NSE 4

Which three settings and protocols can be used to provide secure and restrictive administrative access to FortiGate? (Choose three.)

• HTTPS

• SSH

• Trusted host

• Trusted authentication

• FortiTelemetry

What is the purpose of the Policy Lookup feature?

• It creates a new firewall policy based on input criteria.

• It creates packet flow over FortiGate by sending real-time traffic

• It finds duplicate objects in firewall policies.

• It searches the matching policy based on input criteria.

Which two statements about incoming and outgoing interfaces in firewall policies are true? (Choose two.)

• A zone can be chosen as the outgoing interface.

• An incoming interface is mandatory in a firewall policy, but an outgoing interface is optional.

• Multiple interfaces can be selected as incoming and outgoing interfaces.

• Only the any interface can be chosen as an incoming interface.

Which statement about firewall policy NAT is true?

• You must configure SNAT for each firewall policy.

• SNAT can automatically apply to multiple firewall policies, based on SNAT policies.

• DNAT is not supported.

• DNAT can automatically apply to multiple firewall policies, based on DNAT rules.

An administrator has configured central DNAT and virtual IPs.

Which of the following can be selected in the firewall policy Destination field?

• The mapped IP address object of the VIP object

• A VIP object

• A VIP group

• An IP pool

FortiGate has been configured for Firewall Authentication. When attempting to access an external website, the user is not presented with a login prompt.

What is the most likely reason for this situation?

• The user is using a super admin account.

• No matching user account exists for this user.

• The user was authenticated using passive authentication.

• The user is using a guest account profile.

What does this raw log indicate? (Choose two.)

Select one or more:

• Traffic originated from 13.32.69.150

• FortiGate allowed the traffic to pass

• 10.0.1.10 is the IP address for *.cdn.mozilla.net

• Traffic matches the application profile on firewall policy ID 1

View the exhibit. Which two behaviors result from this full (deep) SSL configuration? (Choose two.)

Select one or more:

• A temporary untrusted FortiGate certificate replaces the server certificate when the server certificate is untrusted.

• A temporary trusted FortiGate certificate replaces the server certificate when the server certificate is trusted.

• A temporary trusted FortiGate certificate replaces the server certificate, even when the server certificate is untrusted.

• The browser bypasses all certificate warnings and allows the connection.

Which two statements about blocking known Botnet Command and Control domains are true? (Choose two.)

• This service requires a FortiGuard web filter and IPS license.

• DNS lookups are checked against the Botnet Command and Control database.

• You must manually download the Botnet Command and Control database and import it into FortiGate.

• The Botnet Command and Control domains can be enabled in the Web Filter profile.

Which three actions are valid for static URL filtering? (Choose three.)

• Warning

• Block

• Shape

• Allow

• Exempt