Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Free Practice Test

Question 1

You have configured the FortiGate device for FSSO. A user is successful in log-in to Windows, but their access to the internet is denied. What should the administrator check first? (Choose one answer)

A. The FortiGate FSSO active users list for user ' s IP address.

B. The FortiGate firewall policy settings for SSL decryption.

C. Whether the user is assigned to the correct AD group.

D. The Windows event viewer for failed login attempts.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

The FortiGate device HQ-NGFW-1 with the IP address 10.0.13.254 sends logs to the FortiAnalyzer device with the IP address 10.0.13.125. The administrator wants to verify that reliable logging is enabled on HQ- NGFW-1.
Which exhibit helps with the verification?

A.

B.

C.

D.

Correct Answer: D

Question 3

Refer to the exhibit.

Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?

A. Antivirus scan is disabled under System - > Feature visibility

B. FortiGate. with less than 2 GB RAM. does not support the Antivirus scan feature.

C. None of the inspected protocols are active in this profile.

D. The Feature Set for the profile is Flow-based but it must be Proxy-based

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit.

What can you conclude from the log shown in the exhibit?

A. The IPS session scan is paused and reevaluating the packet because of a dirty flag.

B. The IPS socket buffer is full and IPS engine cannot decode a packet.

C. The IPS scan is paused by the IPS diagnostic command with bypass mode option 5.

D. The IPS socket buffer is full and IPS engine needs more memory to create new sessions.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Refer to the exhibits.

The exhibits show the application sensor configuration and the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming? (Choose one answer)

A. Apple FaceTime will be allowed, based on the Apple filter configuration.

B. Apple FaceTime will be allowed, based on the Video/Audio category configuration.

C. Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

D. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

What are two characteristics of HA cluster heartbeat IP addresses in a FortiGate device? (Choose two.)

A. Heartbeat IP addresses are used to distinguish between cluster members.

B. Heartbeat interfaces have virtual IP addresses that are manually assigned.

C. The heartbeat interface of the primary device in the cluster is always assigned IP address 169.254.0.1.

D. A change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster.

Correct Answer: A,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Which two statements are correct when the FortiGate device enters conserve mode? (Choose two.)

A. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

B. FortiGate halts complete system operation and requires a reboot to regain available resources.

C. FortiGate refuses to accept configuration changes.

D. FortiGate continues to run critical security actions, such as quarantine.

Correct Answer: A,C

Question 8

Which three statements explain a flow-based antivirus profile? (Choose three answers)

A. If a virus is detected, the last packet is delivered to the client.

B. The IPS engine handles the process as a standalone.

C. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

D. Flow-based inspection optimizes performance compared to proxy-based inspection.

E. FortiGate buffers the whole file but transmits to the client at the same time.

Correct Answer: C,D,E

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode. Which step is not part of the expected process?

A. The user logs into the windows domain.

B. The DC agent sends login event data directly to FortiGate.

C. The collector agent forwards login event data to FortiGate.

D. FortiGate determines user identity based on the IP address in the FSSO list.

Correct Answer: B

Question 10

Which three methods are used by the collector agent for AD polling? (Choose three answers)

A. WinSecLog

B. DNS reverse lookup

C. WMI

D. NetAPI

E. FSSO REST API

Correct Answer: A,C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Free Practice Test