Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 101:

  Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

  A. Source defined as Internet Services in the firewall policy.

  B. Destination defined as Internet Services in the firewall policy.

  C. Highest to lowest priority defined in the firewall policy.

  D. Services defined in the firewall policy.

  E. Lowest to highest policy ID number.

  Correct Answer: ABD

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD47435

• Question 102:

  Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

  A. diagnose wad session list

  B. diagnose wad session list | grep hook-preandandhook-out

  C. diagnose wad session list | grep hook=preandandhook=out

  D. diagnose wad session list | grep "hook=pre"and"hook=out"

  Correct Answer: A

• Question 103:

  An administrator needs to increase network bandwidth and provide redundancy.

  What interface type must the administrator select to bind multiple FortiGate interfaces?

  A. VLAN interface

  B. Software Switch interface

  C. Aggregate interface

  D. Redundant interface

  Correct Answer: C

  Reference: https://forum.fortinet.com/tm.aspx?m=120324

• Question 104:

  Which two statements are true about collector agent standard access mode? (Choose two.)

  A. Standard mode uses Windows convention-NetBios: Domain\Username.

  B. Standard mode security profiles apply to organizational units (OU).

  C. Standard mode security profiles apply to user groups.

  D. Standard access mode supports nested groups.

  Correct Answer: AC

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/482937/agent-based-fsso

• Question 105:

  Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)

  A. FG-traffic

  B. Mgmt

  C. FG-Mgmt

  D. Root

  Correct Answer: AD

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/758820/split-task-vdom-mode

• Question 106:

  Refer to the exhibit, which contains a session diagnostic output.

  

  Which statement is true about the session diagnostic output?

  A. The session is a UDP unidirectional state.

  B. The session is in TCP ESTABLISHED state.

  C. The session is a bidirectional UDP connection.

  D. The session is a bidirectional TCP connection.

  Correct Answer: C

• Question 107:

  Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

  A. diagnose sys top

  B. execute ping

  C. execute traceroute

  D. diagnose sniffer packet any

  E. get system arp

  Correct Answer: BCD

• Question 108:

  Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)

  A. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password

  B. FortiGate supports pre-shared key and signature as authentication methods.

  C. Enabling XAuth results in a faster authentication because fewer packets are exchanged.

  D. A certificate is not required on the remote peer when you set the signature as the authentication method.

  Correct Answer: AB

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/913287/ipsec-vpn-authenticatingaremote-fortigate-peer-with-a-pre-shared-key

• Question 109:

  Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

  A. Warning

  B. Exempt

  C. Allow

  D. Learn

  Correct Answer: AC

• Question 110:

  Which of the following statements correctly describes FortiGates route lookup behavior when searching for a suitable gateway? (Choose two)

  A. Lookup is done on the first packet from the session originator

  B. Lookup is done on the last packet sent from the responder

  C. Lookup is done on every packet, regardless of direction

  D. Lookup is done on the trust reply packet from the responder

  Correct Answer: AD