Fortinet NSE4_FGT-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.0 Online Questions & Answers

• Question 111:

  Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

  A. Denial of Service
  B. Web application firewall
  C. Antivirus
  D. Application control
  B. Web application firewall

  ---

  Reference: https://docs.fortinet.com/document/fortiweb/6.3.3/administration-guide/60895/introduction

• Question 112:

  Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)

  A. FG-traffic
  B. Mgmt
  C. FG-Mgmt
  D. Root
  A. FG-traffic
  D. Root

  ---

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/758820/split-task-vdom-mode

• Question 113:

  View the exhibit.

  

  A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

  A. Addicting.Games is allowed based on the Application Overrides configuration.
  B. Addicting.Games is blocked on the Filter Overrides configuration.
  C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
  D. Addcting.Games is allowed based on the Categories configuration.
  A. Addicting.Games is allowed based on the Application Overrides configuration.

• Question 114:

  In an explicit proxy setup, where is the authentication method and database configured?

  A. Proxy Policy
  B. Authentication Rule
  C. Firewall Policy
  D. Authentication scheme
  D. Authentication scheme

• Question 115:

  Refer to the exhibits. Exhibit A.

  

  Exhibit B.

  

  An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW). What must the administrator do to synchronize the address object?

  A. Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.
  B. Change the csf setting on ISFW (downstream) to sec configuracion-sync local.
  C. Change the csf setting on Local-FortiGate (root) to sec fabric-objecc-unificacion defaulc.
  D. Change the csf setting on ISFW (downstream) to sec fabric-objecc-unificacion defaulc.
  A. Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.

  ---

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43820

• Question 116:

  Refer to the web filter raw logs.

  

  Based on the raw logs shown in the exhibit, which statement is correct?

  A. Social networking web filter category is configured with the action set to authenticate.
  B. The action on firewall policy ID 1 is set to warning.
  C. Access to the social networking web filter category was explicitly blocked to all users.
  D. The name of the firewall policy is all_users_web.
  A. Social networking web filter category is configured with the action set to authenticate.

• Question 117:

  What is the primary FortiGate election process when the HA override setting is disabled?

  A. Connected monitored ports > System uptime > Priority > FortiGate Serial number
  B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number
  C. Connected monitored ports > Priority > HA uptime > FortiGate Serial number
  D. Connected monitored ports > Priority > System uptime > FortiGate Serial number
  B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number

  ---

  Reference: http://myitmicroblog.blogspot.com/2018/11/what-should-you-know-about-ha-override.html

• Question 118:

  Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

  A. Source defined as Internet Services in the firewall policy.
  B. Destination defined as Internet Services in the firewall policy.
  C. Highest to lowest priority defined in the firewall policy.
  D. Services defined in the firewall policy.
  E. Lowest to highest policy ID number.
  A. Source defined as Internet Services in the firewall policy.
  B. Destination defined as Internet Services in the firewall policy.
  D. Services defined in the firewall policy.

  ---

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD47435

• Question 119:

  Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

  A. This is known as many-to-one NAT.
  B. Source IP is translated to the outgoing interface IP.
  C. Connections are tracked using source port and source MAC address.
  D. Port address translation is not used.
  B. Source IP is translated to the outgoing interface IP.
  D. Port address translation is not used.

• Question 120:

  What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

  A. Traffic to botnetservers
  B. Traffic to inappropriate web sites
  C. Server information disclosure attacks
  D. Credit card data leaks
  E. SQL injection attacks
  C. Server information disclosure attacks
  D. Credit card data leaks
  E. SQL injection attacks