NSE4-5.4

NSE4-5.4 practice questions, page 22 of 23, with answer review and explanations.

Question 106

Which statement about the IP authentication header (AH) used by IPsec is true?

  1. AH does not provide any data integrity or encryption.
  2. AH does not support perfect forward secrecy.
  3. AH provides data integrity but no encryption.
  4. AH provides strong data integrity but weak encryption.

Question 107

View the exhibit. Why is the administrator getting the error shown in the exhibit?

  1. The administrator admin does not have the privileges required to configure global settings.
  2. The global settings cannot be configured from the root VDOM context.
  3. The command config system global does not exist in FortiGate.
  4. The administrator must first enter the command edit global.

Question 108

What FortiGate feature can be used to block a ping sweep scan from an attacker?

  1. Web application firewall (WAF)
  2. Rate based IPS signatures
  3. One-arm sniffer
  4. DoS policies

Question 109

Which statements about the firmware upgrade process on an active-active high availability (HA) cluster are true? (Choose two.)

  1. The firmware image must be manually uploaded to each FortiGate.
  2. Only secondary FortiGate devices are rebooted.
  3. Uninterruptable upgrade is enabled by default.
  4. Traffic load balancing is temporally disabled while upgrading the firmware.

Question 110

Examine the exhibit, which shows the output of a web filtering real time debug. Why is the site www.bing.com being blocked?

  1. The web server IP address 204.79.197.200 is categorized by FortiGuard as Malicious Websites.
  2. The rating for the web site www.bing.com has been locally overridden to a category that is being blocked.
  3. The web site www.bing.com is categorized by FortiGuard as Malicious Websites.
  4. The user has not authenticated with the FortiGate yet.