Exam Dumps NSE4_FGT-6.4 Practice Free Latest Fortinet Practice Tests [Q66-Q85] – IT Certification Exam Questions & Answers

Rate this post

Exam Dumps NSE4_FGT-6.4 Practice Free Latest Fortinet Practice Tests

NSE4_FGT-6.4 Exam Questions | Real NSE4_FGT-6.4 Practice Dumps

NO.66 Refer to the exhibit.

The exhibits show a network diagram and the explicit web proxy configuration.
In the commanddiagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

‘host 192.168.0.2 and port 8080’

‘host 10.0.0.50 and port 80’

‘host 192.168.0.1 and port 80’

‘host 10.0.0.50 and port 8080’

NO.67 Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is a UDP unidirectional state.

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a bidirectional TCP connection.

NO.68 Refer to the exhibit.

Which contains a network diagram and routing table output.
The Student is unable to access Webserver.
What is the cause of the problem and what is the solution for the problem?

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0.114.24/32 through port3.

NO.69 Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

Both the phase 1 SA and phase 2 SA are bidirectional.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

NO.70 Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200.1.149

10.200.1.1

10.200.1.49

10.200.1.99

NO.71 Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

Social networking web filter category is configured with the action set to authenticate.

The action on firewall policy ID 1 is set to warning.

Access to the social networking web filter category was explicitly blocked to all users.

The name of the firewall policy is all_users_web.

NO.72 An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

Disabled

On Demand

Enabled

On Idle

NO.73 Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

Heartbeat interfaces have virtual IP addresses that are manually assigned.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Virtual IP addresses are used to distinguish between cluster members.

The primary device in the cluster is always assigned IP address 169.254.0.1.

NO.74 If theServicesfield is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

TheServicesfield prevents SNAT and DNAT from being combined in the same policy.

TheServicesfield is used when you need to bundle several VIPs into VIP groups.

TheServicesfield removes the requirement to create multiple VIPs for different services.

TheServicesfield prevents multiple sources of traffic from using multiple services to connect to a single computer.

NO.75 Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to

On both FortiGate devices, set

On HQ-FortiGate, disable Diffie-Helman group 2

On Remote-FortiGate, set port2

NO.76 Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

NO.77 Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

The debug flow is of ICMP traffic.

A firewall policy allowed the connection.

A new traffic session is created.

The default route is required to receive a reply.

NO.78 Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

The debug flow is of ICMP traffic.

A firewall policy allowed the connection.

A new traffic session is created.

The default route is required to receive a reply.

NO.79 An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Enable asymmetric routing, so the RPF check will be bypassed.

Disable the RPF check at the FortiGate interface level for the source check.

Disable the RPF check at the FortiGate interface level for the reply check.

Enable asymmetric routing at the interface level.

NO.80 Refer to the exhibit, which contains a static route configuration.

An administrator created a static route for Amazon Web Services.
What CLI command must the administrator use to view the route?

get router info routing-table all

get internet service route list

get router info routing-table database

diagnose firewall proute list

NO.81 Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address
10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

10.200.1.10

Any available IP address in the WAN (port1) subnet 10.200.1.0/24

10.200.1.1

10.0.1.254

NO.82 Examine the two static routes shown in the exhibit, then answer the following question.

Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

FortiGate will load balance all traffic across both routes.

FortiGate will use the port1 route as the primary candidate.

FortiGate will route twice as much traffic to the port2 route

FortiGate will only actuate the port1 route in the routing table

NO.83 Which two statements are true about collector agent advanced mode? (Choose two.)

Advanced mode uses Windows convention-NetBios: DomainUsername.

FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate

Advanced mode supports nested or inherited groups

Security profiles can be applied only to user groups, not individual users.

NO.84 If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy?

User or User Group

IP address

No other object can be added

FQDN address

NO.85 Consider the topology:
Application on a Windows machine <–{SSL VPN} –>FGT–> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Set the maximum session TTL value for the TELNET service object.

Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Create a new service object for TELNET and set the maximum session TTL.

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.