Fortinet NSE4-5.4 問題集

質問 1：
What FortiGate feature can be used to allow IPv6 clients to connect to IPv4 servers?
A. IPv6-over-IPv4 IPsec
B. NAT66
C. IPv4-over-IPv6 IPsec
D. NAT64
正解：D

質問 2：
Examine the exhibit, which contains a virtual IP and a firewall policy configuration.

The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address
10.0.1.254/24.
The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
A. 10.200.1.1
B. 10.0.1.254
C. 10.200.1.10
D. Any available IP address in the WAN(port1) subnet 10.200.1.0/24
正解：C

質問 3：
View the exhibit.

The client cannot connect to the HTTP web server. The administrator run the FortiGate built-in sniffer and got the following output:

What should be done next to troubleshoot the problem?
A. Capture the traffic using an external sniffer connected to port1.
B. Execute a debug flow.
C. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10".
D. Run a sniffer in the web server.
正解：D

質問 4：
Which define device identification? (Choose two.)
A. FortiClient can be used as an agent based device identification technique.
B. Enabling a source device in a firewall policy enables device identification on the source interfaces of that policy.
C. You cannot combine source user and source device in the same firewall policy.
D. Device identification is enabled by default on all interfaces.
E. Only agentless device identification techniques are supported.
正解：A,B

質問 5：
A FortiGate is operating in NAT/Route mode and configured with two virtual LAN (VLAN) sub-interfaces added to the same physical interface.
Which statement about the VLAN IDs in this scenario is true?
A. The two VLAN sub-interfaces must have different VLAN IDs.
B. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in different subnets.
C. The two VLAN sub-interfaces can have the same VLAN ID only if they have IP addresses in the same subnet.
D. The two VLAN sub-interfaces can have the same VLAN ID only if they belong to different VDOMs.
正解：A

質問 6：
Which of the following antivirus and attack definition update features are supported by FortiGate units?
(Select all that apply.)
A. Push updates from the FortiGuard Distribution Network.
B. Update status including version numbers, expiry dates, and most recent update dates and times.
C. Manual, user-initiated updates from the FortiGuard Distribution Network.
D. Hourly, daily, or weekly scheduled antivirus and attack definition and antivirus engine updates from the FortiGuard Distribution Network.
正解：A,B,C,D

質問 7：
A FortiGate is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.
Which of the following settings will this administrator be able to configure? (Choose two.)
A. System hostname.
B. FortiGuard Distribution Network configuration.
C. Firewall addresses.
D. DHCP servers.
正解：C,D

質問 8：
View the exhibit.

When a user attempts to connect to an HTTPS site, what is the expected result with this configuration?
A. The user is required to authenticate before accessing sites with untrusted SSL certificates.
B. The user is blocked from connecting to sites that have untrusted SSL certificates (no exception provided).
C. The user is allowed access all sites with untrusted SSL certificates, without certificate warnings.
D. The user is presented with certificate warnings when connecting to sites that have untrusted SSL certificates.
正解：D