NSE4

Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.)

Which two statements are true about IPsec VPNs and SSL VPNs? (Choose two.)

A user logs into a SSL VPN portal and activates the tunnel mode. The administrator has enabled split tunneling. The exhibit shows the firewall policy configuration: Which static route is automatically added to the client’s routing table when the tunnel mode is activated?

When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

Regarding the use of web-only mode SSL VPN, which statement is correct?

An administrator wants to create an IPsec VPN tunnel between two FortiGate devices. Which three configuration steps must be performed on both units to support this scenario? (Choose three.)

You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route-based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route. Which two configuration steps are required to achieve these objectives? (Choose two.)

An administrator has configured a route-based site-to-site IPsec VPN. Which statement is correct regarding this IPsec VPN configuration?

What is IPsec Perfect Forwarding Secrecy (PFS)?.

Which IPsec configuration mode can be used for implementing GRE-over-IPsec VPNs?.

Which antivirus and attack definition update options are supported by FortiGate units? (Choose two.)

Which antivirus inspection mode must be used to scan SMTP, FTP, POP3 and SMB protocols?

Which statements regarding banned words are correct? (Choose two.)

Examine the exhibit; then answer the question below. Which statement describes the green status indicators that appear next to the different FortiGuard Distribution Network services as illustrated in the exhibit?

A FortiGate is configured to receive push updates from the FortiGuard Distribution Network, however, updates are not being received. Which are two reasons for this problem? (Choose two.)

Which statement is correct regarding virus scanning on a FortiGate unit?

Which statements are true regarding the use of a PAC file to configure the web proxy settings in an Internet browser? (Choose two.)

Examine the following FortiGate web proxy configuration; then answer the question below: config web-proxy explicit set pac-file-server-status enable set pac-file-server-port 8080 set pac-file-name wpad.dat end Assuming that the FortiGate proxy IP address is 10.10.1.1, which URL must an Internet browser use to download the PAC file?

Which two methods are supported by the web proxy auto-discovery protocol (WPAD) to automatically learn the URL where a PAC file is located? (Choose two.)

What is a valid reason for using session based authentication instead of IP based authentication in a FortiGate web proxy solution?

Which statements are correct regarding URL filtering on a FortiGate unit? (Choose two.)

Which of the following regular expression patterns make the terms "confidential data" case insensitive?

Which two web filtering inspection modes inspect the full URL? (Choose two.)

Which web filtering inspection mode inspects DNS traffic?

How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent?

Which statements are correct regarding application control? (Choose two.)

Which statements are true regarding traffic shaping that is applied in an application sensor, and associated with a firewall policy? (Choose two.)

In this scenario, the FortiGate unit in Ottawa has the following routing table: S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C 172.20.167.0/24 is directly connected, port1 C 172.20.170.0/24 is directly connected, port2 Sniffer tests show that packets sent from the source IP address 172.20.168.2 to the destination IP address 172.20.169.2 are being dropped by the FortiGate located in Ottawa. Which of the following correctly describes the cause for the dropped packets?

Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it. config router static edit 1 set dst 172.20.168.0 255.255.255.0 set distance 20 set priority 10 set device port1 next edit 2 set dst 172.20.168.0 255.255.255.0 set distance 20 set priority 20 set device port2 next end Which of the following statements correctly describes the static routing configuration provided above?

The Vancouver FortiGate initially had the following information in its routing table: S 172.20.0.0/16 [10/0] via 172.21.1.2, port2 C 172.21.0.0/16 is directly connected, port2 C 172.11.11.0/24 is directly connected, port1 Afterwards, the following static route was added: config router static edit 6 set dst 172.20.1.0 255.255.255.0 set pririoty 0 set device port1 set gateway 172.11.12.1 next end Since this change, the new static route is NOT showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set distance 10 set weight 5 next edit 2 set dst 172.20.1.0 255.255.255.0 set blackhole enable set distance 5 set weight 10 next end Which of the following statements correctly describes the static routing configuration provided? (Choose two.)

In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate operating in NAT/Route mode, when searching for a suitable gateway?

A static route is configured for a FortiGate unit from the CLI using the following commands: config router static edit 1 set device "wan1" set distance 20 set gateway 192.168.100.1 next end Which of the following conditions are required for this static default route to be displayed in the FortiGate unit’s routing table? (Choose two.)

Review the output of the command get router info routing-table database shown in the exhibit below; then answer the question following it. Which two statements are correct regarding this output? (Choose two.)

When does a FortiGate load-share traffic between two static routes to the same destination subnet?

A FortiGate is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root. Which of the following settings will this administrator be able to configure? (Choose two.)

Which statements are correct regarding virtual domains (VDOMs)? (Choose two.)

A FortiGate unit is configured with three Virtual Domains (VDOMs) as illustrated in the exhibit. Which of the following statements are true if the network administrator wants to route traffic between all the VDOMs? (Choose three.)

A FortiGate is configured with three virtual domains (VDOMs). Which of the following statements is correct regarding multiple VDOMs?

A FortiGate administrator with the super_admin profile configures a virtual domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in the GUI in the management VDOM. What would be a possible cause for this problem?

A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface. Which one of the following statements is correct regarding the VLAN IDs in this scenario?

Which statements correctly describe transparent mode operation? (Choose three.)

In transparent mode, forward-domain is an CLI setting associate with ______________.

Which statements are correct for port pairing and forwarding domains? (Choose two.)

Examine the following spanning tree configuration on a FortiGate in transparent mode: config system interface edit <interface name> set stp-forward enable end Which statement is correct for the above configuration?

An administrator has formed a high availability cluster involving two FortiGate units. [ Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer 2 switches ] The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster. Which of the following options describes the best step the administrator can take? The administrator should _____________________.

Which of the following sequences describes the correct order of criteria used for the selection of a master unit within a FortiGate high availability (HA) cluster when override is disabled?

In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit?

Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of diagnose sys session stat for the STUDENT device. Exhibit B shows the command output of diagnose sys session stat for the REMOTE device. Given the information provided in the exhibits, which of the following statements are correct? (Choose two.)

Which of the following statements are correct about the HA command diagnose sys ha reset-uptime? (Choose two.)

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the exhibit below. Which statements are correct regarding this setting? (Choose two.)

The exhibit shows the Disconnect Cluster Member command in a FortiGate unit that is part of a HA cluster with two HA members. What is the effect of the Disconnect Cluster Member command as given in the exhibit. (Choose two.)

Two FortiGate devices fail to form an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of show system ha for the STUDENT device. Exhibit B shows the command output of show system ha for the REMOTE device. Which one of the following is the most likely reason that the cluster fails to form?

What are the requirements for a HA cluster to maintain TCP connections after device or link failover? (Choose two.)

Which IPsec mode includes the peer id information in the first packet?

Which statement is an advantage of using a hub and spoke IPsec VPN configuration instead of a fullymeshed set of IPsec tunnels?

Which statements are correct properties of a partial mesh VPN deployment. (Choose two

Review the IPsec phase 1 configuration in the exhibit; then answer the question below. Which statements are correct regarding this configuration? (Choose two.)

Review the IPsec phase 2 configuration shown in the exhibit; then answer the question below. Which statements are correct regarding this configuration? (Choose two.).

Review the static route configuration for IPsec shown in the exhibit; then answer the question below. Which statements are correct regarding this configuration? (Choose two.)

Review the IKE debug output for IPsec shown in the exhibit below. Which statements is correct regarding this output?

Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit. Which statements is correct regarding this output? (Select one answer).

Review the configuration for FortiClient IPsec shown in the exhibit. Which statement is correct regarding this configuration?

Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit below. Which statements are correct regarding this output? (Choose two.)

Examine the following log message for IPS: 2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly pri=alert vd=root severity="critical" src="192.168.3.168" dst="192.168.3.170" src_int="port2" serial=0 status="detected" proto=1 service="icmp" count=1 attack_name="icmp_flood" icmp_id="0xa8a4" icmp_type="0x08" icmp_code="0x00" attack_id=16777316 sensor="1" ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold 50" Which statement is correct about the above log? (Choose two.)

Which statement correctly describes the output of the command diagnose ips anomaly list?

Review the IPS sensor filter configuration shown in the exhibit Based on the information in the exhibit, which statements are correct regarding the filter? (Choose two.)

With FSSO, a domain user could authenticate either against the domain controller running the collector agent and domain controller agent, or a domain controller running only the domain controller agent. If you attempt to authenticate with a domain controller running only the domain controller agent, which statements are correct? (Choose two.)

Which statement describes what the CLI command diagnose debug authd fsso list is used for?

FSSO provides a single sign on solution to authenticate users transparently to a FortiGate unit using credentials stored in Windows active directory. Which of the following statements are correct regarding FSSO in a Windows domain environment when agent mode is used? (Choose two.)

Which are two requirements for DC-agent mode FSSO to work properly in a Windows AD environment? [Choose two.]

Which statement is one disadvantage of using FSSO NetAPI polling mode over FSSO Security Event Log (WinSecLog) polling mode?

Bob wants to send Alice a file that is encrypted using public key cryptography. Which of the following statements is correct regarding the use of public key cryptography in this scenario?

Which tasks fall under the responsibility of the SSL proxy in a typical HTTPS connection? (Choose two.)

When the SSL proxy is NOT doing man-in-the-middle interception of SSL traffic, which certificate field can be used to determine the rating of a website?

Data leak prevention archiving gives the ability to store files and message data onto a FortiAnalyzer unit for which of the following types of network traffic? (Choose three.)

For data leak prevention, which statement describes the difference between the block and quarantine actions?

In which process states is it impossible to interrupt/kill a process? (Choose two.)

Examine at the output below from the diagnose sys top command: # diagnose sys top 1 Run Time: 11 days, 3 hours and 29 minutes 0U, 0N, 1S, 99I; 971T, 528F, 160KF sshd 123 S 1.9 1.2 ipsengine 61 S < 0.0 5.2 miglogd 45 S 0.0 4.9 pyfcgid 75 S 0.0 4.5 pyfcgid 73 S 0.0 3.9 Which statements are true regarding the output above? (Choose two.)

Examine the following output from the diagnose sys session list command: session info: proto=6 proto_state=65 duration=3 expire=9 timeout=3600 flags=00000000 sockflag=00000000 sockport=443 av_idx=9 use=5 origin-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic 13895Bps reply-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic 13895Bps state=redir local may_dirty ndr npu nlb os rs statistic(bytes/packets/allow_err): org=864/8/1 reply=2384/7/1 tuples=3 orgin->sink: org pre->post, reply pre->post dev=7->6/6->7 gwy=172.17.87.3/10.1.10.1 hook=post dir=org act=snat 192.168.1.110:57999->74.201.86.29:443(172.17.87.16:57999) hook=pre dir=reply act=dnat 74.201.86.29:443->172.17.87.16:57999(192.168.1.110:57999) hook=post dir=reply act=noop 74.201.86.29:443->192.168.1.110:57999(0.0.0.0:0) misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=0 npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0/0 Which statements are true regarding the session above? (Choose two.)

Which statements are true regarding IPv6 anycast addresses? (Choose two.)

What functions can the IPv6 Neighbor Discovery protocol accomplish? (Choose two.)

Which statements are correct regarding an IPv6 over IPv4 IPsec configuration? (Choose two.)

Which is one of the conditions that must be met for offloading the encryption and decryption of IPsec traffic to an NP6 processor?

Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing security profile (UTM) inspection over all the user traffic. What statements are true regarding the sessions that the master unit is offloading to the slave unit for inspection? (Choose two.)

Which statements are true about offloading antivirus inspection to a Security Processor (SP)? (Choose two.)

Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.)

Which network protocols are supported for administrative access to a FortiGate unit? (Choose three.)

What capabilities can a FortiGate provide? (Choose three.)

What methods can be used to access the FortiGate CLI? (Choose two.)

When creating FortiGate administrative users, which configuration objects specify the account rights?

How is the FortiGate password recovery process?

Which statements are true regarding the factory default configuration? (Choose three.)

What are valid options for handling DNS requests sent directly to a FortiGates interface IP? (Choose three.)

What logging options are supported on a FortiGate unit? (Choose two.)

Regarding the header and body sections in raw log messages, which statement is correct?

Which is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying a FortiGate unit?

What is the maximum number of FortiAnalyzer/FortiManager devices a FortiGate unit can be configured to send logs to?

For traffic that does match any configured firewall policy, what is the default action taken by the FortiGate?

In which order are firewall policies processed on a FortiGate unit?

Which firewall objects can be included in the Destination Address field of a firewall policy? (Choose three.)

The order of the firewall policies is important. Policies can be re-ordered from either the GUI or the CLI. Which CLI command is used to perform this function?

Which header field can be used in a firewall policy for traffic matching?

Examine the following CLI configuration: config system session-ttl set default 1800 end What statement is true about the effect of the above configuration line?

Which statement regarding the firewall policy authentication timeout is true?

What methods can be used to deliver the token code to a user that is configured to use two-factor authentication? (Choose three.)

Which statements are true regarding local user authentication? (Choose two.)

Which two statements are true regarding firewall policy disclaimers? (Choose two.)

When firewall policy authentication is enabled, which protocols can trigger an authentication challenge? (Choose two.)

The FortiGate port1 is connected to the Internet. The FortiGate port2 is connected to the internal network. Examine the firewall configuration shown in the exhibit; then answer the question below.