Labour Day Special - 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: c4sdisc65

Note! NSE4_FGT-6.4 has been withdrawn. The new exam code is NSE4_FGT-7.2

NSE4_FGT-6.4 Practice Exam Questions with Answers Fortinet NSE 4 - FortiOS 6.4 Certification

Question # 6

Refer to the exhibits.

NSE4_FGT-6.4 question answer

NSE4_FGT-6.4 question answer

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.

Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

Which part of the policy configuration must you change to resolve the issue?

A.

The SSL inspection needs to be a deep content inspection.

B.

Force access to Facebook using the HTTP service.

C.

Additional application signatures are required to add to the security policy.

D.

Add Facebook in the URL category in the security policy.

Full Access
Question # 7

An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

A.

Configure Source IP Pools.

B.

Configure split tunneling in tunnel mode.

C.

Configure different SSL VPN realms.

D.

Configure host check.

Full Access
Question # 8

Refer to the exhibit.

NSE4_FGT-6.4 question answer

The exhibits show a network diagram and the explicit web proxy configuration.

In the command diagnose sniffer packet, what filter can you use to capture the traffic between the

client and the explicit web proxy?

A.

‘host 192.168.0.2 and port 8080’

B.

‘host 10.0.0.50 and port 80’

C.

‘host 192.168.0.1 and port 80’

D.

‘host 10.0.0.50 and port 8080’

Full Access
Question # 9

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

A.

Root VDOM

B.

FG-traffic VDOM

C.

Customer VDOM

D.

Global VDOM

Full Access
Question # 10

An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

A.

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

B.

Create a new service object for HTTP service and set the session TTL to never

C.

Set the TTL value to never under config system-ttl

D.

Set the session TTL on the HTTP policy to maximum

Full Access
Question # 11

By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.

Which two CLI commands will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering? (Choose two.)

A.

set fortiguard anycast disable

B.

set protocol udp

C.

set webfilter-force-off disable

D.

set webfilter-cache disable

Full Access
Question # 12

If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

A.

IP address

B.

Once Internet Service is selected, no other object can be added

C.

User or User Group

D.

FQDN address

Full Access
Question # 13

Which three methods are used by the collector agent for AD polling? (Choose three.)

A.

FortiGate polling

B.

NetAPI

C.

Novell API

D.

WMI

E.

WinSecLog

Full Access
Question # 14

Which scanning technique on FortiGate can be enabled only on the CLI?

A.

Heuristics scan

B.

Trojan scan

C.

Antivirus scan

D.

Ransomware scan

Full Access
Question # 15

Examine this PAC file configuration.

NSE4_FGT-6.4 question answer

Which of the following statements are true? (Choose two.)

A.

Browsers can be configured to retrieve this PAC file from the FortiGate.

B.

Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.

C.

All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.

D.

Any web request fortinet.com is allowed to bypass the proxy.

Full Access
Question # 16

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

A.

To detect intermediary NAT devices in the tunnel path.

B.

To dynamically change phase 1 negotiation mode aggressive mode.

C.

To encapsulation ESP packets in UDP packets using port 4500.

D.

To force a new DH exchange with each phase 2 rekey.

Full Access
Question # 17

Refer to the exhibit.

NSE4_FGT-6.4 question answer

Based on the raw log, which two statements are correct? (Choose two.)

A.

Traffic is blocked because Action is set to DENY in the firewall policy.

B.

Traffic belongs to the root VDOM.

C.

This is a security log.

D.

Log severity is set to error on FortiGate.

Full Access
Question # 18

Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

A.

Proxy-based inspection

B.

Certificate inspection

C.

Flow-based inspection

D.

Full Content inspection

Full Access
Question # 19

When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

A.

Log ID

B.

Universally Unique Identifier

C.

Policy ID

D.

Sequence ID

Full Access
Question # 20

An administrator has configured the following settings:

NSE4_FGT-6.4 question answer

What are the two results of this configuration? (Choose two.)

A.

Device detection on all interfaces is enforced for 30 minutes.

B.

Denied users are blocked for 30 minutes.

C.

A session for denied traffic is created.

D.

The number of logs generated by denied traffic is reduced.

Full Access
Question # 21

An organization’s employee needs to connect to the office through a high-latency internet connection.

Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

A.

Change the session-ttl.

B.

Change the login timeout.

C.

Change the idle-timeout.

D.

Change the udp idle timer.

Full Access
Question # 22

Examine this FortiGate configuration:

NSE4_FGT-6.4 question answer

Examine the output of the following debug command:

NSE4_FGT-6.4 question answer

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

A.

It is allowed, but with no inspection

B.

It is allowed and inspected as long as the inspection is flow based

C.

It is dropped.

D.

It is allowed and inspected, as long as the only inspection required is antivirus.

Full Access
Question # 23

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

A.

The subject field in the server certificate

B.

The serial number in the server certificate

C.

The server name indication (SNI) extension in the client hello message

D.

The subject alternative name (SAN) field in the server certificate

E.

The host field in the HTTP header

Full Access
Question # 24

Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

A.

Fabric Coverage

B.

Automated Response

C.

Security Posture

D.

Optimization

Full Access