Free NSE4-54 Fortinet NSE4-54 Practice Test Question - Page 2

Question 4 (Topic 1)

An administrator wants to create a policy-based IPsec VPN tunnel between two FortiGate devices. Which configuration steps must be performed on both units to support this scenario? (Choose three.)

Select an option, then click Submit answer.

○ Define the phase 2 parameters.
○ Set the phase 2 encapsulation method to transport mode.
○ Define at least one firewall policy, with the action set to IPsec.
○ Define a route to the remote network over the IPsec tunnel.
○ Define the phase 1 parameters, without enabling IPsec interface mode.

Question 5 (Topic 1)

View the exhibit. In this scenario, FGT1 has the following routing table: S* 0. 0. 0. 0/0 [10/0] via 10. 40. 72. 2, port1 C 172. 16. 32. 0/24 is directly connected, port2 C 10. 40. 72. 0/30 is directly connected, port1 A user at 192.168.32.15 is trying to access the web server at 172.16.32.254. Which of the following statements best describe how the FortiGate will perform reverse path forwarding checks on this traffic? (Choose two.)

Select an option, then click Submit answer.

○ Strict RPF check will deny the traffic.
○ Strict RPF check will allow the traffic.
○ Loose RPF check will allow the traffic.
○ Loose RPF check will deny the traffic.

Reference / correct answer:

Strict RPF check will allow the traffic.

Most accepted answer: B. Strict RPF check will allow the traffic.

Community votes: B=1, C=1

Selected Answer: BC B. and C. RPF Check Explanation: Strict RPF: The incoming interface must exactly match the one used to reach the source address. Loose RPF: The incoming interface must be one of the interfaces used to reach the source address. Analysis: In this scenario, both strict and loose RPF checks will allow the traffic because: The traffic is destined for a directly connected network (172.16.32.0/24) on port2. This means the traffic enters the FortiGate through the correct interface. The source address (192.168.32.15) is irrelevant for RPF checks in this case. Since the destination is directly connected, the FortiGate doesn't need to perform any routing lookup to determine the outgoing interface. Therefore, both strict and loose RPF checks will allow the traffic to pass through the FortiGate. Key Points: RPF checks are primarily designed to prevent spoofed traffic. When the destination is directly connected, RPF checks are less stringent. Understanding the network topology and traffic flow is crucial for proper RPF configuration. upvoted 1 times

correct answer is B & C Reference: Fortinet Training Institute. FCP - Fortigate 7.4 Administrator Sample Questions. upvoted 1 times

B and C. https://extreme-networks.my.site.com/ExtrArticleDetail?an=000086726 upvoted 1 times

the correct answer is B and C upvoted 2 times

Question 6 (Topic 1)

Which statements about the firmware upgrade process on an active-active high availability (HA) cluster are true? (Choose two.)

Select an option, then click Submit answer.

○ The firmware image must be manually uploaded to each FortiGate.
○ Only secondary FortiGate devices are rebooted.
○ Uninterruptable upgrade is enabled by default.
○ Traffic load balancing is temporally disabled while upgrading the firmware.

Free NSE4-54 – Fortinet NSE4-54 Practice Test Question