NSE4_FGT-6.4 Practice Test

Review 121 NSE4-FGT-6-4 practice questions with answer explanations and community insights.

Question 1

Which two statements are true when FortiGate is in transparent mode? (Choose two.)

  1. By default, all interfaces are part of the same broadcast domain.
  2. The existing network IP schema must be changed when installing a transparent mode FortiGate in the network.
  3. Static routes are required to allow traffic to the next hop.
  4. FortiGate forwards frames without changing the MAC address.

Question 2

What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

  1. Full Content inspection
  2. Proxy-based inspection
  3. Certificate inspection
  4. Flow-based inspection

Question 3

Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

  1. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password.
  2. FortiGate supports pre-shared key and signature as authentication methods.
  3. Enabling XAuth results in a faster authentication because fewer packets are exchanged.
  4. A certificate is not required on the remote peer when you set the signature as the authentication method.

Question 4

Which scanning technique on FortiGate can be enabled only on the CLI?

  1. Heuristics scan
  2. Trojan scan
  3. Antivirus scan
  4. Ransomware scan

Question 5

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

  1. Firewall policy
  2. Policy rule
  3. Security policy
  4. SSL inspection and authentication policy