20 January, 2021

Down To Date NSE4_FGT-6.4 Exam Dumps For Fortinet NSE 4 - FortiOS 6.4 Certification

We provide real NSE4_FGT-6.4 exam questions and answers braindumps in two formats. Download PDF & Practice Tests. Pass Fortinet NSE4_FGT-6.4 Exam quickly & easily. The NSE4_FGT-6.4 PDF type is available for reading and printing. You can print more and practice many times. With the help of our Fortinet NSE4_FGT-6.4 dumps pdf and vce product and material, you can easily pass the NSE4_FGT-6.4 exam.

Check NSE4_FGT-6.4 free dumps before getting the full version:

Page: 1 / 7

Total 94 questions Full Exam Access

Question 1

Examine this PAC file configuration.
NSE4_FGT-6.4 dumps exhibit

Which of the following statements are true? (Choose two.)

Browsers can be configured to retrieve this PAC file from the FortiGate.

Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.

All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.

Any web request fortinet.com is allowed to bypass the proxy.

Question 2

Refer to the exhibit.
NSE4_FGT-6.4 dumps exhibit

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack.

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

Question 3

Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

The public key of the web servercertificate must be installed on the browser.

The web-server certificate must be installed on the browser.

The CA certificate that signed the web-server certificate must be installed on the browser.

The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Question 4

An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

Configure Source IP Pools.

Configure split tunneling in tunnel mode.

Configure different SSL VPN realms.

Configure host check.

Question 5

Refer to the exhibit.
NSE4_FGT-6.4 dumps exhibit

The exhibits show a network diagram and the explicit web proxy configuration.
In the commanddiagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

‘host 192.168.0.2 and port 8080’

‘host 10.0.0.50 and port 80’

‘host 192.168.0.1 and port 80’

‘host 10.0.0.50 and port 8080’

Question 6

Refer to the exhibits.
NSE4_FGT-6.4 dumps exhibit

The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?

Change the SSL VPN port on the client.

Change the Server IP address.

Change the idle-timeout.

Change the SSL VPN portal to the tunnel.

Question 7

How do you format the FortiGate flash disk?

Load a debug FortiOS image.

Load the hardware test (HQIP) image.

Execute the CLI command execute formatlogdisk.

Select the format boot device option from the BIOS menu.

Question 8

Refer to the exhibit showing a debug flow output.
NSE4_FGT-6.4 dumps exhibit

Which two statements about the debug flow output are correct? (Choose two.)

The debug flow is of ICMP traffic.

A firewall policy allowed the connection.

A new traffic session is created.

The default route is required to receive a reply.

Question 9

What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Traffic to botnetservers

Traffic to inappropriate web sites

Server information disclosure attacks

Credit card data leaks

SQL injection attacks

Question 10

View the exhibit.
NSE4_FGT-6.4 dumps exhibit

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

Addicting.Games is allowed based on the Application Overrides configuration.

Addicting.Games is blocked on the Filter Overrides configuration.

Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

Addcting.Games is allowed based on the Categories configuration.

Question 11

To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

FortiManager

Root FortiGate

FortiAnalyzer

Downstream FortiGate

Question 12

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interfac

Outgoing Interfac

Schedule, and Service fields can be shared with both IPv4and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

Question 13

Refer to the exhibit.
NSE4_FGT-6.4 dumps exhibit

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

A user

A root CA

A bridge CA

A subordinate

Question 14

If theServicesfield is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

TheServicesfield prevents SNAT and DNAT from being combined in the same policy.

TheServicesfield is used when you need to bundle several VIPs into VIP groups.

TheServicesfield removes the requirement to create multiple VIPs for different services.

TheServicesfield prevents multiple sources of traffic from using multiple services to connect to a singlecomputer.

Question 15

Which of the following statements about central NAT are true? (Choose two.)

IP tool references must be removed from existing firewall policies before enabling central NAT.

Central NAT can be enabled or disabled from the CLI only.

Source NAT, using central NAT, requires at least one central SNAT policy.

Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

Question 16

Refer to the exhibit.
NSE4_FGT-6.4 dumps exhibit

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

Custom permission for Network

Read/Write permission for Log & Report

CLI diagnostics commands permission

Read/Write permission for Firewall

Question 17

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
*All traffic must be routed through the primary tunnel when both tunnels are up
*The secondary tunnel must be used only if the primary tunnel goes down
*In addition, FortiGate should be able to detect a dead tunnel to speed up tunnelfailover
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Enable Dead Peer Detection.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

Configure a higher distance on the static route for the primary tunnel, and a lower distance on the state route for the secondary tunnel.

Question 18

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Question 19

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep "hook=pre"&"hook=out"

Question 20

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

The keyUsage extension must be set to keyCertSign.

The common name on the subject field must use a wildcard name.

The issuer must be a public CA.

The CA extension must be set to TRUE.

Question 21

By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers. Which two CLI commands will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering? (Choose two.)

set fortiguard anycast disable

set protocol udp

set webfilter-force-off disable

set webfilter-cache disable

Page: 1 / 7

Total 94 questions Full Exam Access