NSE4_FGT_AD-7.6 practice questions 61–70

1. Question 61 · 78 in bank

   Select 3

   What are three key routing principles in SD-WAN? (Choose three.)

   • ASD-WAN rules have precedence over any other type of routes.
   • BBy default, SD-WAN rules are skipped if only one route to the destination is available.
   • CRegular policy routes have precedence over SD-WAN rules.
   • DBy default, SD-WAN rules are skipped if the included SD-WAN members do not have a valid route to the destination.
   • EBy default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

   Show answer

   Answer: CDE

   Next question

2. Question 62 · 78 in bank

   Refer to the exhibit.

   

   Why did the FortiGate device drop the packet?

   • AIt matched the default implicit firewall policy.
   • BIt failed the RPF check.
   • CIt matched an explicitly configured firewall policy with the action DENY.
   • DIt cannot reach the next-hop IP.

   Show answer

   Answer: A

   Next question

3. Question 63 · 78 in bank

   Refer to the exhibits.

   

   

   

   The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

   • AApple FaceTime will be allowed, based on the Video/Audio category configuration.
   • BApple FaceTime will be allowed, based on the Apple filter configuration.
   • CApple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.
   • DApple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

   Show answer

   Answer: D

   Next question

4. Question 64 · 78 in bank

   Select 2

   Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two.)

   • AIf SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
   • BIf SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
   • CIf SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode.
   • DIf SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

   Show answer

   Answer: AC

   Next question

5. Question 65 · 78 in bank

   An administrator suspects that the Collector Agent is not forwarding login events to FortiGate. What is the most effective troubleshooting step?

   • AVerify if DC agent is enabled on the FortiGate.
   • BRestart the domain controller to refresh authentication services.
   • CCheck if TCP port 8000 is open between the collector agent and FortiGate.
   • DVerify if FortiGate is set to use LDAP authentication instead of FSSO.

   Show answer

   Answer: C

   Next question

6. Question 66 · 78 in bank

   Select 2

   A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes. All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover. Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

   • AEnable Dead Peer Detection.
   • BUse the VPN wizard to create an IPsec template for a redundant IPsec VPN tunnel.
   • CConfigure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
   • DIn the phase1-interface, enable npu-offload to detect a dead tunnel.

   Show answer

   Answer: AC

   Next question

7. Question 67 · 78 in bank

   Select 2

   Refer to the exhibits.

   

   

   

   A diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device are shown. Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet. Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

   • AIn the IP pool configuration, set type to overload.
   • BIn the IP pool configuration, set endip to 100.65.0.112.
   • CIn the firewall policy, set match-vip to enable using CLI.
   • DIn the system settings, set Multiple Interface Policies to enable.

   Show answer

   Answer: AB

   Next question

8. Question 68 · 78 in bank

   An administrator wants to address shadow IT visibility challenges and prevent users from sending sensitive files outside the organization without proper approval. Which FortiSASE method should the administrator implement to achieve these goals?

   • ASecure internet access (SIA)
   • BSecure private access (SPA)
   • CSecure SaaS access (SSA)
   • DSecure SD-WAN access (SSD-WAN)

   Show answer

   Answer: C

   Next question

9. Question 69 · 78 in bank

   Refer to the exhibit.

   

   You are configuring FortiAnalyzer on FortiGate. Which step must you take to connect FortiAnalyzer to FortiGate?

   • AVerify the FortiAnalyzer serial number.
   • BEnable disk logging on FortiGate.
   • CAuthorize FortiGate on FortiAnalyzer.
   • DConfigure UDP port 514 on FortiGate.

   Show answer

   Answer: C

   Next question

10. Question 70 · 78 in bank

    Refer to the exhibit. A partial cloud topology is shown.

    

    You deployed a FortiGate Cloud-Native Firewall (CNF) in AWS for FortiGate CNF policy enforcement for EC2 instance traffic. Which path does the EC2 traffic take from the EC2 instance to the internet?

    • AEC2 instance -> internet gateway (IGW) -> gateway load balancer (GWLB) -> FortiGate CNF -> internet
    • BEC2 instance -> GWLBe -> FortiGate CNF -> GWLBe -> IGW -> internet
    • CEC2 instance -> GWBL endpoint (GWLBe) -> FortiGate CNF -> IGW -> internet
    • DEC2 instance -> FortiGate CNF -> GWLB -> GWLBe -> IGW -> internet

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT_AD-7.6 practice, question 61. 78 questions available.