Fortinet NSE4_FGT-7.0 Exam Questions Simulate Actual NSE4_FGT-7.0 Exam

Category:

Comments:

0 Comments

Post Date:

April 1, 2023

NSE4_FGT-7.0 exam dumps questions are designed to simulate the actual exam. This means that you will get a feel for the types of questions you can expect to see on the exam, as well as the format and difficulty level. In addition, NSE 4 NSE4_FGT-7.0 dumps are often accompanied by detailed explanations and answers. This means that if you get a question wrong, you can learn from your mistake and understand why the correct answer is the right one. Test free online NSE4_FGT-7.0 exam dumps below.

Page 1 of 6

1. Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

System event logs

Forward traffic logs

Local traffic logs

Security logs

2. In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies.

Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

3. Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.

What will be the impact of using Include in every user group option in a RADIUS configuration?

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

4. Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

Root VDOM

FG-traffic VDOM

Customer VDOM

Global VDOM

5. Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Source defined as Internet Services in the firewall policy.

Destination defined as Internet Services in the firewall policy.

Highest to lowest priority defined in the firewall policy.

Services defined in the firewall policy.

Lowest to highest policy ID number.

6. If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

The Services field prevents SNAT and DNAT from being combined in the same policy.

The Services field is used when you need to bundle several VIPs into VIP groups.

The Services field removes the requirement to create multiple VIPs for different services.

The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.

7. Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

8. Examine this output from a debug flow:

Why did the FortiGate drop the packet?

The next-hop IP address is unreachable.

It failed the RPF check.

It matched an explicitly configured firewall policy with the action DEN

It matched the default implicit firewall policy.

9. Examine the two static routes shown in the exhibit, then answer the following question.

Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

FortiGate will load balance all traffic across both routes.

FortiGate will use the port1 route as the primary candidate.

FortiGate will route twice as much traffic to the port2 route

FortiGate will only actuate the port1 route in the routing table

10. View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games).

Based on this configuration, which statement is true?

Addicting.Games is allowed based on the Application Overrides configuration.

Addicting.Games is blocked on the Filter Overrides configuration.

Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

Addcting.Games is allowed based on the Categories configuration.

Page 2 of 6

11. Refer to the exhibit.

The exhibit shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will allow attackers matching the NT

Spoofed.Ko

DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will reset all connections that match these signatures.

The sensor will gather a packet log for all matched traffic.

12. Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Log downloads from the GUI are limited to the current filter view

Log backups from the CLI cannot be restored to another FortiGate.

Log backups from the CLI can be configured to upload to FTP as a scheduled time

Log downloads from the GUI are stored as LZ4 compressed files.

13. Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.

How does FortiGate process the traffic sent to http://www.fortinet.com?

Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.

Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.

Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.

Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.

14. Which two statements are correct about NGFW Policy-based mode? (Choose two.)

NGFW policy-based mode does not require the use of central source NAT policy

NGFW policy-based mode can only be applied globally and not on individual VDOMs

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

NGFW policy-based mode policies support only flow inspection

15. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

Enable Dead Peer Detection.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

16. Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is a UDP unidirectional state.

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a bidirectional TCP connection.

17. Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.

The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

10.200.1.10

Any available IP address in the WAN (port1) subnet 10.200.1.0/24

10.200.1.1

10.0.1.254

18. Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

diagnose sys top

execute ping

execute traceroute

diagnose sniffer packet any

get system arp

19. An administrator has configured two-factor authentication to strengthen SSL VPN access.

Which additional best practice can an administrator implement?

Configure Source IP Pools.

Configure split tunneling in tunnel mode.

Configure different SSL VPN realms.

Configure host check.

20. FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

www.example.com:443

www.example.com

example.com

www.example.com/index.html

Page 3 of 6

21. When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

remote user’s public IP address

The public IP address of the FortiGate device.

The remote user’s virtual IP address.

The internal IP address of the FortiGate device.

22. An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

Device detection on all interfaces is enforced for 30 minutes.

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

23. Which two statements are true about the RPF check? (Choose two.)

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

The RPF check is run on the first sent and reply packet of any new session.

RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

24. Which three statements about a flow-based antivirus profile are correct? (Choose three.)

IPS engine handles the process as a standalone.

FortiGate buffers the whole file but transmits to the client simultaneously.

If the virus is detected, the last packet is delivered to the client.

Optimized performance compared to proxy-based inspection.

Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.

25. An administrator needs to increase network bandwidth and provide redundancy.

What interface type must the administrator select to bind multiple FortiGate interfaces?

VLAN interface

Software Switch interface

Aggregate interface

Redundant interface

26. Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)

SSH

HTTPS

FTM

FortiTelemetry

27. An administrator is running the following sniffer command:

diagnose aniffer packet any "host 192.1.68.2.12” 5

Which three pieces of Information will be Included in me sniffer output? {Choose three.)

Interface name

Packet payload

Ethernet header

IP header

Application header

28. Refer to the exhibits.

Exhibit A.

Exhibit B.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.

Change the csf setting on ISFW (downstream) to sec configuracion-sync local.

Change the csf setting on Local-FortiGate (root) to sec fabric-objecc-unificacion defaulc.

Change the csf setting on ISFW (downstream) to sec fabric-objecc-unificacion defaulc.

29. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

30. To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on

which device?

FortiManager

Root FortiGate

FortiAnalyzer

Downstream FortiGate

Page 4 of 6

31. An organization’s employee needs to connect to the office through a high-latency internet connection.

Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

Change the session-ttl.

Change the login timeout.

Change the idle-timeout.

Change the udp idle timer.

32. Refer to the exhibit.

Which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is in SYN_SENT state.

The session is in FIN_ACK state.

The session is in FTN_WAIT state.

The session is in ESTABLISHED state.

33. If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

A CRL

A person

A subordinate CA

A root CA

34. You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.

What is the default behavior when the local disk is full?

Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.

No new log is recorded until you manually clear logs from the local disk.

Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.

No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.

35. Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

Proxy-based inspection

Certificate inspection

Flow-based inspection

Full Content inspection

36. The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.

What order must FortiGate use when the web filter profile has features enabled, such as safe search?

DNS-based web filter and proxy-based web filter

Static URL filter, FortiGuard category filter, and advanced filters

Static domain filter, SSL inspection filter, and external connectors filters

FortiGuard category filter and rating filter

37. Which two statements are true about the FGCP protocol? (Choose two.)

Not used when FortiGate is in Transparent mode

Elects the primary FortiGate device

Runs only over the heartbeat links

Is used to discover FortiGate devices in different HA groups

38. In an explicit proxy setup, where is the authentication method and database configured?

Proxy Policy

Authentication Rule

Firewall Policy

Authentication scheme

39. What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

FortiGate automatically negotiates different local and remote addresses with the remote peer.

FortiGate automatically negotiates a new security association after the existing security association expires.

FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

40. Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

Web filter in flow-based inspection

Antivirus in flow-based inspection

DNS filter

Web application firewall

Application control

Page 5 of 6

41. Which of the following SD-WAN load Cbalancing method use interface weight value to distribute traffic? (Choose two.)

Source IP

Spillover

Volume

Session

42. NGFW mode allows policy-based configuration for most inspection rules.

Which security profile’s configuration does not change when you enable policy-based inspection?

Web filtering

Antivirus

Web proxy

Application control

43. Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It always authorizes the traffic without requiring authentication.

It drops the traffic.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

44. Refer to the exhibit to view the application control profile.

Users who use Apple FaceTime video conferences are unable to set up meetings.

In this scenario, which statement is true?

Apple FaceTime belongs to the custom monitored filter.

The category of Apple FaceTime is being monitored.

Apple FaceTime belongs to the custom blocked filter.

The category of Apple FaceTime is being blocked.

45. Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

46. Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port3 default route has the highest distance.

The port3 default route has the lowest metric.

There will be eight routes active in the routing table.

The port1 and port2 default routes are active in the routing table.

47. Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

This is known as many-to-one NA

Source IP is translated to the outgoing interface I

Connections are tracked using source port and source MAC address.

Port address translation is not used.

48. Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password

FortiGate supports pre-shared key and signature as authentication methods.

Enabling XAuth results in a faster authentication because fewer packets are exchanged.

A certificate is not required on the remote peer when you set the signature as the authentication method.

49. Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings.

Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

The signature setting uses a custom rating threshold.

The signature setting includes a group of other signatures.

Traffic matching the signature will be allowed and logged.

Traffic matching the signature will be silently dropped and logged.

50. A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces must have different VLAN IDs.

The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

Page 6 of 6

51. Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

Both the phase 1 SA and phase 2 SA are bidirectional.

52. Which two statements ate true about the Security Fabric rating? (Choose two.)

It provides executive summaries of the four largest areas of security focus.

Many of the security issues can be fixed immediately by clicking Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

TAGS:

NSE4_FGT-7.0, NSE4_FGT-7.0 exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Posts

Fortinet Free Dumps

Get NSE4_FGT-7.0 Dumps Full Version

Q&As: 172
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm

Fortinet NSE4_FGT-7.0 Exam Questions Simulate Actual NSE4_FGT-7.0 Exam

Related

Posts

2024 Fortinet FCP_FCT_AD-7.2 Exam Dumps Questions

Online FCP_WCS_AD-7.4 Dumps Help You Understand Questions Well

FCSS_ADA_AR-6.7 Dumps Guarantee You Pass FCSS_ADA_AR-6.7 Exam Easily

Study Online FCSS_SASE_AD-23 Exam Dumps to Pass

About Us

EMAIL

Services

Opening Hours