (Choose two.)

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

The RPF check is run on the first sent and reply packet of any new session.

RPF is a mechanism that protects FortiGuard and your network from IP spoofing attacks.

14. Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

DNS

ping

udp-echo

TWAMP

15. Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

Heartbeat interfaces have virtual IP addresses that are manually assigned.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Virtual IP addresses are used to distinguish between cluster members.

The primary device in the cluster is always assigned IP address 169.254.0.1.

16. What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

Full Content inspection

Proxy-based inspection

Certificate inspection

Flow-based inspection

17. Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The subject field in the server certificate

The serial number in the server certificate

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The host field in the HTTP header

18. Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

get system status

get system performance status

diagnose sys top

get system arp

19. Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets

To finish any inspection operations

To remove the NAT operation

To generate logs

20. Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Page 3 of 5

21. In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies.

Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

22. Refer to the exhibit.

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.

How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

If there is a full-through policy in place, users will not be prompted for authentication.

Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.

Authentication is enforced at a policy level; all users will be prompted for authentication.

Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.

23. Which statement about the IP authentication header (AH) used by IPsec is true?

AH does not provide any data integrity or encryption.

AH does not support perfect forward secrecy.

AH provides data integrity bur no encryption.

AH provides strong data integrity but weak encryption.

24. Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

A local FortiManager is one of the servers FortiGate communicates with.

One server was contacted to retrieve the contract information.

There is at least one server that lost packets consecutively.

FortiGate is using default FortiGuard communication settings.

25. Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

By default, FortiGate uses WINS servers to resolve names.

By default, the SSL VPN portal requires the installation of a client’s certificate.

By default, split tunneling is enabled.

By default, the admin GUI and SSL VPN portal use the same HTTPS port.

26. Which two statements about antivirus scanning mode are true? (Choose two.)

In proxy-based inspection mode, files bigger than the buffer size are scanned.

In flow-based inspection mode. FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

In flow-based inspection mode, files bigger than the buffer size are scanned.

27. When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

Log ID

Universally Unique Identifier

Policy ID

Sequence ID

28. Examine the following web filtering log.

Which statement about the log message is true?

The action for the category Games is set to block.

The usage quota for the IP address 10.0.1.10 has expired

The name of the applied web filter profile is default.

The web site miniclip.com matches a static URL filter whose action is set to Warning.

29. An administrator observes that the port1 interface cannot be configured with an IP address.

What can be the reasons for that? (Choose three.)

The interface has been configured for one-arm sniffer.

The interface is a member of a virtual wire pair.

The operation mode is transparent.

The interface is a member of a zone.

Captive portal is enabled in the interface.

30. What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Traffic to botnetservers

Traffic to inappropriate web sites

Server information disclosure attacks

Credit card data leaks

SQL injection attacks

Page 4 of 5

31. Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

There are five devices that are part of the security fabric.

Device detection is disabled on all FortiGate devices.

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

32. Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

It is allowed, but with no inspection

It is allowed and inspected as long as the inspection is flow based

It is dropped.

It is allowed and inspected, as long as the only inspection required is antivirus.

33. Refer to the exhibit.

The exhibits show a network diagram and the explicit web proxy configuration.

In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

‘host 192.168.0.2 and port 8080’

‘host 10.0.0.50 and port 80’

‘host 192.168.0.1 and port 80’

‘host 10.0.0.50 and port 8080’

34. Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

Central NAT is enabled, so NAT settings from matching Central SNAT policies will be

applied.

Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.149

10.200.1.1

10.200.1.49

10.200.1.99

35. Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLA

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

36. Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

SMT

IMA

ip_src_session

Location: server Protocol: SMTP

37. Which of statement is true about SSL VPN web mode?

The tunnel is up while the client is connected.

It supports a limited number of protocols.

The external network application sends data through the VP

It assigns a virtual IP address to the client.

38. Refer to the exhibit.

The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.

An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.

The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database.

Users will be prompted for authentication.

How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)

If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.

If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.

If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.

If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.

39. Which two statements ate true about the Security Fabric rating? (Choose two.)

It provides executive summaries of the four largest areas of security focus.

Many of the security issues can be fixed immediately by click ng Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

40. To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

FortiManager

Root FortiGate

FortiAnalyzer

Downstream FortiGate

Page 5 of 5

41. NGFW mode allows policy-based configuration for most inspection rules.

Which security profile’s configuration does not change when you enable policy-based inspection?

Web filtering

Antivirus

Web proxy

Application control

42. Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)

Traffic is blocked because Action is set to DENY in the firewall policy.

Traffic belongs to the root VDO

This is a security log.

Log severity is set to error on FortiGate.

43. Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine

whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.

What is a possible reason for this?

The IPS filter is missing the Protocol: HTTPS option.

The HTTPS signatures have not been added to the sensor.

A DoS policy should be used, instead of an IPS sensor.

The firewall policy is not using a full SSL inspection profile.

NSE4_FGT-6.4 Fortinet NSE 4 Exam will Retire on March 31, 2022

NSE4_FGT-6.4 Fortinet NSE 4 Exam will Retire on March 31, 2022

Share this post

Leave a Reply Cancel reply

Related Posts