NSE4_FGT-6.4 Free Practice Test

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

1. A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
2. B. ADVPN is only supported with IKEv2.
3. C. Tunnels are negotiated dynamically between spokes.
4. D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Correct Answer: AC

Which statement regarding the firewall policy authentication timeout is true?

1. A. It is an idle timeou
2. B. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source IP.
3. C. It is a hard timeou
4. D. The FortiGate removes the temporary policy for a user’s source IP address after this timer has expired.
5. E. It is an idle timeou
6. F. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source MAC.
7. G. It is a hard timeou
8. H. The FortiGate removes the temporary policy for a user’s source MAC address after this timer has expired.

Correct Answer: A

Refer to the exhibits.


Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

1. A. Administrators can access FortiGate only through the console port.
2. B. FortiGate has entered conserve mode.
3. C. FortiGate will start sending all files to FortiSandbox for inspection.
4. D. Administrators cannot change the configuration.

Correct Answer: CD

Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

1. A. This security fabric topology is a logical topology view.
2. B. There are 19 security recommendations for the security fabric.
3. C. There are five devices that are part of the security fabric.
4. D. Device detection is disabled on all FortiGate devices.

Correct Answer: AD

If theServicesfield is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

1. A. TheServicesfield prevents SNAT and DNAT from being combined in the same policy.
2. B. TheServicesfield is used when you need to bundle several VIPs into VIP groups.
3. C. TheServicesfield removes the requirement to create multiple VIPs for different services.
4. D. TheServicesfield prevents multiple sources of traffic from using multiple services to connect to a singlecomputer.

Correct Answer: C