Fortinet NSE4_FGT-6.0 問題集

質問 1：
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
A. It limits the scope of application control to the browser-based technology category only.
B. It limits the scope of application control to scan application traffic on DNS protocol only.
C. It limits the scope of application control to scan application traffic using parent signatures only
D. It limits the scope of application control to scan application traffic based on application category only.
正解：D

質問 2：
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)
A. Source IP is translated to the outgoing interface IP.
B. This is known as many-to-one NAT.
C. Connections are tracked using source port and source MAC address.
D. Port address translation is not used.
正解：A,B

質問 3：
Which of the following statements about central NAT are true? (Choose two.)
A. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
B. Central NAT can be enabled or disabled from the CLI only.
C. IP tool references must be removed from existing firewall policies before enabling central NAT.
D. Source NAT, using central NAT, requires at least one central SNAT policy.
正解：B,C

質問 4：
An administrator has configured two VLAN interfaces:

A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface.
However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?
A. Both interfaces must belong to the same forward domain.
B. Both interfaces must be in different VDOMs.
C. The role of the VLAN10 interface must be set to server.
D. Both interfaces must have the same VLAN ID.
正解：A

質問 5：
How can you block or allow to Twitter using a firewall policy?
A. Configure the Service field as Internet Service objects for Twitter.
B. Configure the Source field as Internet Service objects for Twitter.
C. Configure the Destination field as Internet Service objects for Twitter.
D. Configure the Action field as Learn and select Twitter.
正解：C

質問 6：
Examine the exhibit, which shows the partial output of an IKE real-time debug.

Which of the following statement about the output is true?
A. Extended authentication (XAuth) was successful.
B. The VPN is configured to use pre-shared key authentication.
C. Remote is the host name of the remote IPsec peer.
D. Phase 1 went down.
正解：B

質問 7：
An administrator has configured a dialup IPsec VPN with XAuth. Which statement best describes what occurs during this scenario?
A. Dialup clients must provide a username and password for authentication.
B. Phase 1 negotiations will skip preshared key exchange.
C. Dialup clients must provide their local ID during phase 2 negotiations.
D. Only digital certificates will be accepted as an authentication method in phase 1.C
正解：A

質問 8：
Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?
A. It authenticates the traffic using the authentication scheme SCHEME2.
B. It authenticates the traffic using the authentication scheme SCHEME1.
C. It always authorizes the traffic without requiring authentication.
D. It drops the traffic.
正解：B