NSE4_FGT-6.0 試験問題を無料オンラインアクセス

Which statements correctly describe transparent mode operation? (Choose three.)

• A.All interfaces of the transparent mode FortiGate device must be on different IP subnets.
• B.It permits inline traffic inspection and firewalling without changing the IP scheme of the network.
• C.Ethernet packets are forwarded based on destination MAC addresses, not IP addresses.
• D.FortiGate acts as transparent bridge and forwards traffic at Layer 2.
• E.The transparent FortiGate is visible to network hosts in an IP traceroute.

Which of the following statements about central NAT are true? (Choose two.)

• A.Central NAT can be enabled or disabled from the CLI only.
• B.IP tool references must be removed from existing firewall policies before enabling central NAT.
• C.Source NAT, using central NAT, requires at least one central SNAT policy.
• D.Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

View the exhibit.

Which of the following statements are correct? (Choose two.)

• A.The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
• B.This is a redundant IPsec setup.
• C.Dead peer detection must be disabled to support this type of IPsec setup.
• D.This setup requires at least two firewall policies with the action set to IPsec.

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

• A.It limits the scope of application control to scan application traffic based on application category only.
• B.It limits the scope of application control to scan application traffic using parent signatures only
• C.It limits the scope of application control to scan application traffic on DNS protocol only.
• D.It limits the scope of application control to the browser-based technology category only.

Which of the following statements about the FSSO collector agent timers is true?

• A.The dead entry timeout interval is used to age out entries with an unverified status.
• B.The user group cache expiry is used to age out the monitored groups.
• C.The IP address change verify interval monitors the server IP address where the collector agent is installed, and the updates the collector agent configuration if it changes.
• D.The workstation verify interval is used to periodically check of a workstation is still a domain member.