NSE4-5.4

NSE4-5.4 practice questions, page 14 of 23, with answer review and explanations.

Question 66

An administrator has blocked Netflix login in a cloud access security inspection (CASI) profile. The administrator has also applied the CASI profile to a firewall policy. What else is required for the CASI profile to work properly?

  1. You must enable logging for security events on the firewall policy.
  2. You must activate a FortiCloud account.
  3. You must apply an application control profile to the firewall policy.
  4. You must enable SSL inspection on the firewall policy.

Question 67

How does FortiGate look for a matching firewall policy to process traffic?

  1. From top to bottom, based on the sequence numbers.
  2. Based on best match.
  3. From top to bottom, based on the policy ID numbers.
  4. From lower to higher, based on the priority value.

Question 68

How do you configure a FortiGate to do traffic shaping of P2P traffic, such as BitTorrent?

  1. Apply an application control profile allowing BitTorrent to a firewall policy and configure a traffic shaping policy.
  2. Enable the shape option in a firewall policy with service set to BitTorrent.
  3. Apply a traffic shaper to a BitTorrent entry in the SSL/SSH inspection profile.
  4. Apply a traffic shaper to a protocol options profile.

Question 69

Which file names will match the *.tiff file name pattern configured in a data leak prevention filter? (Choose two.)

  1. tiff.tiff [1]
  2. tiff.jpeg
  3. gif.tiff

Question 70

An administrator has configured a dialup IPsec VPN with XAuth. Which method statement best describes this scenario?

  1. Only digital certificates will be accepted as an authentication method in phase 1.
  2. Dialup clients must provide a username and password for authentication.
  3. Phase 1 negotiations will skip pre-shared key exchange.
  4. Dialup clients must provide their local ID during phase 2 negotiations.