Exam NSE4_FGT-6.4 topic 1 question 41 discussion

C is correct, I have just confirmed this on a Production Fortigate FW and you can add user/User group but you cannot add Address group with ISDB object. It will simply show a red highlighted error which is read as "Addresses/groups cannot be mixed with Internet Services'

B is correct. If your try adding anything else you get an error

C. You can't mix ISDB objects with regular address objects. User objects are not restricted in any way. Fortigate Security 7.0 pg 117

C is correct and tested (user added and user group are added to policy but ip address or network failed to add) Version 7.0.5

C é a verdadeira

I think it's "C" Service : This option is only available when Destination Internet Service is off. So if you are on source you should be able to add users and groups, I didn't test but as per theory that is what is looks like. https://docs.fortinet.com/document/fortimanager/6.2.1/administration-guide/663598/create-new-firewall-policy

Addresses/groups cannot be mixed with Internet Services For this reason the answer is the C

I have tested B is correct

C - you can add USER if you are unig in source. FortiGate Security 6.4 Study Guide - pag 109

C is correct

B. You CANNOT mix regular address objects with ISDB objects, and you CANNOT select services on a firewall policy

A and D are not correct for a very simple reason: The internet service dictates them already. If you choose AWS-Web als the service, then AWS has a fixed set of IP addresses and domain names that define them. Makes no sense to say I want to block AWS on Google.com or something like this. If it is Google.com it is not AWS anymore. C is correct and makes sense - I want to block AWS, but only for certain users in my company.

Correct answer is A. "You CANNOT mix regular address objects with ISDB objects, and you CANNOT select services on a firewall policy." Direct quote from Security 6.4 study guide page 109.

C is the correct answer.

The correct Answer is A, you CAN add user/groups if you have added Internet Service as a Source. You CAN'T add (IP) addresses or address groups in the Source if you have Internet Service there also. I just tested this in a VM instance of a FG.

C is correct, You can give it a try, HAND ON LAB

C is Correct. You can prove it by configuring it on FortiGate.