NSE4-5.4

NSE4-5.4 practice questions, page 12 of 23, with answer review and explanations.

Question 56

Which configuration objects can be selected for the Source filed of a firewall policy? (Choose two.)

  1. FQDN address
  2. IP pool
  3. User or user group
  4. Firewall service

Question 57

Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

  1. 10.200.1.1
  2. 10.0.1.254
  3. Any available IP address in the WAN(port1) subnet 10.200.1.0/24
  4. 10.200.1.10

Question 58

Which statement about data leak prevention (DLP) on a FortiGate is true?

  1. Traffic shaping can be applied to DLP sensors.
  2. It can be applied to a firewall policy in a flow-based VDOM.
  3. Files can be sent to FortiSandbox for detecting DLP threats.
  4. It can archive files and messages.

Question 59

Which statements about an IPv6-over-IPv4 IPsec configuration are correct? (Choose two.)

  1. The remote gateway IP must be an IPv6 address.
  2. The source quick mode selector must be an IPv4 address.
  3. The local gateway IP must an IPv4 address.
  4. The destination quick mode selector must be an IPv6 address.

Question 60

Which statements about IP-based explicit proxy authentication are true? (Choose two.)

  1. IP-based authentication is best suited to authenticating users behind a NAT device.
  2. Sessions from the same source address are treated as a single user.
  3. IP-based authentication consumes less FortiGate's memory than session-based authentication.
  4. FortiGate remembers authenticated sessions using browser cookies.