NSE4_FGT-6.4 Certification – Valid Exam Dumps Questions Study Guide! (Updated 165 Questions)
NSE4_FGT-6.4 Dumps are Available for Instant Access using Exams4sures
Network Security Professional (Fortinet NSE4_FGT-6.4) Professional Exam Certified Professional salary
The estimated average salary of Network Security Professional (Fortinet NSE4_FGT-6.4) Professional Exam is listed below:
- United States: 149,446 USD
- India: 10,893,118 INR
- Europe: 122,755 EURO
- England: 105,649 POUND
Topics of Network Security Professional (Fortinet NSE4_FGT-6.4) Professional Exam
Candidates must know the test themes prior to the start of their exam preparations, as it will help them in acing the exam. FORTINET NSE4_FGT-6.4 dumps pdf will incorporate the accompanying themes:
- Intrusion Prevention and Denial of Service
- Introduction and Initial Configuration
- Antivirus
- Firewall Authentication
- Network Address Translation (NAT)
- Application Control
- Security Fabric
- Logging and Monitoring
- Firewall Policies
- Web Filtering
- Certificate Operations
NEW QUESTION 60
Refer to the exhibit.
Which contains a session diagnostic output. Which statement is true about the session diagnostic output?
- A. The session is in FTN_WAIT state.
- B. The session is in FIN_ACK state.
- C. The session is in SYN_SEXT state.
- D. The session is in ESTABLISHED state.
Answer: D
NEW QUESTION 61
Refer to the exhibit, which contains a radius server configuration.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option What will be the impact of using Include in every user group option in a RADIUS configuration?
- A. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
- B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- C. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
- D. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
Answer: D
NEW QUESTION 62
Refer to the exhibit.
The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet.
TheTo_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)
- A. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
- B. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
- C. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
- D. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
Answer: B,D
NEW QUESTION 63
Which three statements are true regarding session-based authentication? (Choose three.)
- A. HTTP sessions are treated as a single user.
- B. It requires more resources.
- C. It is not recommended if multiple users are behind the source NAT
- D. IP sessions from the same source IP address are treated as a single user.
- E. It can differentiate among multiple clients behind the same source IP address.
Answer: A,B,E
NEW QUESTION 64
Refer to the exhibit.
Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)
- A. port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
- B. port1-vlan1 and port2-vlan1 can be assigned in the same VDOM or to different VDOMs
- C. port1 is a native VLAN.
- D. Traffic between port2 and port2-vlan1 is allowed by default.
Answer: A,D
NEW QUESTION 65
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic belongs to the root VDOM.
- B. Log severity is set to error on FortiGate.
- C. Traffic is blocked because Action is set to DENY in the firewall policy.
- D. This is a security log.
Answer: C,D
NEW QUESTION 66
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
- A. The CA extension must be set to TRUE.
- B. The common name on the subject field must use a wildcard name.
- C. The keyUsage extension must be set to keyCertSign.
- D. The issuer must be a public CA.
Answer: A,B
NEW QUESTION 67
An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
- A. Add user accounts to the FortiGate group fitter.
- B. Add user accounts to the Ignore User List.
- C. Add user accounts to Active Directory (AD).
- D. Add the support of NTLM authentication.
Answer: B
NEW QUESTION 68
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.
Which two other security profiles can you apply to the security policy? (Choose two.)
- A. DNS filter
- B. Intrusion prevention
- C. Antivirus scanning
- D. File filter
Answer: A,C
NEW QUESTION 69
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic belongs to the root VDOM.
- B. Log severity is set to error on FortiGate.
- C. This is a security log.
- D. Traffic is blocked because Action
Answer: C,D
NEW QUESTION 70
Examine the following web filtering log.
Which statement about the log message is true?
- A. The web site miniclip.com matches a static URL filter whose action is set to Warning.
- B. The action for the category Games is set to block.
- C. The name of the applied web filter profile is default.
- D. The usage quota for the IP address 10.0.1.10 has expired
Answer: C
NEW QUESTION 71
Refer to the exhibit.
Exhibit A
Exhibit B
The SSL VPN connection fails when a user attempts to connect to it.
What should the user do to successfully connect to SSL VPN?
- A. Change the SSL VPN port on the client.
- B. Change the Server IP address.
- C. Change the idle-timeout.
- D. Change the SSL VPN portal to the tunnel.
Answer: A
Explanation:
Explanation/Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/150494
NEW QUESTION 72
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The firewall policy performs the full content inspection on the file.
- B. The volume of traffic being inspected is too high for this model of FortiGate.
- C. The flow-based inspection is used, which resets the last packet to the user.
- D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
Answer: A
NEW QUESTION 73
Examine this FortiGate configuration:
How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?
- A. It authenticates the traffic using the authentication scheme SCHEME2.
- B. It always authorizes the traffic without requiring authentication.
- C. It authenticates the traffic using the authentication scheme SCHEME1.
- D. It drops the traffic.
Answer: C
Explanation:
Explanation
"What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting"
NEW QUESTION 74
Examine this output from a debug flow:
Why did the FortiGate drop the packet?
- A. The next-hop IP address is unreachable.
- B. It matched the default implicit firewall policy.
- C. It failed the RPF check.
- D. It matched an explicitly configured firewall policy with the action DENY.
Answer: B
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
NEW QUESTION 75
Which of the following statements about central NAT are true? (Choose two.)
- A. Source NAT, using central NAT, requires at least one central SNAT policy.
- B. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
- C. IP tool references must be removed from existing firewall policies before enabling central NAT.
- D. Central NAT can be enabled or disabled from the CLI only.
Answer: C,D
NEW QUESTION 76
Refer to the exhibit.
The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?
- A. Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.
- B. Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.
- C. Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.
- D. Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.
Answer: A
NEW QUESTION 77
Refer to the exhibit.
The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet. The To_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)
- A. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
- B. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
- C. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
- D. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
Answer: B,D
NEW QUESTION 78
Which two statements are correct about SLA targets? (Choose two.)
- A. SLA targets are used only when referenced by an SD-WAN rule.
- B. SLA targets are required for SD-WAN rules with a Best Quality strategy.
- C. You can configure only two SLA targets per one Performance SL
- D. SLA targets are optional.
Answer: A,D
NEW QUESTION 79
What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)
- A. Traffic to botnetservers
- B. Server information disclosure attacks
- C. Traffic to inappropriate web sites
- D. SQL injection attacks
- E. Credit card data leaks
Answer: A,B,D
NEW QUESTION 80
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic belongs to the root VDOM.
- B. Log severity is set to error on FortiGate.
- C. Traffic is blocked because Action is set to DENY in the firewall policy.
- D. This is a security log.
Answer: C,D
NEW QUESTION 81
View the exhibit.
Which of the following statements are correct? (Choose two.)
- A. Dead peer detection must be disabled to support this type of IPsec setup.
- B. This is a redundant IPsec setup.
- C. This setup requires at least two firewall policies with the action set to IPsec.
- D. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
Answer: B,D
NEW QUESTION 82
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. Traffic belongs to the root VDOM.
- B. Log severity is set to error on FortiGate.
- C. Traffic is blocked because Action is set to DENY in the firewall policy.
- D. This is a security log.
Answer: C,D
NEW QUESTION 83
......
Fortinet NSE4_FGT-6.4 Exam Practice Test Questions: https://www.exams4sures.com/Fortinet/NSE4_FGT-6.4-practice-exam-dumps.html