NSE4-5.4

NSE4-5.4 practice questions, page 10 of 23, with answer review and explanations.

Question 46

Which statements about high availability (HA) for FortiGates are true? (Choose two.)

  1. Virtual clustering can be configured between two FortiGate devices with multiple VDOM.
  2. Heartbeat interfaces are not required on the primary device.
  3. HA management interface settings are synchronized between cluster members.
  4. Sessions handled by UTM proxy cannot be synchronized.

Question 47

Which of the following statements about central NAT are true? (Choose two.)

  1. IP tool references must be removed from existing firewall policies before enabling central NAT.
  2. Central NAT can be enabled or disabled from the CLI only.
  3. Source NAT, using central NAT, requires at least one central SNAT policy.
  4. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall policy.

Question 48

Which statement about the FortiGuard services for the FortiGate is true?

  1. Antivirus signatures are downloaded locally on the FortiGate.
  2. FortiGate downloads IPS updates using UDP port 53 or 8888.
  3. FortiAnalyzer can be configured as a local FDN to provide antivirus and IPS updates.
  4. The web filtering database is downloaded locally on the FortiGate.

Question 49

Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)

  1. The antivirus engine starts scanning a file after the last packet arrives.
  2. It does not support FortiSandbox inspection.
  3. FortiGate can insert the block replacement page during the first connection attempt only if a virus is detected at the start of the TCP stream.
  4. It uses the compact antivirus database.

Question 50

An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?

  1. A phase 2 configuration is not required.
  2. This VPN cannot be used as part of a hub and spoke topology.
  3. The IPsec firewall policies must be placed at the top of the list.
  4. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.