Attested NSE4_FGT-6.2 Dumps PDF Resource [2024]
Latest NSE4_FGT-6.2 Actual Free Exam Questions Updated 142 Questions
NEW QUESTION # 25
What settings must you configure to ensure FortiGate generates logs for web filter activity on a firewall policy called Full Access? (Choose two.)
- A. Enable Event Logging.
- B. Enable disk logging.
- C. Enable a web filter security profile on the Full Access firewall policy.
- D. Enable Log Allowed Traffic on the Full Access firewall policy.
Answer: C,D
NEW QUESTION # 26
Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
- A. Browsers can be configured to retrieve this PAC file from the FortiGate.
- B. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- C. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
- D. Any web request fortinet.com is allowed to bypass the proxy.
Answer: A,D
NEW QUESTION # 27
Examine the two static routes shown in the exhibit, then answer the following question.
Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
- A. FortiGate will route twice as much traffic to the port2 route
- B. FortiGate will only actuate the port1 route in the routing table
- C. FortiGate will load balance all traffic across both routes.
- D. FortiGate will use the port1 route as the primary candidate.
Answer: D
Explanation:
Explanation
"If multiple static routes have the same distance, they are all active; however, only the one with the lowest priority is considered the best path."
NEW QUESTION # 28
What FortiGate components are tested during the hardware test? (Choose three.)
- A. CPU
- B. Administrative access
- C. HA heartbeat
- D. Hard disk
- E. Network interfaces
Answer: A,D,E
NEW QUESTION # 29
Consider a new IPsec deployment with the following criteria:
* All satellite offices must connect to the two HQ sites.
* The satellite offices do not need to communicate directly with other satellite offices.
* Backup VPN is not required.
* The design should minimize the number of tunnels being configured.
Which topology should you use to satisfy all of the requirements?
- A. Redundant
- B. Partial mesh
- C. Full mesh
- D. Hub-and-spoke
Answer: D
NEW QUESTION # 30
Which Statements about virtual domains (VDOMs) arc true? (Choose two.)
- A. Different VLAN sub-interface of the same physical interface can be assigned to different VDOMs.
- B. Each VDOM can be configured with different system hostnames.
- C. Each VDOM has its own routing table.
- D. Transparent mode and NAT/Route mode VDOMs cannot be combined on the same FortiGate.
Answer: A,C
NEW QUESTION # 31
An employee connects to the https://example.com on the Internet using a web browser. The web server's certificate was signed by a private internal CA. The FortiGate that is inspecting this traffic is configured for full SSL inspection.
This exhibit shows the configuration settings for the SSL/SSH inspection profile that is applied to the policy that is invoked in this instance. All other settings are set to defaults. No certificates have been imported into FortiGate. View the exhibit and answer the question that follows.
Which certificate is presented to the employee's web browser?
- A. The web server's certificate.
- B. A certificate signed by Fortinet_CA_SSL.
- C. A certificate signed by Fortinet_CA_Untrusted.
- D. The user's personal certificate signed by a private internal CA.
Answer: B
NEW QUESTION # 32
Which two statements correctly describe auto discovery VPN (ADVPN)? (Choose two.)
- A. ADVPN is supported only with IKEv2.
- B. Every spoke requires a static tunnel to be configured to other spokes, so that phase 1 and phase 2 proposals are defined in advance.
- C. IPSec tunnels are negotiated dynamically between spokes.
- D. It recommends the use of dynamic routing protocols, so that spokes can learn the routes to other spokes.
Answer: C,D
NEW QUESTION # 33
An administrator is investigating a report of users having intermittent issues with browsing the web. The administrator ran diagnostics and received the output shown in the exhibit.
Examine the diagnostic output shown exhibit. Which of the following options is the most likely cause of this issue?
- A. High memory usage
- B. High session timeout value
- C. NAT port exhaustion
- D. High CPU usage
Answer: C
NEW QUESTION # 34
An administrator needs to strengthen the security for SSL VPN access. Which of the following statements are best practices to do so? (Choose three.)
- A. Configure SSL offloading to a content processor (FortiASIC).
- B. Configure two-factor authentication using security certificates.
- C. Configure a client integrity check (host-check).
- D. Configure host restrictions by IP or MAC address.
- E. Configure split tunneling for content inspection.
Answer: B,C,D
NEW QUESTION # 35
Examine the exhibit, which contains a virtual IP and firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address
10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
- A. 10.200.1.10
- B. 10.0.1.254
- C. Any available IP address in the WAN (port1) subnet 10.200.1.0/24
- D. 10.200.1.1
Answer: C
Explanation:
Explanation
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Objects/Virtual%20IPs.
NEW QUESTION # 36
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?
- A. Root VDOM
- B. FG-traffic VDOM
- C. Global VDOM
- D. Customer VDOM
Answer: A
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.2.0/new-features/287377/split-task-vdom-support
NEW QUESTION # 37
Examine the network diagram shown in the exhibit, and then answer the following question:
A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of the following static routes will satisfy this requirement on FGT1? (Choose two.)
- A. 172.20.2.0/24 (25/0) via 10.10.3.2, port3 [5/0]
- B. 172.20.2.0/24 (1/150) via 10.10.1.2, port3 [10/0]
- C. 172.20.2.0/24 (1/150) via 10.30.3.2, port3 [10/0]
- D. 172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
Answer: B,C
NEW QUESTION # 38
View the exhibit.
A
user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?
- A. Addicting.Games is blocked on the Filter Overrides configuration.
- B. Addcting.Games is allowed based on the Categories configuration.
- C. Addicting.Games is allowed based on the Application Overrides configuration.
- D. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
Answer: C
NEW QUESTION # 39
Examine the following web filtering log.
Which statement about the log message is true?
- A. The usage quota for the IP address 10.0.1.10 has expired
- B. The web site miniclip.com matches a static URL filter whose action is set to Warning.
- C. The name of the applied web filter profile is default.
- D. The action for the category Games is set to block.
Answer: C
NEW QUESTION # 40
View the exhibit. Which of the following statements is true regarding the configuration settings?
Response:
- A. When a remote user accesses http: //10.200.1.1 :443, the FortiGate login page appears.
- B. The settings are invalid. The administrator settings and the SSL VPN settings cannot use the same port.
- C. When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.
- D. When a remote user accesses https://10.200.1.1:443, the FortiGate login page appears.
- E. When a remote user accesses http: /110.200.1.1:443, the SSL VPN login page appears.
Answer: C
NEW QUESTION # 41
Which statements about antivirus scanning mode are true? (Choose two.)
- A. In flow-based inspection mode, you can use the CLI to configure antivirus profiles to use protocol option profiles.
- B. In quick scan mode, you can configure antivirus profiles to use any of the available signature data bases.
- C. In proxy-based inspection mode, if a virus is detected, a replacement message may not be displayed immediately.
- D. In proxy-based inspection mode antivirus buffers the whole file for scarring before sending it to the client.
Answer: A,D
Explanation:
Explanation
A: Buffers the whole file, packets sent to the client after scan finishes- B: When the antivirus profile is operating in flow-based inspection mode, two scanning mode options are available: full scan mode and quick scan mode.(Normal extended, or extreme-depending on what is configured in the CLI).
NEW QUESTION # 42
......
NSE4_FGT-6.2 Certification Overview Latest NSE4_FGT-6.2 PDF Dumps: https://www.test4sure.com/NSE4_FGT-6.2-pass4sure-vce.html
Free NSE4_FGT-6.2 Exam Braindumps certification guide Q&A: https://drive.google.com/open?id=1eAgOLuugVGukpOAzGWA_hpSwms0W4cZa