Nse4.0 v7.0_4

111. Which of the following SD-WAN load –balancing method use interface weight value to distribute traffic? (Choose two.)

• A. Source IP

• B. Spillover

• C. Volume

• D. Session

112.Examine the network diagram shown in the exhibit, then answer the following question:

Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?

• A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]

• B. 0.0.0.0/0 [20/0] via 10.4.200.2, port2

• C. 10.4.200.0/30 is directly connected, port2

• D. 172.16.32.0/24 is directly connected, port1

113.Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.

What should the administrator do next to troubleshoot the problem?

• A. Run a sniffer on the web server.

• B. Capture the traffic using an external sniffer connected to port1.

• C. Execute another sniffer in the FortiGate, this time with the filter “host 10.0.1.10”

• D. Execute a debug flow.

114.Examine this PAC file configuration

Which of the following statements are true? (Choose two.)

• A. Browsers can be configured to retrieve this PAC file from the FortiGate.

• B. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.

• C. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.

• D. Any web request fortinet.com is allowed to bypass the proxy.

115.A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

• A. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

• B. The two VLAN sub interfaces must have different VLAN IDs.

• C. The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs

• D. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

116.View the exhibit.

Which of the following statements are correct? (Choose two.)

• A. This setup requires at least two firewall policies with the action set to IPsec.

• B. Dead peer detection must be disabled to support this type of IPsec setup.

• C. The Tunnel B route is the primary route for reaching the remote site. The Tunnel A route is used only if the Tunnel B VPN is down

• D. This is a redundant IPsec setup.

117.Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

• A. To remove the NAT operation.

• B. To generate logs

• C. To finish any inspection operations

• D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

118.Which two statements are true when FortiGate is in transparent mode? (Choose two.)

• A. By default, all interfaces are part of the same broadcast domain.

• B. The existing network IP schema must be changed when installing a transparent mode.

• C. Static routes are required to allow traffic to the next hop.

• D. FortiGate forwards frames without changing the MAC address.

119.To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

• A. FortiManager

• B. Root FortiGate

• C. FortiAnalyzer

• D. Downstream FortiGate

120.View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games).

Based on this configuration, which statement is true?

• A. Addicting.Games is allowed based on the Application Overrides configuration.

• B. Addicting.Games is blocked on the Filter Overrides configuration.

• C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt

• D. Addcting.Games is allowed based on the Categories configuration