NSE4_FGT-6.4 Free Practice Test

Refer to theexhibits.


The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they areunableto leavereactions on videos or other types ofposts.
Which part ofthe policy configuration must you change to resolve the issue?

1. A. The SSL inspection needs tobe a deep content inspection.
2. B. Force access to Facebook using the HTTP service.
3. C. Additional application signatures arerequired to add to thesecurity policy.
4. D. Add Facebook in the URL category in the security policy.

Correct Answer: A

Which two statements ate true about the Security Fabric rating? (Choose two.)

1. A. It provides executive summaries of the four largest areas of security focus.
2. B. Many of the security issues can befixed immediately by click ng Apply where available.
3. C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
4. D. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

Correct Answer: AC

Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

1. A. It is allowed, but with no inspection
2. B. It is allowed and inspected as long as the inspection is flow based
3. C. It is dropped.
4. D. It is allowed and inspected, as long as the only inspection required is antivirus.

Correct Answer: C

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
*All traffic must be routed through the primary tunnel when both tunnels are up
*The secondary tunnel must be used only if the primary tunnel goes down
*In addition, FortiGate should be able to detect a dead tunnel to speed up tunnelfailover
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

1. A. Enable Dead Peer Detection.
2. B. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
3. C. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
4. D. Configure a higher distance on the static route for the primary tunnel, and a lower distance on the state route for the secondary tunnel.

Correct Answer: A

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

1. A. It limits the scope of application control to the browser-based technology category only.
2. B. It limits the scope of application control to scan application traffic based on application category only.
3. C. It limits the scope of application control to scan application traffic using parent signatures only
4. D. It limits the scope of application control to scan application traffic on DNS protocol only.

Correct Answer: B