NSE4_FGT-6.4無料問題集「Fortinet NSE 4

質問 1

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

（A）Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

（B）Enable Dead Peer Detection.

（C）Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

（D）Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

正解：B、C 解答を投票する

質問 2

Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

（A）Denial of Service

（B）Antivirus

（C）Application control

（D）Web application firewall

正解：D 解答を投票する

質問 3

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

（A）Destination defined as Internet Services in the firewall policy.

（B）Source defined as Internet Services in the firewall policy.

（C）Highest to lowest priority defined in the firewall policy.

（D）Services defined in the firewall policy.

（E）Lowest to highest policy ID number.

正解：A、B、D 解答を投票する

質問 4

Which two statements are true about collector agent standard access mode? (Choose two.)

（A）Standard access mode supports nested groups.

（B）Standard mode uses Windows convention-NetBios: Domain\Username.

（C）Standard mode security profiles apply to organizational units (OU).

（D）Standard mode security profiles apply to user groups.

正解：B、D 解答を投票する

質問 5

Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

（A）Lookup is done on the first packet from the session originator

（B）Lookup is done on every packet, regardless of direction

（C）Lookup is done on the trust reply packet from the responder

（D）Lookup is done on the last packet sent from the responder

正解：A、C 解答を投票する

質問 6

NGFW mode allows policy-based configuration for most inspection rules. Which security profile's configuration does not change when you enable policy-based inspection?

（A）Antivirus

（B）Web filtering

（C）Application control

（D）Web proxy

正解：A 解答を投票する

質問 7

Which statement regarding the firewall policy authentication timeout is true?

（A）It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

（B）It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

（C）It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

（D）It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

正解：D 解答を投票する

質問 8

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

（A）On Demand

（B）Disabled

（C）On Idle

（D）Enabled

正解：C 解答を投票する

質問 9

Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

（A）One server was contacted to retrieve the contract information.

（B）A local FortiManager is one of the servers FortiGate communicates with.

（C）FortiGate is using default FortiGuard communication settings.

（D）There is at least one server that lost packets consecutively.

正解：A、C 解答を投票する

質問 10

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

（A）To force a new DH exchange with each phase 2 rekey.

（B）To encapsulation ESP packets in UDP packets using port 4500.

（C）To dynamically change phase 1 negotiation mode aggressive mode.

（D）To detect intermediary NAT devices in the tunnel path.

正解：B、D 解答を投票する

NSE4_FGT-6.4 無料問題集「Fortinet NSE 4 - FortiOS 6.4」

弊社を連絡する

関連リンク

トップ試験