Fortinet NSE 4 - FortiOS 7.6 Administrator - NSE4_FGT

QUESTION NO: 1
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three answers)

A. Manual with load balancing B. Lowest Cost (SLA) without load balancing C. Best Quality with load balancing D. Lowest Cost (SLA) with load balancing E. Lowest Quality (SLA) with load balancing

Correct Answer: A,B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Which two statements about the Security Fabric rating are true? (Choose two answers)

A. The Security Posture category provides PCI compliance results. B. The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric. C. A license is required to obtain an executive summary in the Security Rating section. D. Security Rating Insights are available only in the Security Rating page.

Correct Answer: A,B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

A. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0. B. On HQ-NGFW. enable Diffie-Hellman Group 2. C. On HQ-NGFW. set Encryption to AES256. D. On BR1-FGT. set Seconds to 43200

Correct Answer: A,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
You have configured an application control profile, set peer-o-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, you peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?

A. Application and Filter Overrides B. FortiGuard category ratings C. Replacement Messages for UDP-based Applications D. Network Protocol Enforcement

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
How does FortiExtender connect to FortiSASE in a site-based, remote internet access method?

A. FortiExtender uses the proxy auto-configuration < PAC) file and an explicit web proxy to connect. B. FortiExtender establishes a secure SSL connection using FortiClient. C. FortiExtender uses a Virtual Extensible LAN (VXLAN)-over-IPsec connection. D. FortiExtender first connects to a FortiGate LAN extension through a secure web gateway (SWG).

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
The FortiGate device HQ-NGFW-1 with the IP address 10.0.13.254 sends logs to the FortiAnalyzer device with the IP address 10.0.13.125. The administrator wants to verify that reliable logging is enabled on HQ- NGFW-1.
Which exhibit helps with the verification?

A.

B.

C.

D.

Correct Answer: B

QUESTION NO: 7
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true? (Choose two answers)

A. If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance-mode. B. If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based. C. If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP. D. If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Refer to the exhibits.

You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)

A. Add " Google " .com to the URL category in the security profile. B. Move up Google in the Application and Filter Overrides section to set its priority lot C. Set the action for Google in the Application and Filter Overrides section to Allow D. Change the Inspection mode to Flow-based E. Set SSL inspection to deep-content inspection.

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

A. On Demand B. Usabled C. Enabled D. On Idle

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
Refer to the exhibit.

An SD-WAN zone configuration on the FortiGate GUI is shown. Based on the exhibit, which statement is true?

A. The virtual-wan-link and overlay zones can be deleted B. port2 and port3 are not assigned to a zone. C. The Underlay zone is the zone by default. D. The Underlay zone contains no member.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet NSE 4 - FortiOS 7.6 Administrator - NSE4_FGT_AD-7.6 Exam Questions