NSE4_FGT-6.2 実際試験問題と解答 - 模擬練習 - 受験自信を増やす

Question No : 1
An administrator needs to strengthen the security for SSL VPN access.
Which of the following statements are best practices to do so? (Choose three)

A.Configure split tunneling for content inspection.
B.Configure host restrictions by IP or MAC address.
C.Configure two-factor authentication using security certificates
D.Configure SSL offloading to a content processor (FortiASIC)
E.Configure a client integrity check host-check)

正解:

Question No : 2
View the exhibit.

NSE4_FGT-6

What does this raw log indicate? (Choose two.)

A.FortiGate blocked the traffic
B.type indicates that a security event was recorded
C.10.0.1.20 is the IP address for lavito tk.
D.policyid indicates that traffic went through the IPS firewall policy

正解:

Question No : 3
Which is the correct description of a hash result as it relates to digital certificates?

A.A unique value used to verify the input data.
B.An output value that is used to identify the person or deduce that authored the input data.
C.An obfuscation used to mask the input data.
D.An encrypted output value used to safeguard the input data.

正解:

Question No : 4
What information is flushed when the chunk-size value is changed in the config dip settings?

A.The database for DLP document fingerprinting
B.The supported file types in the DLP filters
C.The archived files and messages
D.The file name patterns in the DLP filters

正解:

Question No : 5
View the exhibit.

NSE4_FGT-622_2

Which of the following statements are correct? (Choose two.)

A.This setup requires at least two firewall policies with the action set to lPsec.
B.Dead peer detection must be disabled to support this type of IPsec setup.
C.The Tunnel route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
D.This is a redundant IPsec setup.

正解:

Question No : 6
Which of the following SD-WAN-load balancing method use interface weight value to distribute traffic?

A.Source IP
B.Spillover
C.Volume
D.Session

正解:

Question No : 7
How does FortiGate select the central SNAT policy that is applied to a TCP session?

A.It selects the SNAT policy specified in the configuration of the outgoing interface ，
B.It selects the first matching central SNAT policy, reviewing from top to bottom.
C.It selects the central SNAT policy with the lowest priority.
D.It selects the 5NAT policy specified in the configuration of the firewall policy that matches the traffic.

正解:

Question No : 8
A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface. Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

A.The two VLAN sub interfaces can have the same VLAN ID, only if they have lP addresses in different subnets ，
B.The two VLAN sub interfaces must have different VLAN IDs ，
C.The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.
D.The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

正解:

Question No : 9
Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

NSE4_FGT-633_1

NSE4_FGT-633_2

An administrator has configured the WinDOS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?

A.The IPS filter is missing the Protocol: HTTPS option.
B.The HTTPS signatures have not been added to the sensor.
C.A DOS policy should be used, instead of an IPS sensor.
D.A DOS policy should be used, instead of an IPS sensor.
E.The firewall policy is not using a full SSL inspection profile.

正解:

Question No : 10
When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?

A.It must be configured in a static route using the sdwan virtual interface.
B.It must be provided in the SD-WAN member interface configuration.
C.It must be configured in a policy-route using the sdwan virtual interface.
D.It must be learned automatically through a dynamic routing protocol.

正解:

Question No : 11
Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

NSE4_FGT-627_1

NSE4_FGT-627_2

When detecting attacks, which anomaly, signature, or filter wil FortiGate evaluate first?

A.SMT
B.Login.Brute Force
C.IMA
D.Login.brute.Force
E.ip_src_session
F.Location: server Protocol: SMTP

正解:

Question No : 12
An administrator observes that the port1 interface cannot be configured with an IP address.
What can be the reasons for that? (Choose three.)

A.The interface has been configured for one-arm sniffer
B.The interface is a member of a virtual wire pair
C.The operation mode is transparent.
D.The interface is a member of a zone.
E.Captive portal is enabled in the interface.

正解:

Question No : 13
An administrator has configured two VLAN interfaces ：

NSE4_FGT-6

A DHCP server is connected to the VLAN 10 interface ， A DHCP Client is connected to the VLAN5 interface. However ， the DHCP client cannot get a dynamic IP address from the DHCP server.
What is the cause of the problem?

A.Both interfaces must belong to the same forward domain
B.The role of the VLAN10 interface must be set to server
C.Both interfaces must have the same VLAN I
D.Both interfaces must be in different VDOMs.

正解:

Question No : 14
An administrator is running the following sniffer command ：
diagnose sniffer packet any"host 10.0.2.10" 3
What information will be included in the sniffer output? (Choose three.)

A.IP header
B.Ethernet header
C.Packet payload
D.Application header
E.Interface name

正解:

Question No : 15
View the exhibit:

NSE4_FGT-6

Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two)

A.Access to all unknown applications will be allowed
B.Access to browser based Social.Media applications will be blocked
C.Access to mobile social media applications will be blocked
D.Access to all applications in Social.Media category will be blocked

正解:

Fortinet NSE4_FGT-6.2 問題練習