NSE4_FGT-5.6 by Fortinet Actual Free Exam Q&As

Question 1

Which statements are true of public key infrastracture (PKI) users on FortiGate?
(Choose two.)
Response:

A. FortiGate must include the CA certificate that issued the PKI peer user certificate. B. The first PKI user must be added to FortiGate through the GUI. C. PKI users can belong to firewall user groups. D. PKI users must authenticate with both a certificate and a password.

Discussion 0

Correct Answer: A,C Vote an answer

Question 2

Which statements best describe auto discovery VPN (ADVPN).
(Choose two.)
Response:

A. ADVPN is only supported with IKEv2. B. Tunnels are negotiated dynamically between spokes. C. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes. D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Discussion 0

Correct Answer: B,C Vote an answer

Question 3

Examine this output from a debug flow:

Which statements about the output are correct?
(Choose two.)
Response:

A. The packet was allowed by the firewall policy with the ID 00007fc0. B. FortiGate received a TCP SYN/ACK packet. C. FortiGate routed the packet through port 3. D. The source IP address of the packet was translated to 10.0.1.10.

Discussion 0

Correct Answer: C,D Vote an answer

Question 4

How does FortiGate select the central SNAT policy that is applied to a TCP session?
Response:

A. It selects the SNAT policy specified in the configuration of the outgoing interface. B. It selects the first matching central-SNAT policy from top to bottom. C. It selects the central-SNAT policy with the lowest priority. D. It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

Discussion 0

Correct Answer: B Vote an answer

Question 5

How do you configure inline SSL inspection on a firewall policy?
(Choose two.)
Response:

A. Execute the inline ssl inspection CLI command. B. Enable one or more flow-based security profiles on the firewall policy. C. Enable one or more proxy-based security profiles on the firewall policy. D. Enable the SSL/SSH Inspection profile on the firewall policy.

Discussion 0

Correct Answer: B,D Vote an answer

Question 6

An administrator wants to monitor their network for any probing attempts aimed to exploit existing vulnerabilities in their servers. What must they configure on their FortiGate to accomplish this?
(Choose two.)
Response:

A. A web application firewall profile to check protocol constraints. B. A DoS policy, and log all UDP and TCP scan attempts. C. An application control profile and set all application signatures to monitor. D. An IPS sensor to monitor all signatures applicable to the server.

Discussion 0

Correct Answer: B,D Vote an answer

Fortinet NSE 4 - FortiOS 5.6 - NSE4_FGT-5.6 Exam Practice Test