NSE4_FGT_AD-7.6 practice questions 21–30

1. Question 21 · 78 in bank

   Select 2

   Refer to the exhibits.

   

   

   You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits. You cannot access any of the Google applications, but you are able to access www.fortinet.com Which two actions would you take to resolve the issue? (Choose two.)

   • AChange the Inspection mode to Flow-based.
   • BSet the action for Google in the Application and Filter Overrides section to Allow.
   • CAdd “Google”.com to the URL category in the security profile.
   • DSet SSL inspection to deep-content inspection.
   • EMove up Google in the Application and Filter Overrides section to set its priority to 1.

   Show answer

   Answer: DE

   Next question

2. Question 22 · 78 in bank

   Select 2

   Refer to the exhibit, which shows a routing table.

   

   An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only. What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

   • AThe new static route must have the priority set to 3.
   • BThe existing static route through port 3 must have the distance set to 11.
   • CThe new static route must have the distance set to 9.
   • DThe new static route must have the metric set to1.

   Show answer

   Answer: BC

   Next question

3. Question 23 · 78 in bank

   Select 2

   Which two components are part of the secure internet access (SIA) agent-based mode on FortiSASE? (Choose two.)

   • AFortiExtender
   • BVPN policies
   • CThe proxy auto-configuration (PAC) file
   • DFortiSASE Firewall-as-a-Service (FWaaS)

   Show answer

   Answer: BD

   Next question

4. Question 24 · 78 in bank

   Refer to the exhibits.

   

   

   

   An administrator has observed the performance status outputs on an HA cluster for 55 seconds. Which FortiGate is the primary?

   • AHQ-NGFW-2 with the parameter memory-failover-threshold setting
   • BHQ-NGFW-1 with the parameter override setting
   • CHQ-NGFW-2 with the parameter priority setting
   • DHQ-NGFW-1 with the parameter memory-failover-flip-timeout setting

   Show answer

   Answer: A

   Next question

5. Question 25 · 78 in bank

   Select 2

   Refer to the exhibit.

   

   A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

   • AOn BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0
   • BOn BR1-FGT, set Seconds to 43200.
   • COn HQ-NGFW, set Encryption to AES256.
   • DOn HQ-NGFW, enable Diffie-Hellman Group 2.

   Show answer

   Answer: AC

   Next question

6. Question 26 · 78 in bank

   Refer to the exhibit.

   

   The administrator configured SD-WAN rules and set the FortiGate traffic log page to display SD-WAN-specific columns: SD-WAN Quality and SD-WAN Rule Name. FortiGate allows the traffic according to policy ID 1 placed at the top. This is the policy that allows SD-WAN traffic. Despite these settings, the traffic logs do not show the name of the SD-WAN rule used to steer those traffic flows. What could be the reason?

   • ADestinations in the SD-WAN rules are configured for each application, but feature visibility is not enabled.
   • BSD-WAN rule names do not appear immediately. The administrator must refresh the page.
   • CThere is no application control profile applied to the firewall policy.
   • DFortiGate load balanced the traffic according to the implicit SD-WAN rule.

   Show answer

   Answer: D

   Next question

7. Question 27 · 78 in bank

   Refer to the exhibit.

   

   What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?

   • AFortiGate will close the connection if the SNI does not match the CN and SAN fields.
   • BFortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
   • CFortiGate will close the connection if the SNI does not match the CN or SAN fields.
   • DFortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.

   Show answer

   Answer: C

   Next question

8. Question 28 · 78 in bank

   Refer to the exhibits.

   

   

   

   A web filter profile configuration and firewall policy configuration are shown. You are trying to access www.facebook.com , but you are redirected to a FortiGuard web filtering block page. Based on the exhibits, what is the possible cause of the issue?

   • AThe web rating override configuration is incorrect.
   • BThe firewall policy inspection mode is incorrect.
   • CFor www.facebook.com, the URL filter action is incorrect.
   • DThe web filter profile feature set is configured incorrectly.

   Show answer

   Answer: B

   Next question

9. Question 29 · 78 in bank

   Refer to the exhibits.

   

   

   

   Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibits. What should be the expected outcome in the HA cluster?

   • AThe HA cluster will become out od sync because the override setting must match on all HA members.
   • BHQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
   • CHQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.
   • DHQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.

   Show answer

   Answer: D

   Next question

10. Question 30 · 78 in bank

    Select 2

    What are two features of collector agent advanced mode? (Choose two.)

    • AAdvanced mode supports nested or inherited groups.
    • BAdvanced mode uses the Windows convention-NetBios: Domain\Username.
    • CIn advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
    • DIn advanced mode, security profiles can be applied only to user groups, not individual users.

    Show answer

    Answer: AC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT_AD-7.6 practice, question 21. 78 questions available.