Nse4.0 v7.0_6

141.Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

• A. A local FortiManager is one of the servers FortiGate communicates with.

• B. One server was contacted to retrieve the contract information.

• C. There is at least one server that lost packets consecutively.

• D. FortiGate is using default FortiGuard communication settings.

142.Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

• A. Fabric Coverage

• B. Automated Response

• C. Security Posture

• D. Optimization

143.Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.

What will be the impact of using Include in every user group option in a RADIUS configuration?

• A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

• B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

• C. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate

• D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

144.Which statement regarding the firewall policy authentication timeout is true?

• A. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source IP.

• B. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source IP address after this timer has expired

• C. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source MAC

• D. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source MAC address after this timer has expired

145.An administrator is running the following sniffer command:

diagnose aniffer packet any "host 192.1.68.2.12” 5

Which three pieces of Information will be Included in me sniffer output? {Choose three.)

• A. Interface name

• B. Packet payload

• C. Ethernet header

• D. IP header

• E. Application heade

146.Which two protocol options are available on the CLI but not on the GUI when configuring an SD-

WAN Performance SLA? (Choose two.)

• A. DNS

• B. ping

• C. udp-echo

• D. TWAMP

147.Which three statements are true regarding session-based authentication? (Choose three.)

• A. HTTP sessions are treated as a single user.

• B. IP sessions from the same source IP address are treated as a single user

• C. It can differentiate among multiple clients behind the same source IP address.

• D. It requires more resources.

• E. It is not recommended if multiple users are behind the source NAT

148.Which of the following statements about central NAT are true? (Choose two.)

• A. IP tool references must be removed from existing firewall policies before enabling central NAT.

• B. Central NAT can be enabled or disabled from the CLI only.

• C. Source NAT, using central NAT, requires at least one central SNAT policy.

• D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

149.What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

• A. FortiGate automatically negotiates different local and remote addresses with the remote peer.

• B. FortiGate automatically negotiates a new security association after the existing security association expires

• C. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

• D. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

150.Which statement about the IP authentication header (AH) used by IPsec is true?

• A. AH does not provide any data integrity or encryption.

• B. AH does not support perfect forward secrecy.

• C. AH provides data integrity bur no encryption

• D. AH provides strong data integrity but weak encryption