Pinpoint NSE4_FGT-6.0 Preparation 2021

NEW QUESTION 1
If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

• A. The Services field removes the requirement of creating multiple VIPs for different services.
• B. The Services field is used when several VIPs need to be bundled into VIP groups.
• C. The Services field does not allow source NAT and destination NAT to be combined in the same policy.
• D. The Services field does not allow multiple sources of traffic, to use multiple services, to connect to a single computer.

Answer: A

NEW QUESTION 2
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

• A. This is known as many-to-one NAT.
• B. Source IP is translated to the outgoing interface IP.
• C. Connections are tracked using source port and source MAC address.
• D. Port address translation is not used.

Answer: BD

NEW QUESTION 3
Which is a requirement for creating an inter-VDOM link between two VDOMs?

• A. The inspection mode of at least one VDOM must be proxy-based.
• B. At least one of the VDOMs must operate in NAT mode.
• C. The inspection mode of both VDOMs must match.
• D. Both VDOMs must operate in NAT mode.

Answer: A

NEW QUESTION 4
An administrator wants to block HTTP uploads. Examine the exhibit, which contains the proxy address created for that purpose.

Where must the proxy address be used?

• A. As the source in a firewall policy.
• B. As the source in a proxy policy.
• C. As the destination in a firewall policy.
• D. As the destination in a proxy policy.

Answer: B

NEW QUESTION 5
Which of the following statements describe WMI polling mode for the FSSO collector agent? (Choose two.)

• A. The NetSessionEnum function is used to track user logoffs.
• B. WMI polling can increase bandwidth usage in large networks.
• C. The collector agent uses a Windows API to query DCs for user logins.
• D. The collector agent do not need to search any security event logs.

Answer: BC

NEW QUESTION 6
An administrator is running the following sniffer command:
diagnose sniffer packet any “host 10.0.2.10” 3
What information will be included in the sniffer output? (Choose three.)

• A. IP header
• B. Ethernet header
• C. Packet payload
• D. Application header
• E. Interface name

Answer: ABC

NEW QUESTION 7
How does FortiGate select the central SNAT policy that is applied to a TCP session?

• A. It selects the SNAT policy specified in the configuration of the outgoing interface.
• B. It selects the first matching central SNAT policy, reviewing from top to bottom.
• C. It selects the central SNAT policy with the lowest priority.
• D. It selects the SNAT policy specified in the configuration of the firewall policy that matches the traffic.

Answer: B

NEW QUESTION 8
View the exhibit:

Which statement about the exhibit is true? (Choose two.)

• A. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
• B. port-VLAN1 is the native VLAN for the port1 physical interface.
• C. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
• D. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Answer: CD

NEW QUESTION 9
Which statements about DNS filter profiles are true? (Choose two.)

• A. They can inspect HTTP traffic.
• B. They can redirect blocked requests to a specific portal.
• C. They can block DNS requests to known botnet command and control servers.
• D. They must be applied in firewall policies with SSL inspection enabled.

Answer: CD

NEW QUESTION 10
Which of the following FortiGate configuration tasks will create a route in the policy route table? (Choose two.)

• A. Static route created with a Named Address object
• B. Static route created with an Internet Services object
• C. SD-WAN route created for individual member interfaces
• D. SD-WAN rule created to route traffic based on link latency

Answer: AD

NEW QUESTION 11
An administrator has configured central DNAT and virtual IPs. Which of the following can be selected in the firewall policy Destination field?

• A. A VIP group
• B. The mapped IP address object of the VIP object
• C. A VIP object
• D. An IP pool

Answer: C

NEW QUESTION 12
An administrator needs to strengthen the security for SSL VPN access. Which of the following statements are best practices to do so? (Choose three.)

• A. Configure split tunneling for content inspection.
• B. Configure host restrictions by IP or MAC address.
• C. Configure two-factor authentication using security certificates.
• D. Configure SSL offloading to a content processor (FortiASIC).
• E. Configure a client integrity check (host-check).

Answer: CDE

NEW QUESTION 13
Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

• A. Lookup is done on the trust packet from the session originator
• B. Lookup is done on the last packet sent from the re spender
• C. Lookup is done on every packet, regardless of direction
• D. Lookup is done on the trust reply packet from the re spender

Answer: AB

NEW QUESTION 14
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

• A. To remove the NAT operation.
• B. To generate logs
• C. To finish any inspection operations.
• D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Answer: D

NEW QUESTION 15
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

• A. By default, FortiGate uses WINS servers to resolve names.
• B. By default, the SSL VPN portal requires the installation of a client’s certificate.
• C. By default, split tunneling is enabled.
• D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.

Answer: A

NEW QUESTION 16
During the digital verification process, comparing the original and fresh hash results satisfies which security requirement?

• A. Authentication.
• B. Data integrity.
• C. Non-repudiation.
• D. Signature verification.

Answer: D

NEW QUESTION 17
Why must you use aggressive mode when a local FortiGate IPSec gateway hosts multiple dialup tunnels?

• A. In aggressive mode, the remote peers are able to provide their peer IDs in the first message.
• B. FortiGate is able to handle NATed connections only in aggressive mode.
• C. FortiClient only supports aggressive mode.
• D. Main mode does not support XAuth for user authentication.

Answer: A

NEW QUESTION 18
When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

• A. remote user’s public IP address
• B. The public IP address of the FortiGate device.
• C. The remote user’s virtual IP address.
• D. The internal IP address of the FotiGate device.

Answer: D

NEW QUESTION 19
NGFW mode allows policy-based configuration for most inspection rules. Which security profile’s configuration does not change when you enable policy-based inspection?

• A. Web filtering
• B. Antivirus
• C. Web proxy
• D. Application control

Answer: C

NEW QUESTION 20
Which is the correct description of a hash result as it relates to digital certificates?

• A. A unique value used to verify the input data
• B. An output value that is used to identify the person or deuce that authored the input data.
• C. An obfuscation used to mask the input data.
• D. An encrypted output value used to safe-guard die input data

Answer: A

NEW QUESTION 21
Which of the following conditions are required for establishing an IPSec VPN between two FortiGate devices? (Choose two.)

• A. If XAuth is enabled as a server in one peer, it must be enabled as a client in the other peer.
• B. If the VPN is configured as route-based, there must be at least one firewall policy with the action set toIPSec.
• C. If the VPN is configured as DialUp User in one peer, it must be configured as either Static IP Addressor Dynamic DNS in the other peer.
• D. If the VPN is configured as a policy-based in one peer, it must also be configured as policy-based in the other peer.

Answer: BC

NEW QUESTION 22
Examine the exhibit, which shows the partial output of an IKE real-time debug.

Which of the following statement about the output is true?

• A. The VPN is configured to use pre-shared key authentication.
• B. Extended authentication (XAuth) was successful.
• C. Remote is the host name of the remote IPsec peer.
• D. Phase 1 went down.

Answer: A

NEW QUESTION 23
Which of the following static routes are not maintained in the routing table? (Choose two.)

• A. Named Address routes
• B. Dynamic routes
• C. ISDB routes
• D. Policy routes

Answer: BD

NEW QUESTION 24
Which statement is true regarding SSL VPN timers? (Choose two.)

• A. Allow to mitigate DoS attacks from partial HTTP requests.
• B. SSL VPN settings do not have customizable timers.
• C. Disconnect idle SSL VPN users when a firewall policy authentication timeout occurs.
• D. Prevent SSL VPN users from being logged out because of high network latency.

Answer: AD

NEW QUESTION 25
Examine this output from a debug flow:

Why did the FortiGate drop the packet?

• A. The next-hop IP address is unreachable.
• B. It failed the RPF check.
• C. It matched an explicitly configured firewall policy with the action DENY.
• D. It matched the default implicit firewall policy.

Answer: D

NEW QUESTION 26
......