NSE4_FGT_AD-7.6 practice questions 51–60

1. Question 51 · 78 in bank

   Refer to the exhibit.

   

   What can you conclude from the log shown in the exhibit?

   • AThe IPS socket buffer is full and IPS engine needs more memory to create new sessions.
   • BThe IPS socket buffer is full and IPS engine cannot decode a packet.
   • CThe IPS scan is paused by the IPS diagnostic command with bypass mode option 5.
   • DThe IPS session scan is paused and reevaluating the packet because of a dirty flag.

   Show answer

   Answer: A

   Next question

2. Question 52 · 78 in bank

   Select 2

   Refer to the exhibit.

   

   The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)

   • AConfigure a web override rating for download.com and select Malicious Websites as the subcategory.
   • BConfigure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
   • CSet the Freeware and Software Downloads category Action to Warning.
   • DConfigure a separate firewall policy with action Deny and an FQDN address object for *. download.com as destination address.

   Show answer

   Answer: AB

   Next question

3. Question 53 · 78 in bank

   Select 2

   Which two statements are true about an HA cluster? (Choose two.)

   • ALink failover triggers a failover if the administrator sets the interface down on the primary device.
   • BAn HA cluster cannot have both in-band and out-of-band management interfaces at the same time.
   • CWhen sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.
   • DHA incremental synchronization includes FIB entries and IPsec SAs.

   Show answer

   Answer: AD

   Next question

4. Question 54 · 78 in bank

   Refer to the exhibit. An intrusion prevention system (IPS) profile signature setting is shown.

   

   What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?

   • AThe signature setting uses a custom rating threshold.
   • BFortiGate allows this low severity signature packet and creates a log.
   • CFortiGate stores a local copy of the packet that matches the signature.
   • DThe signature setting includes a group of other signatures.

   Show answer

   Answer: C

   Next question

5. Question 55 · 78 in bank

   Select 3

   Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three.)

   • ALowest Cost (SLA) without load balancing
   • BBest Quality with load balancing
   • CLowest Cost (SLA) with load balancing
   • DManual with load balancing
   • ELowest Quality (SLA) with load balancing

   Show answer

   Answer: ACD

   Next question

6. Question 56 · 78 in bank

   Select 2

   A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded. The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

   • AThe selected SSL inspection profile has certificate inspection enabled.
   • BThe browser does not trust the FortiGate self-signed CA certificate.
   • CThe website is exempted from SSL inspection.
   • DThe EICAR test file exceeds the protocol options oversize limit.

   Show answer

   Answer: AC

   Next question

7. Question 57 · 78 in bank

   Refer to the exhibits.

   

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device. The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.11.50?

   • A100.65.0.200
   • B100.65.0.102
   • C100.65.0.101
   • D10.0.11.254

   Show answer

   Answer: B

   Next question

8. Question 58 · 78 in bank

   Refer to the exhibit, which shows a partial configuration from the remote authentication server.

   

   Why does the FortiGate administrator need this configuration?

   • ATo authenticate only the Training user group.
   • BTo authenticate Any FortiGate user groups.
   • CTo authenticate and match the Training OU on the RADIUS server.
   • DTo set up a RADIUS server Secret.

   Show answer

   Answer: A

   Next question

9. Question 59 · 78 in bank

   Refer to the exhibits.

   

   

   An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page. Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?

   • ASet the Social Networking action as warning in the FortiGuard Category Based Filter.
   • BChange the Feature set of Web Filter Profile as Proxy-based.
   • CSet the Action as Exempt for www.facebook.com in the Static URL Filter.
   • DChange the type as Simple in the Static URL Filter section.

   Show answer

   Answer: C

   Next question

10. Question 60 · 78 in bank

    What is the primary FortiGate election process when the HA override setting is enabled?

    • AConnected monitored ports > HA uptime > Priority > FortiGate serial number
    • BConnected monitored ports > Priority > System uptime > FortiGate serial number
    • CConnected monitored ports > Priority > HA uptime > FortiGate serial number
    • DConnected monitored ports > System uptime > Priority > FortiGate serial number

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT_AD-7.6 practice, question 51. 78 questions available.