Fortinet NSE 4 NSE4_FGT_AD-7.6完全版問題集には無料PDF問題で合格させる [Q44-Q61]

Fortinet NSE 4 NSE4_FGT_AD-7.6完全版問題集には無料PDF問題で合格させる

100%更新されたのはFortinet NSE4_FGT_AD-7.6限定版PDF問題集

質問 # 44
Refer to the exhibit showing a debug flow output.

Which two conclusions can you make from the debug flow output? (Choose two.)

A. The default gateway is configured on port2.
B. The RPF check fails.
C. The debug flow is for UDP traffic.
D. The matching firewall policy denies the traffic.

正解：A、D

解説：
The default gateway is configured on port2 → The debug output shows find a route:
flag=00000000 gw-0.0.0.0 via port2, which indicates that the default route (0.0.0.0/0) points out port2.
The matching firewall policy denies the traffic → The log line Denied by forward policy check (policy 2) confirms that policy 2 matched and explicitly dropped the traffic.

質問 # 45
When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

A. To allow the FortiGate to dynamically change interfaces for all active sessions when a WAN link fails
B. To improve security by forcing users to authenticate again when the WAN link changes
C. To ensure that existing SSL VPN connections remain on the same interface even if route changes occur
D. To make sure all sessions without source NAT enabled always use the primary WAN link

正解：C

解説：
Session preservation keeps active sessions, such as SSL VPNs, tied to the original interface to prevent disruption when WAN routes change.

質問 # 46
What are two characteristics of HA cluster heartbeat IP addresses in a FortiGate device?
(Choose two.)

A. A change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster.
B. The heartbeat interface of the primary device in the cluster is always assigned IP address
169.254.0.1.
C. Heartbeat interfaces have virtual IP addresses that are manually assigned.
D. Heartbeat IP addresses are used to distinguish between cluster members.

正解：A、D

解説：
Heartbeat IP addresses are used to distinguish between cluster members → Each FortiGate in the HA cluster uses unique heartbeat IPs so members can identify one another.
A change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster → Heartbeat IPs are dynamically reassigned when the cluster membership changes to maintain proper communication.

質問 # 47
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.

Which FortiGate is the primary?

A. HQ-NGFW-2 with the parameter memory-failover-threshold setting
B. HQ-NGFW-2 with the parameter priority setting
C. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
D. HQ-NGFW-1 with the parameter override setting

正解：D

解説：
The HA configuration shows that override is disabled (set override disable), but despite this, HQ- NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ- NGFW-1 is the primary device.

質問 # 48
Which two statements are true about an HA cluster? (Choose two.)

A. Link failover triggers a failover if the administrator sets the interface down on the primary device.
B. When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.
C. An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.
D. HA incremental synchronization includes FIB entries and IPsec SAs.

正解：A、D

解説：
Setting an interface down on the primary device triggers a failover due to link failover detection.
HA incremental synchronization includes forwarding information base (FIB) entries and IPsec security associations (SAs) to maintain session continuity.

質問 # 49
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)

A. If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.
B. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.
C. If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.
D. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

正解：A、C

解説：
When SD-WAN is disabled, FortiGate supports volume-based ECMP mode via the v4-ecmp- mode parameter.
When SD-WAN is enabled, the load balancing algorithm is controlled by the load-balance-mode parameter within the SD-WAN configuration.

質問 # 50
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress 10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

A. 10.200.1.99
B. 10.200.1.1
C. 10.200.1.149
D. 10.200.1.49

正解：A

解説：
All_TCP doesn't include ICMP. So you would match rule ID 2, in which uses IP Poop remote 1.

質問 # 51
What are three key routing principles in SD-WAN? (Choose three.)

A. By default. SD-WAN rules are skipped if the included SD-WAN members do not have a valid route to the destination.
B. SD-WAN rules have precedence over any other type of routes.
C. By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
D. By default. SD-WAN rules are skipped if only one route to the destination is available.
E. Regular policy routes have precedence over SD-WAN rules.

正解：A、B、C

解説：
SD-WAN rules are skipped if none of the SD-WAN members have a valid route to the destination.
SD-WAN rules take precedence over other route types.
SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member by default.

質問 # 52
Refer to the exhibit. The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)

A. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
B. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
C. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
D. These websites are in an allowlist of reputable domain names maintained by FortiGuard.

正解：A、C

解説：
FortiGate's temporary SSL certificate may cause access denial to sites using HTTP Strict Transport Security (HSTS), so such sites are exempted from deep SSL inspection. Legal regulations require exemption of certain categories to protect user privacy and sensitive information, so these web categories are excluded from SSL inspection.

質問 # 53
Refer to the exhibit. What can you conclude from the log shown in the exhibit?

A. The IPS socket buffer is full and IPS engine needs more memory to create new sessions.
B. The IPS session scan is paused and reevaluating the packet because of a dirty flag.
C. The IPS scan is paused by the IPS diagnostic command with bypass mode option 5.
D. The IPS socket buffer is full and IPS engine cannot decode a packet.

正解：A

解説：
The log message IPS session scan paused, enter fail open mode indicates that the IPS socket buffer is full, meaning the IPS engine does not have enough memory to process new sessions.
As a result, FortiGate switches to fail-open mode, allowing traffic to pass (or temporarily dropping it) without full IPS scanning.

質問 # 54
You want to ensure that an SSL VPN user's authenticated session does not remain active after they disconnect from the VPN.
Which configuration will ensure this?

A. Manually clear active firewall authentication sessions after a user disconnects.
B. Enable settings to force the firewall authentication session to end when the SSL VPN session ends
C. Configure the firewall authentication session timeout to be lower than the SSL VPN session timeout.
D. Increase the SSL VPN idle timeout to reduce the chance of early disconnections.

正解：B

解説：
To ensure that an authenticated SSL VPN user session does not persist after disconnecting, you must enable the setting that forces the firewall authentication session to end when the SSL VPN session ends. This ensures that once the VPN disconnects, the associated firewall authentication state is immediately cleared, preventing unintended access.

質問 # 55
Refer to the exhibits. A diagram of a FortiGate device connected to the network VIP object and firewall policy configurations are shown.
The WAN (port2) interface has the IP address 100.65.0.101/24.
The LAN (port4) interface has the IP address 10.0.11.254/24.
If the host 100.65.1.111sends a TCP SYN packet on port 443 to 100.65.0.200, what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

A. 10.0.11.254, 100.65.0.200, and 443, respectively
B. 100.65.1.111, 10.0.11.50and 443, respectively
C. 10.0.11.254, 10.0.15.50, and 4443, respectively
D. 100.65.1.111, 10.0.11.50, and 4443, respectively

正解：D

解説：
The VIP object maps the external IP 100.65.0.200:443 to the internal server 10.0.11.50:4443.
Since NAT is disabled on the firewall policy, the source IP is preserved.
So, when host 100.65.1.111 connects to 100.65.0.200:443:
- The source remains 100.65.1.111.
- The destination IP is translated to 10.0.11.50.
- The destination port is translated to 4443.

質問 # 56
Refer to the exhibits. The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device.

Based on the system performance output, what are the two possible outcomes? (Choose two.)

A. Administrators can change the configuration.
B. FortiGate drops new sessions.
C. FortiGate has entered conserve mode.
D. Administrators can access FortiGate only through the console port.

正解：A、B

解説：
Since memory usage is at 90%, exceeding the red threshold (88%), FortiGate enters a state where configuration changes are still allowed.
In this state, FortiGate drops new sessions to preserve resources and maintain stability.

質問 # 57
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.

The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)

A. 100.65.0.149
B. 100.65.0.49
C. 100.65.0.99
D. 100.65.0.101

正解：C

解説：
The ping traffic policy uses the IP pool named SNAT-Remote1, which has the external IP range
100.65.0.99. Therefore, traffic matching this policy (ping from HQ-PC-1 to BR1-FGT) will use
100.65.0.99 for source NAT.

質問 # 58
Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

A. On BR1-FGT, set Seconds to 43200.
B. On HQ-NGFW. set Encryption to AES256.
C. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.
D. On HQ-NGFW, enable Diffie-Hellman Group 2.

正解：A、C

解説：
The key lifetime (Seconds) must match on both sides; BR1-FGT is set to 14400, so setting it to
43200 matches HQ-NGFW.
The remote address on BR1-FGT should match the HQ-NGFW's local subnet (10.0.11.0/24), but it is currently set incorrectly as 172.20.1.0/24. Changing it to 10.0.11.0/255.255.255.0 will align the Phase 2 selectors.

質問 # 59
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

A. Disabled
B. Enabled
C. On Idle
D. On Demand

正解：D

解説：
Disable: Disable Dead Peer Detection.
On-idle: Trigger Dead Peer Detection when no IPsec traffic is received.
On-demand: Trigger Dead Peer Detection when no IPsec traffic is received AND FortiGate has been sending IPsec traffic. On-demand is the default setting.

質問 # 60
Refer to the exhibits. An administrator configured both members of an HA cluster at the same time. After one week of monitoring, the administrator wants to verify the HA failover performance.
How can the administrator force a failover?

A. The administrator must increase the HA priority on HQ-NGFW-2.
B. The administrator must set the monitored port to down on HQ-NGFW-1.
C. The administrator must reset the HA uptime on HQ-NGFW-1.
D. The administrator must set the parameter override to enable on HQ-NGFW-2.

正解：B

解説：
Both FortiGates are in an active-passive (a-p) HA cluster with override disabled. This means failover is triggered only if the primary (HQ-NGFW-1) becomes unavailable or monitored interfaces fail. To test failover performance, the administrator can set the monitored interface (port1) down on HQ-NGFW-1, which will force a failover to HQ-NGFW-2.

質問 # 61
......

有効な試験問題を試そうNSE4_FGT_AD-7.6は無料サイトで限定お試しチャンス：https://www.jpntest.com/shiken/NSE4_FGT_AD-7.6-mondaishu

無料Fortinet NSE 4 NSE4_FGT_AD-7.6公式認定ガイドPDFダウンロード：https://drive.google.com/open?id=1YgMXMC0FS4t8oyASBayXTzQXPCSW5mNZ