Fortinet NSE4_FGT-6.4 問題集

質問 1：
An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?
A. This VPN cannot be used as part of a hub-and-spoke topology.
B. A phase 2 configuration is not required.
C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
D. The IPsec firewall policies must be placed at the top of the list.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
A. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"
B. Capture the traffic using an external sniffer connected to port1.
C. Run a sniffer on the web server.
D. Execute a debug flow.
正解：D

質問 3：
Which scanning technique on FortiGate can be enabled only on the CLI?
A. Heuristics scan
B. Antivirus scan
C. Trojan scan
D. Ransomware scan
正解：A

質問 4：
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
A. The collector agent uses a Windows API to query DCs for user logins.
B. The NetSession Enum function is used to track user logouts.
C. NetAPI polling can increase bandwidth usage in large networks.
D. The collector agent must search security event logs.
正解：B

質問 5：
An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
A. Add user accounts to the FortiGate group fitter.
B. Add user accounts to Active Directory (AD).
C. Add the support of NTLM authentication.
D. Add user accounts to the Ignore User List.
正解：D

質問 6：
Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
A. Set the maximum session TTL value for the TELNET service object.
B. Create a new service object for TELNET and set the maximum session TTL.
C. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.
D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.
正解：B,D