Font size
WorksheetsPost Test NSE4 Basic Training
Total questions: 45
Worksheet time: 26mins
An administrator is investigating a report of users having intermittent issues with browsing the web. The administrator ran diagnostics and received the output shown in the exhibit.
NAT port exhaustion
High CPU usage
High memory usage
High session timeout value
Which statement about FortiGuard services for FortiGate is true?
The web filtering database is downloaded locally on FortiGate.
Antivirus signatures are downloaded locally on FortiGate.
FortiGate downloads IPS updates using UDP port 53 or 8888.
FortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.
Which of the following services can be inspected by the DLP prof ile? (Choose three.)
IMAP
ClFS
FTP
HTTP-POST
NFS
Which of the following statements about virtual domains(VDOMs) are true? (Choose two.)
Each VDOM maintains its own routing table.
A FortiGate device has 64 VDOMs, created by default.
Each VDOM maintains its own system time.
The root VDOM is the management VDOM by default.
What FortiGate components are tested during the hardware test? (Choose three.)
Hard disk
HAheartbeat
CPU
Network interfaces
Administrativeaccess
Which one of the following processes is involved in updating IPS from FortiGuard?
FortiGate IPS update requests are sent using UDP port 443.
Protocol decoder update requests are sent to service. fortiguard.net.
IPS engine updates can only be obtained using push updates.
IPS signature update requests are sent to update. fortiguard.net.
Which of the following statements about Conserve mode are true? (Choose two.)
FortiGate stops doing RPF checks over incoming packets
Administrators cannot change the configuration
Administrators can access the FortiGate only through the console port.
FortiGate stops sending f iles to FortiSandbox for inspection.
Given the FortiGate CLI output, why is the administrator getting the error shown in the exhibit?
The administrator must first enter the command edit global.
The administrator admin does not have the privileges required to configure global settings.
The command config system global does not exist in FortiGate.
The global settings cannot be configured from the root VDOM context.
Examine the network diagram and the existing FGTI routing table shown in the exhibit, and then answer the following question:An administrator has added the following static route on FGTI.
Since the change, the new static route is not showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?
The new route's destination subnet overlaps an existing route.
The new route's Distance value should be higher than 10.
The Gateway IP address is not in the same subnet as port1.
The Priority is 0, which means that this route will remain inactive.
Which users and user groups are allowed access to the network through captive portal?
Users and groups defined in the firewall policy.
Only individual users "" not groups "" defined in the captive portal configuration
Groups defined in the captive portal configuration
All users
NGFW mode allows policy-based configuration for most inspection rules. Which security profile's configuration does not change when you enable policy-based inspection?
Web filtering
Antivirus
Web proxy
Application control
During the digital verification process, comparing the original and fresh hash results satisfies which security requirement?
Non-repudiation.
Data integrity.
Signature verification.
Authentication.
Why must you use aggressive mode when a local FortiGate lPSec gateway hosts multiple dialup tunnels?
In aggressive mode, the remote peers are able to provide their peer IDs in the first message.
FortiGate is able to handle NATed connections only in aggressive mode.
FortiClient only supports aggressive mode.
Main mode does not support XAuth for user authentication.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
Run a sniffer on the web server.
Capture the traffic using an external sniffer connected to port1.
Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"
Execute a debug flow.
Which of the following statements are best practices for troubleshooting FSSO? (Choose two.)
Include the group of guest users in a policy.
Extend timeout timers.
Guarantee at least 34 Kbps bandwidth between FortiGate and domain controllers.
Ensure all firewalls allow the FSSO required ports.
If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected for the Destination field of a firewall policy?
IP address
User or User Group
No other object can be added
FQDN address
Which statements about HA for FortiGate devices are true? (Choose two.)
Sessions handled by proxy-based security profiles cannot be synchronized.
Virtual clustering can be configured between two FortiGate devices that have multiple VDOMs.
HA management interface settings are synchronized between cluster members.
Heartbeat interfaces are not required on the primary device.
An administrator has configured a route-based IPsec VPN between two FortiGate devices.
Which statement about this IPsec VPN configuration is true?
A phase 2 configuration is not required.
This VPN cannot be used as part of a hub-and-spoke topology.
A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
The IPsec firewall policies must be placed at the top of the list.
What settings must you configure to ensure FortiGate generates logs for web filter activity on a firewall policy called Full Access? (Choose two.)
Enable Event Logging
Enable Log Allowed Traff ic on the Full Access firewall policy
Enable a web filer security profile on the Full Access f irewall policy
Enable disk logging.
Based on the configuration shown in the exhibit, what statements about application control behavior are true? (Choose two.)
Access to all unknown applications will be allowed.
Access to browser-based Social.Media applications will be blocked.
Access to mobile social media applications will be blocked.
Access to all applications in Social.Media category will be blocked.
HTTP Public Key Pinning (HPKP) can be an obstacle to implementing full SSL inspection. What solutions could resolve this problem? (Choose two.)
Enable Allow Invalid SSL Certificates for the relevant security profile.
Change web browsers to one that does not support HPKP.
Exempt those web sites that use HPKP from full SSL inspection.
Install the CA certificate (that is required to verify the web server certificate) stores of users' computers.
Examine the routing database shown in the exhibit, and then answer the following question:
Which of the following statements are correct? (Choose two.)
The port3 default route has the highest distance.
The port3 default route has the lowest metric.
There will be eight routes active in the routing table.
The port1 and port2 default routes are active in the routing table.
Which of the following features is supported by web filter in flow-based inspection mode with NGFW mode set to profile-based? (choose two)
FortiGuard Quotas
Static URL Filter
Search engines
Rating option
Examine the exhibit, which contains a virtual IP and firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
10.200.1.10
Any available IP address in the WAN (port1) subnet 10.200.1.0/24
10.200.1.1
10.0.1.254
By default, when logging to disk, when does FortiGate delete logs?
1 year
7 days
Never
30 days
When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?
The public IP address of the FortiGate device
remote user's public IP address
The remote user's virtual IP address
The internal IP address of the FortiGate device
A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not.
Which configuration option is the most effective way to support this request?
Implement web filter authentication for the specified website
Implement DNS f ilter for the specified website.
Implement a web filter category override for the specified website
Implement web filter quotas for the specif ied website.
Which two statements about antivirus scanning mode are true? (Choose two.)
In proxy-based inspection mode, files bigger than the buffer size are scanned
In full scan flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
In quick scan mode, you can conf igure antivirus prof iles to use any of the available antivirus signature databases.
In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.
Which is the correct description of a hash result as it relates to digital certificates?
An encrypted output value used to safe-guard the input data
An output value that is used to identify the person or deduce that authored the input data.
An obfuscation used to mask the input data.
A unique value used to verify the input data
On a FortiGate with a hard disk, how frequently can you upload logs to FortiAnalyzer or FortiManager? (Choose two.)
every 5 minutes
hourly
on demand
real-time
Which statement about DLP on FortiGate is true?
Files can be sent to FortiSandbox for detecting DLP threats
It can be applied to a firewall policy in a flow-based VDOM
It can archive files and messages
Traffic shaping can be applied to DLP sensors.
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)
This is known as many-to-one NAT.
Source IP is translated to the outgoing interface IP.
Connections are tracked using source port and source MAC address.
Port address translation is not used.
What criteria does FortiGate use to look for a matching firewall policy to process traff ic? (Choose two.)
Services defined in the firewall policy
Highest to lowest priority defined in the firewall policy.
Lowest to highest policy ID number.
Incoming and outgoing interfaces
An administrator wants to configure a FortiGate as a DNS server. FotiGate must use a DNS database first, and then relay all irresolvable queries to an external
DNS server. Which of the following DNS methods must you use?
Recursive
Non-recursive
Forward to primary and secondary DNS
Forward to system DNS
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?
Downstream FortiGate
FortiAnalyzer
FortiManager
Root FortiGate
An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.
Where must the proxy address be used?
As the source in a firewall policy.
As the source in a proxy policy.
As the destination in a firewall policy.
As the destination in a proxy policy.
An administrator has configured two VLAN interfaces:
A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?
Both interfaces must belong to the same forward domain.
The role of the VLAN10 interface must be set to server.
Both interfaces must have the same VLAN ID.
Both interfaces must be in different VDOMs.
Which three statements correctly describe transparent mode operation? (Choose three.)
The transparent FortiGate is visible to network hosts in an IP traceroute.
FortiGate acts as a transparent bridge and forwards traffic at Layer 2.
Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
All interfaces on the transparent mode FortiGate device must be on different IP subnets.
Given to the static routes shown in the exhibit, which statements are correct? (Choose two.)
This is a redundant IPsec setup.
This setup requires at least two firewall policies with the action set to IPsec
Dead peer detection must be disabled to support this type of IPsec setup.
The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
Which statement about the exhibit is true? (Choose two.)
Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
port-VLAN1 is the native VLAN for the port1 physical interface.
port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
Given the network diagram shown in the exhibit, which route is the best candidate route for FGT1 to route traffic from the workstation to the webserver?
172.16.32.0/24 is directly connected, port1
172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
10.4.200.0/30 is directly connected, port2
0.0.0.0/0 [20/0] via 10.4.200.2, port2
A firewall administrator must configure equal cost multipath (ECMP) routing on FGT1 to ensure both port1 and port3 links are used at the same time for all traffic destined for 172.20.2.0/24. Which of the following static routes will satisfy this requirement on FGT1? (Choose two.)
172.20.2.0/24 (1/0) via 10.10.1.2, port1 [0/0]
172.20.2.0/24 (25/0) via 10.10.3.2, port3 [5/0]
172.20.2.0/24 (1/150) via 10.10.3.2, port3 [10/0]
172.20.2.0/24 (25/0) via 10.10.3.2, port3 [5/0]
Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)
Warning
Exempt
Allow
Learn
Which two static routes are not maintained in the routing table? (Choose two.)
Dynamic routes
Policy routes
ISDB routes
Named Address routes
What will happen to unauthenticated users when an active authentication policy is followed by a fall through policy without authentication?
The user must log in again to authenticate.
The user will be denied access to resources without authentication.
The user will not be prompted for authentication.
User authentication happens at an interface level.
