Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 91:

  What inspection mode does FortiGate use if it is configured as a policy-based next- generation firewall (NGFW)?

  A. Full Content inspection

  B. Proxy-based inspection

  C. Certificate inspection

  D. Flow-based inspection

  Correct Answer: D

• Question 92:

  What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

  A. It limits the scope of application control to the browser-based technology category only.

  B. It limits the scope of application control to scan application traffic based on application category only.

  C. It limits the scope of application control to scan application traffic using parent signatures only

  D. It limits the scope of application control to scan application traffic on DNS protocol only.

  Correct Answer: B

• Question 93:

  A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

  What is the reason for the certificate warning errors?

  A. The browser requires a software update.

  B. FortiGate does not support full SSL inspection when web filtering is enabled.

  C. The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.

  D. There are network connectivity issues.

  Correct Answer: C

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41394

• Question 94:

  You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.

  What is the default behavior when the local disk is full?

  A. Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.

  B. No new log is recorded until you manually clear logs from the local disk.

  C. Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.

  D. No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.

  Correct Answer: C

  Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cli-reference/462620/log-disk-setting

• Question 95:

  Examine the following web filtering log.

  

  Which statement about the log message is true?

  A. The action for the category Games is set to block.

  B. The usage quota for the IP address 10.0.1.10 has expired

  C. The name of the applied web filter profile is default.

  D. The web site miniclip.com matches a static URL filter whose action is set to Warning.

  Correct Answer: C

• Question 96:

  Refer to the exhibit to view the application control profile.

  

  Based on the configuration, what will happen to Apple FaceTime?

  A. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration

  B. Apple FaceTime will be allowed, based on the Apple filter configuration.

  C. Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn

  D. Apple FaceTime will be allowed, based on the Categories configuration.

  Correct Answer: A

• Question 97:

  Refer to the exhibit, which contains a static route configuration.

  

  An administrator created a static route for Amazon Web Services.

  What CLI command must the administrator use to view the route?

  A. get router info routing-table all

  B. get internet service route list

  C. get router info routing-table database

  D. diagnose firewall proute list

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/latest/administration-guide/139692/routingconcepts

• Question 98:

  NGFW mode allows policy-based configuration for most inspection rules. Which security profile's configuration does not change when you enable policy-based inspection?

  A. Web filtering

  B. Antivirus

  C. Web proxy

  D. Application control

  Correct Answer: B

• Question 99:

  Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

  B. ADVPN is only supported with IKEv2.

  C. Tunnels are negotiated dynamically between spokes.

  D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

  Correct Answer: AC

• Question 100:

  An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

  A. The interface has been configured for one-arm sniffer.

  B. The interface is a member of a virtual wire pair.

  C. The operation mode is transparent.

  D. The interface is a member of a zone.

  E. Captive portal is enabled in the interface.

  Correct Answer: ABC

  https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top_VirtualWirePair.htm