Online Access Free NSE4_FGT-5.6 Exam Questions

Examine this FortiGate configuration:
config system global
set av-failopen pass
set fail-open disable
end
Examine the output of the following debug command:
# diagnose hardware sysinfo conserve
memory conserve mode: on
total RAM: 3040 MB
memory used: 2706 MB 89% of total RAM
memory used threshold extreme: 2887 MB 95% of total RAM
memory used threshold red: 2675 MB 88% of total RAM
memory used threshold green: 2492 MB 82% of total RAM
Based on the diagnostics outputs above, how is the FortiGate handling packets that require IPS inspection?
Response:

• A.They are allowed and inspected as long as no additional proxy-based inspection is required.
• B.They are allowed and inspected.
• C.They are allowed, but with no inspection.
• D.They are dropped.

An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?
Response:

• A.The IPsec firewall policies must be placed at the top of the list.
• B.This VPN cannot be used as part of a hub and spoke topology.
• C.A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
• D.A phase 2 configuration is not required.

Under which circumstance is the IPsec ESP traffic encapsulated over UDP?
Response:

• A.When NAT-T detects there is a device between both IPsec peers doing NAT over the IPsec traffic
• B.When the phase 1 is configured to use aggressive mode
• C.When the IPsec VPN is configured as dial-up
• D.When using IKE version 2 (IKEv2)

Examine the CLI configuration. What does this configuration do?
(Choose two.)
config system setting
set ses-denied-traffic enable
end
Response:

• A.It reduces the amount of logs generated by denied traffic.
• B.It reduces the amount of logs generated by denied traffic.
• C.It creates a session for traffic being denied.
• D.It sends an alert notification to the administrator upon detecting denied traffic.

Which of the following web filtering modes apply to full URL inspection?
(Choose two.)
Response:

• A.Proxy-based
• B.Policy-based
• C.DNS-based
• D.IP-based
• E.Flow-based