Fortinet NSE4-5.4 Exam Questions

Question 6 of 575

View the exhibit.
Exam NSE4-5.4: Question 6 - Image 1

Which of the following statements are correct? (Choose two.)

This is a redundant IPsec setup.

The TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

This setup requires at least two firewall policies with action set to IPsec.

Dead peer detection must be disabled to support this type of IPsec setup.

Correct Answer: A, B

Question 7 of 575

Which statements about DNS filter profiles are true? (Choose two.)

They can inspect HTTP traffic.

They must be applied in firewall policies with SSL inspection enabled.

They can block DNS request to known botnet command and control servers.

They can redirect blocked requests to a specific portal.

Correct Answer: C, D

Question 8 of 575

An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)

Logs must be stored on FortiGate first, before transmitting to FortiAnalyzer

FortiGate uses port 8080 for log transmission

Log messages are transmitted as plain text in LZ4 compressed format (store-and-upload method).

FortiGate can encrypt communications using SSL encrypted OFTP traffic.

Correct Answer: C, D

Log messages are transmitted as plain text in LZ4 compressed format, and FortiGate can encrypt communications using SSL encrypted OFTP traffic to ensure secure transmission of log data to FortiAnalyzer. This makes options C and D correct as they align with the typical methods and security protocols used in transmitting log data from FortiGate to FortiAnalyzer.

Question 9 of 575

Which of the following statements describe WMI polling mode for FSSO collector agent? (Choose two.)

The collector agent does not need to search any security event logs.

WMI polling can increase bandwidth usage with large networks.

The NetSessionEnum function is used to track user logoffs.

The collector agent uses a Windows API to query DCs for user logins.

Correct Answer: B, D

Question 10 of 575

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

The interface has been configured for one-arm sniffer.

The interface is a member of a virtual wire pair.

The operation mode is transparent.

The interface is a member of a zone.

Captive portal is enabled in the interface.

Correct Answer: A, B, C

The interface cannot be configured with an IP address if it is set up for one-arm sniffer because this mode is used for network traffic analysis and does not require an IP address. If the interface is a member of a virtual wire pair, it acts as a transparent bridge and does not need an IP address. When the operation mode is transparent, the device operates at Layer 2, meaning it forwards packets without needing an IP address assigned to its interfaces.