Fortinet NSE4-5.4 問題集

質問 1：
View the exhibit.

Which of the following statements are correct? (Choose two.)
A. next-hop IP address is not required when configuring a static route that uses the wan-load balance interface.
B. The wan-load-balance interface must be manually created.
C. Each member interface requires its own firewall policy to allow traffic.
D. Sessions will be load-balanced based on source and destination IP addresses.
正解：A,D

質問 2：
Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.

Which of the following statements correctly describes the static routing configuration provided above?
A. The FortiGate shares the traffic to 172.20.168.0/24 through both routes, but the port2 route will carry approximately twice as much of the traffic.
B. The FortiGate sends all the traffic to 172.20.168.0/24 through port1.
C. Only the route that is using port1 will show up in the routing table.
D. The FortiGate evenly shares the traffic to 172.20.168.0/24 through both routes.
正解：B

質問 3：
Which of the following statements describes the method of creating a policy to block access to an FTP site?
A. Create a firewall policy with a protection profile containing the Block FTP option enabled.
B. Create a firewall policy with destination address set to the IP address of the FTP site, the Service set to FTP, and the Action set to Deny.
C. Enable Web Filter URL blocking and add the URL of the FTP site to the URL Block list.
D. None of the above.
正解：B

質問 4：
How does FortiGate verify the login credentials of a remote LDAP user?
A. FortiGate queries the LDAP server for credentials.
B. FortiGate re-generates the algorithm based on the login credentials and compares it against the algorithm stored on the LDAP server.
C. FortiGate sends the user entered credentials to the LDAP server for authentication.
D. FortiGate queries its own database for credentials.
正解：C

質問 5：
What is longest length of time allowed on a FortiGate device for the virus scan to complete?
A. 10 seconds
B. 45 seconds
C. 30 seconds
D. 20 seconds
正解：C

質問 6：
An administrator has formed a high availability cluster involving two FortiGate units.
[ Multiple upstream Layer 2 switches] -- [ FortiGate HA Cluster ] -- [ Multiple downstream Layer 2 switches ] The administrator wishes to ensure that a single link failure will have minimal impact upon the overall throughput of traffic through this cluster.
Which of the following options describes the best step the administrator can take? The administrator should_____________.
A. Enable monitoring of all active interfaces.
B. Configure the HA ping server feature to allow for HA failover in the event that a path is disrupted
C. Set up a full-mesh design which uses redundant interfaces.
D. Increase the number of FortiGate units in the cluster and configure HA in active-active mode.
正解：C

質問 7：
Review the static route configuration for IPsec shown in the exhibit; then answer the question below.

Which statements are correct regarding this configuration? (Choose two.)
A. Interface remote is an IPsec interface.
B. A gateway address is not required because the interface is a point-to-point connection.
C. A gateway address is not required because the default route is used.
D. Interface remote is a zone.
正解：A,B

質問 8：
Examine the network topology diagram in the exhibit; the workstation with the IP address 212.10.11.110 sends a TCP SYN packet to the workstation with the IP address 212.10.11.20.

Which of the following sentences best describes the result of the reverse path forwarding (RFP) check executed by the FortiGate on the SYN packets? (Choose two).
A. Packets is allowed if RPF is configured as strict.
B. Packets is blocked if RPF is configured as loose.
C. Packets is blocked if RPF is configured as strict.
D. Packets is allowed if RPF is configured as loose.
正解：C,D