Online Access Free NSE4_FGT-5.6 Practice Test

An administrator has configured a route-based IPsec VPN between two FortiGates. Which statement about this IPsec VPN configuration is true?
Response:

• A.The IPsec firewall policies must be placed at the top of the list.
• B.A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
• C.This VPN cannot be used as part of a hub and spoke topology.
• D.A phase 2 configuration is not required.

Examine this output from a debug flow:

Which statements about the output are correct?
(Choose two.)
Response:

• A.The source IP address of the packet was translated to 10.0.1.10.
• B.FortiGate routed the packet through port 3.
• C.FortiGate received a TCP SYN/ACK packet.
• D.The packet was allowed by the firewall policy with the ID 00007fc0.

View the exhibit.


Which of the following statements are correct?
(Choose two.)
Response:

• A.This is a redundant IPsec setup.
• B.This setup requires at least two firewall policies with action set to IPsec.
• C.Dead peer detection must be disabled to support this type of IPsec setup.
• D.The TunnelB route is the primary one for searching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

Which traffic inspection features can be executed by a security processor (SP)?
(Choose three.)
Response:

• A.Flow-based web filtering
• B.SIP session helper
• C.Proxy-based antivirus
• D.TCP SYN proxy
• E.Attack signature matching

Under which circumstance is the IPsec ESP traffic encapsulated over UDP?
Response:

• A.When the phase 1 is configured to use aggressive mode
• B.When using IKE version 2 (IKEv2)
• C.When the IPsec VPN is configured as dial-up
• D.When NAT-T detects there is a device between both IPsec peers doing NAT over the IPsec traffic