Fortinet NSE4_FGT-6.2 問題集

質問 1：
Examine the exhibit, which contains a session diagnostic output.

Which of the following statements about the session diagnostic output is true?
A. The session is in TIME_WAIT state.
B. The session is in ESTABLISHED state.
C. The session is in LISTEN state.
D. The session is in CLOSE_WAIT state.
正解：B

質問 2：
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
A. By default, the SSL VPN portal requires the installation of a client's certificate.
B. By default, the admin GUI and SSL VPN portal use the same HTTPS port.
C. By default, FortiGate uses WINS servers to resolve names.
D. By default, split tunneling is enabled.
正解：B

質問 3：
Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.


An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?
A. The firewall policy is not using a full SSL inspection profile.
B. The IPS filter is missing the Protocol: HTTPS option.
C. A DoS policy should be used, instead of an IPS sensor.
D. A DoS policy should be used, instead of an IPS sensor.
E. The HTTPS signatures have not been added to the sensor.
正解：A

質問 4：
Examine the network diagram and the existing FGTI routing table shown in the exhibit, and then answer the following question:

An administrator has added the following static route on FGTI.

Since the change, the new static route is not showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?
A. The new route's destination subnet overlaps an existing route.
B. The Priority is 0, which means that this route will remain inactive.
C. The new route's Distance value should be higher than 10.
D. The Gateway IP address is not in the same subnet as port1.
正解：D

質問 5：
When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?
A. The remote user's virtual IP address.
B. The internal IP address of the FortiGate device.
C. remote user's public IP address
D. The public IP address of the FortiGate device.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
When using SD-WAN, how do you configure the next-hop gateway address for a member interface so that FortiGate can forward Internet traffic?
A. It must be configured in a static route using the sdwan virtual interface.
B. It must be configured in a policy-route using the sdwan virtual interface.
C. It must be learned automatically through a dynamic routing protocol.
D. It must be provided in the SD-WAN member interface configuration.
正解：D

質問 7：
View the exhibit.

Which of the following statements are correct? (Choose two.)
A. This is a redundant IPsec setup.
B. This setup requires at least two firewall policies with the action set to IPsec.
C. Dead peer detection must be disabled to support this type of IPsec setup.
D. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
正解：A,D