NSE4_FGT-6.4 is one of the most popular certifications for Fortinet！Lead4Pass many exam experts after a long time of hard work, today in January 2022 released the latest updated Fortinet NSE4_FGT-6.4 exam questions – Lead4Pass NSE4_FGT-6.4 dumps.
Lead4Pass NSE4_FGT-6.4 dumps have two modes dumps pdf and dumps VCE, which are 100% true and effective to help you pass the exam – NSE4_FGT-6.4 dumps (2022.1 updates): https://www.lead4pass.com/nse4_fgt-6-4.html (163 Q&A dumps)
And: Share a part of the latest updated NSE4_FGT-6.4 exam questions online exam test (the answer to the exam question will be announced at the end of the article)
Continue: Or download the NSE4_FGT-6.4 dumps PDF for free sharing online: https://drive.google.com/file/d/1ZtG4Pp65RGJiU3P_ovC8iDkAYVjoHXcB/
NSE4_FGT-6.4 exam questions online exam practice
QUESTION 1
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and
static routes.
1.
All traffic must be routed through the primary tunnel when both tunnels are up
2.
The secondary tunnel must be used only if the primary tunnel goes down
3.
In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
A. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
B. Enable Dead Peer Detection.
C. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
D. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
QUESTION 2
Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)
A. hard-timeout
B. auth-on-demand
C. soft-timeout
D. new-session
E. Idle-timeout
https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221
QUESTION 3
An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken.
Each site has a FortiGate VPN gateway.
What must an administrator do to achieve this objective?
A. The administrator can register the same FortiToken on more than one FortiGate.
B. The administrator must use a FortiAuthenticator device.
C. The administrator can use a third-party radius OTP server.
D. The administrator must use the user self-registration server.
QUESTION 4
Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
A. Browsers can be configured to retrieve this PAC file from the FortiGate.
B. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
C. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
D. Any web request fortinet.com is allowed to bypass the proxy.
QUESTION 5
Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?
A. diagnose wad session list
B. diagnose wad session list | grep hook-preandandhook-out
C. diagnose wad session list | grep hook=preandandhook=out
D. diagnose wad session list | grep “hook=pre”and”hook=out”
QUESTION 6
An administrator must disable RPF check to investigate an issue. Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?
A. Enable asymmetric routing, so the RPF check will be bypassed.
B. Disable the RPF check at the FortiGate interface level for the source check.
C. Disable the RPF check at the FortiGate interface level for the reply check.
D. Enable asymmetric routing at the interface level.
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955
QUESTION 7
Refer to the exhibit.
Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)
A. Traffic between port2 and port2-vlan1 is allowed by default.
B. port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
C. port1 is a native VLAN.
D. port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
QUESTION 8
Examine this output from a debug flow: Why did the FortiGate drop the packet?
A. The next-hop IP address is unreachable.
B. It failed the RPF check.
C. It matched an explicitly configured firewall policy with the action DENY.
D. It matched the default implicit firewall policy.
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
QUESTION 9
Refer to the exhibit.
The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are
configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access internet.
The To_lnternet VDOM is the only VDOM with internet access and is directly connected to ISP modem.
Which two statements are true? (Choose two.)
A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
QUESTION 10
Which of the following statements about central NAT are true? (Choose two.)
A. IP tool references must be removed from existing firewall policies before enabling central NAT.
B. Central NAT can be enabled or disabled from the CLI only.
C. Source NAT, using central NAT, requires at least one central SNAT policy.
D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.
QUESTION 11
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
A. On HQ-FortiGate, enable Auto-negotiate.
B. On Remote-FortiGate, set Seconds to 43200.
C. On HQ-FortiGate, enable Diffie-Hellman Group 2.
D. On HQ-FortiGate, set Encryption to AES256.
Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/168495
QUESTION 12
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
A. System time
B. FortiGuaid update servers
C. Operating mode
D. NGFW mode
Verify answer:
| Q1 | Q2 | Q3 | Q4 | Q5 | Q6 | Q7 | Q8 | Q9 | Q10 | Q11 | Q12 |
| BD | ADE | C | AD | D | D | AD | D | AD | AB | C | AD |
All Fortinet NSE4_FGT-6.4 exam questions will be updated in 2022, guaranteed to be true and valid, and get complete Fortinet NSE4_FGT-6.4 dumps to ensure 100% pass the exam (2022.1 updates): https://www.lead4pass.com/nse4_fgt-6-4.html (163 Q&A dumps)
PS.Free to share the latest updated NSE4_FGT-6.4 dumps PDF: https://drive.google.com/file/d/1ZtG4Pp65RGJiU3P_ovC8iDkAYVjoHXcB/