Steps Necessary To Pass The NSE4_FGT-6.4 Exam from Training Expert Pass4cram
Valid Way To Pass Fortinet NSE 4's NSE4_FGT-6.4 Exam
NEW QUESTION 26
Which two statements are true about the RPF check? (Choose two.)
- A. The RPF check is run on the first sent packet of any new session.
- B. The RPF check is run on the first sent and reply packet of any new session.
- C. RPF is a mechanism that protects FortiGuard and your network from IP spoofing attacks.
- D. The RPF check is run on the first reply packet of any new session.
Answer: A,C
Explanation:
Explanation/Reference: https://www.programmersought.com/article/16383871634/
NEW QUESTION 27
Refer to the exhibit.
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP
10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)
- A. If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
- B. If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.
- C. If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.
- D. If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.
Answer: A,B
NEW QUESTION 28
Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.
An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?
- A. The HTTPS signatures have not been added to the sensor.
- B. A DoS policy should be used, instead of an IPS sensor.
- C. The firewall policy is not using a full SSL inspection profile.
- D. The IPS filter is missing the Protocol: HTTPS option.
- E. A DoS policy should be used, instead of an IPS sensor.
Answer: C
NEW QUESTION 29
Refer to the web filter raw logs.
Based on the raw logs shown in the exhibit, which statement is correct?
- A. The action on firewall policy ID 1 is set to warning.
- B. Access to the social networking web filter category was explicitly blocked to all users.
- C. Social networking web filter category is configured with the action set to authenticate.
- D. The name of the firewall policy is all_users_web.
Answer: C
NEW QUESTION 30
Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
- A. The IPS engine was unable to prevent an intrusion attack.
- B. The IPS engine will continue to run in a normal state.
- C. The IPS engine was blocking all traffic.
- D. The IPS engine was inspecting high volume of traffic.
Answer: C
NEW QUESTION 31
Examine the network diagram shown in the exhibit, then answer the following question:
Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?
- A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
- B. 10.4.200.0/30 is directly connected, port2
- C. 0.0.0.0/0 [20/0] via 10.4.200.2, port2
- D. 172.16.32.0/24 is directly connected, port1
Answer: D
NEW QUESTION 32
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port1 and port2 default routes are active in the routing table.
- B. There will be eight routes active in the routing table.
- C. The port3 default route has the highest distance.
- D. The port3 default route has the lowest metric.
Answer: A,C
NEW QUESTION 33
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port1 and port2 default routes are active in the routing table.
- B. There will be eight routes active in the routing table.
- C. The port3 default route has the highest distance.
- D. The port3 default route has the lowest metric.
Answer: A,C
NEW QUESTION 34
An administrator is running the following sniffer command:
Which three pieces of Information will be Included in me sniffer output? {Choose three.)
- A. Ethernet header
- B. Interface name
- C. Packet payload
- D. Application header
- E. IP header
Answer: B,C,E
NEW QUESTION 35
View the exhibit.
Which of the following statements are correct? (Choose two.)
- A. This setup requires at least two firewall policies with the action set to IPsec.
- B. This is a redundant IPsec setup.
- C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
- D. Dead peer detection must be disabled to support this type of IPsec setup.
Answer: B,C
NEW QUESTION 36
Examine the following web filtering log.
Which statement about the log message is true?
- A. The web site miniclip.com matches a static URL filter whose action is set to Warning.
- B. The usage quota for the IP address 10.0.1.10 has expired
- C. The action for the category Games is set to block.
- D. The name of the applied web filter profile is default.
Answer: D
NEW QUESTION 37
Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)
- A. A certificate is not required on the remote peer when you set the signature as the authentication method.
- B. FortiGate supports pre-shared key and signature as authentication methods.
- C. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password
- D. Enabling XAuth results in a faster authentication because fewer packets are exchanged.
Answer: A,B
Explanation:
Explanation/Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/913287/ipsec-vpn-authenticating-a- remote-fortigate-peer-with-a-pre-shared-key
NEW QUESTION 38
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
- A. Static routes are required to allow traffic to the next hop.
- B. FortiGate forwards frames without changing the MAC address.
- C. By default, all interfaces are part of the same broadcast domain.
- D. The existing network IP schema must be changed when installing a transparent mode.
Answer: B,C
NEW QUESTION 39
Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
- A. Any web request fortinet.com is allowed to bypass the proxy.
- B. Browsers can be configured to retrieve this PAC file from the FortiGate.
- C. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- D. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
Answer: A,B
NEW QUESTION 40
Refer to the exhibit.
The exhibits show a network diagram and the explicit web proxy configuration.
In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?
- A. 'host 192.168.0.2 and port 8080'
- B. 'host 10.0.0.50 and port 8080'
- C. 'host 10.0.0.50 and port 80'
- D. 'host 192.168.0.1 and port 80'
Answer: A
NEW QUESTION 41
......
All NSE4_FGT-6.4 Dumps and Fortinet NSE 4 - FortiOS 6.4 Training Courses: https://tesking.pass4cram.com/NSE4_FGT-6.4-dumps-torrent.html