Use the best ways of preparing for NSE4_FGT-6.4 Exam Dumps with ActualCollection Fortinet NSE4_FGT-6.4 dump PDF [2021]
Fortinet NSE4_FGT-6.4 exam candidates will surely pass the Exam if they consider the NSE4_FGT-6.4 dumps learning material presented by ActualCollection.
NEW QUESTION 41
Refer to the exhibit to view the application control profile.
https://www.fast2test.com/NSE4_FGT-6.4-practice-test.html 1
Valid Fast2test NSE4_FGT-6.4 Exam PDF Dumps - New NSE4_FGT-6.4 Real Exam Questions
Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?
- A. The category of Apple FaceTime is being blocked.
- B. Apple FaceTime belongs to the custom blocked filter.
- C. The category of Apple FaceTime is being monitored.
- D. Apple FaceTime belongs to the custom monitored filter.
Answer: D
NEW QUESTION 42
Refer to the exhibit.
The exhibit contains a network diagram, firewall policies, and a firewall address object configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2. Remote-user2 is still able to access Webserver.
Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Set the Destination address as Deny_IP in the Allow-access policy.
- B. Enable match vip in the Deny policy.
- C. Set the Destination address as Web_server in the Deny policy.
- D. Disable match-vip in the Deny policy.
Answer: B,C
NEW QUESTION 43
Examine this output from a debug flow:
Why did the FortiGate drop the packet?
- A. It matched an explicitly configured firewall policy with the action DENY.
- B. The next-hop IP address is unreachable.
- C. It failed the RPF check.
- D. It matched the default implicit firewall policy.
Answer: D
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
NEW QUESTION 44
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- A. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
- B. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
- C. Enable Dead Peer Detection.
- D. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Answer: A,C
NEW QUESTION 45
Refer to the exhibit, which contains a radius server configuration.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option What will be the impact of using Include in every user group option in a RADIUS configuration?
- A. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
- B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- C. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
- D. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
Answer: D
NEW QUESTION 46
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase
2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
- A. On HQ-FortiGate, set Encryption to AES256.
- B. On HQ-FortiGate,enable Auto-negotiate.
- C. On HQ-FortiGate,enable Diffie-Hellman Group 2.
- D. On Remote-FortiGate, set Seconds to 43200.
Answer: A
NEW QUESTION 47
Refer to the exhibit, which contains a session diagnostic output.
Which statement is true about the session diagnostic output?
- A. The session is in TCP ESTABLISHED state.
- B. The session is a bidirectional TCP connection.
- C. The session is a UDP unidirectional state.
- D. The session is a bidirectional UDP connection.
Answer: D
NEW QUESTION 48
Examine this FortiGate configuration:
Examine the output of the following debug command:
Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?
- A. It is allowed and inspected, as long as the only inspection required is antivirus.
- B. It is allowed and inspected as long as the inspection is flow based
- C. It is allowed, but with no inspection
- D. It is dropped.
Answer: D
NEW QUESTION 49
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A. This is a security log.
- B. Log severity is set to error on FortiGate.
- C. Traffic is blocked because Action is set to DENY in the firewall policy.
- D. Traffic belongs to the root VDOM.
Answer: A,C
NEW QUESTION 50
Which of statement is true about SSL VPN web mode?
- A. The external network application sends data through the VPN.
- B. The tunnel is up while the client is connected.
- C. It supports a limited number of protocols.
- D. It assigns a virtual IP address to the client.
Answer: C
Explanation:
Explanation
FortiGate_Security_6.4 page 575 - Web mode requires only a web browser, but supports a limited number of protocols.
NEW QUESTION 51
Refer to the exhibit.
The exhibit contains a network diagram, firewall policies, and a firewall address object configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2.
Remote-user2 is still able to access Webserver.
Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
- A. Disable match-vip in the Deny
- B. Enable match vip in the Deny policy.
- C. Set the Destination address as Web_server in the Deny policy.
- D. Set the Destination address as
Answer: B,C
NEW QUESTION 52
Which two types of traffic are managed only by the management VDOM? (Choose two.)
- A. DNS
- B. PKI
- C. Traffic shaping
- D. FortiGuard web filter queries
Answer: C,D
NEW QUESTION 53
A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.
Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.
- A. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
- B. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.
- C. The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.
- D. The two VLAN sub interfaces must have different VLAN IDs.
Answer: D
Explanation:
Explanation
FortiGate_Infrastructure_6.0_Study_Guide_v2-Online.pdf -> page 147
"Multiple VLANs can coexist in the same physical interface, provide they have different VLAN ID"
NEW QUESTION 54
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?
- A. To allow for out-of-order packets that could arrive after the FIN/ACK packets.
- B. To remove the NAT operation.
- C. To generate logs
- D. To finish any inspection operations.
Answer: A
NEW QUESTION 55
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. A session for denied traffic is created.
- B. Device detection on all interfaces is enforced for 30 minutes.
- C. The number of logs generated by denied traffic is reduced.
- D. Denied users are blocked for 30 minutes.
Answer: A,C
NEW QUESTION 56
Which two statements are true about the RPF check? (Choose two.)
- A. The RPF check is run on the first reply packet of any new session.
- B. RPF is a mechanism that protects FortiGuard and your network from IP spoofing attacks.
- C. The RPF check is run on the first sent packet of any new session.
- D. The RPF check is run on the first sent and reply packet of any new session.
Answer: B,C
Explanation:
Explanation/Reference: https://www.programmersought.com/article/16383871634/
NEW QUESTION 57
Refer to the exhibit.
The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet. The To_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)
- A. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
- B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
- C. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
- D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
Answer: C,D
NEW QUESTION 58
Refer to the exhibit.
The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
- A. Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.
- B. Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.
- C. If there is a full-through policy in place, users will not be prompted for authentication.
- D. Authentication is enforced at a policy level; all users will be prompted for authentication.
Answer: D
NEW QUESTION 59
Refer to the exhibit.
The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.
Which interface will be selected as an outgoing interface?
- A. port1
- B. port3
- C. port2
- D. port4
Answer: A
NEW QUESTION 60
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken.
Each site has a FortiGate VPN gateway.
What must an administrator do to achieve this objective?
- A. The administrator can use a third-party radius OTP server.
- B. The administrator can register the same FortiToken on more than one FortiGate.
- C. The administrator must use a FortiAuthenticator device.
- D. The administrator must use the user self-registration server.
Answer: A
NEW QUESTION 61
Which of the following SD-WAN load balancing method use interface weight value to distribute traffic? (Choose two.)
- A. Source IP
- B. Volume
- C. Spillover
- D. Session
Answer: B,D
NEW QUESTION 62
How does FortiGate act when using SSL VPN in web mode?
- A. FortiGate acts as an FDS server.
- B. FortiGate acts as router.
- C. FortiGate acts as DNS server.
- D. FortiGate acts as an HTTP reverse proxy.
Answer: D
NEW QUESTION 63
Refer to the exhibit.
The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?
- A. Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.
- B. Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.
- C. Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.
- D. Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.
Answer: C
NEW QUESTION 64
......
Accurate & Verified Answers As Seen in the Real Exam here: https://www.actualcollection.com/NSE4_FGT-6.4-exam-questions.html