Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 111:

  Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

  A. Firewall policy

  B. Policy rule

  C. Security policy

  D. SSL inspection and authentication policy

  Correct Answer: CD

  Reference: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/38324/ngfw-policy-based-mode

• Question 112:

  Exhibit:

  

  Refer to the exhibit to view the authentication rule configuration In this scenario, which statement is true?

  A. IP-based authentication is enabled

  B. Route-based authentication is enabled

  C. Session-based authentication is enabled.

  D. Policy-based authentication is enabled

  Correct Answer: C

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45387

• Question 113:

  Refer to the exhibit to view the application control profile.

  

  Users who use Apple FaceTime video conferences are unable to set up meetings.

  In this scenario, which statement is true?

  A. Apple FaceTime belongs to the custom monitored filter.

  B. The category of Apple FaceTime is being monitored.

  C. Apple FaceTime belongs to the custom blocked filter.

  D. The category of Apple FaceTime is being blocked.

  Correct Answer: C

• Question 114:

  Which three statements about a flow-based antivirus profile are correct? (Choose three.)

  A. IPS engine handles the process as a standalone.

  B. FortiGate buffers the whole file but transmits to the client simultaneously.

  C. If the virus is detected, the last packet is delivered to the client.

  D. Optimized performance compared to proxy-based inspection.

  E. Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.

  Correct Answer: BDE

  Reference: https://forum.fortinet.com/tm.aspx?m=192309

• Question 115:

  In which two ways can RPF checking be disabled? (Choose two )

  A. Enable anti-replay in firewall policy.

  B. Disable the RPF check at the FortiGate interface level for the source check

  C. Enable asymmetric routing.

  D. Disable strict-arc-check under system settings.

  Correct Answer: CD

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

• Question 116:

  Refer to the exhibit.

  

  The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

  A. Change password

  B. Enable restrict access to trusted hosts

  C. Change Administrator profile

  D. Enable two-factor authentication

  Correct Answer: C

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD34502

• Question 117:

  By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.

  Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

  A. set fortiguard-anycast disable

  B. set webfilter-force-off disable

  C. set webfilter-cache disable

  D. set protocol tcp

  Correct Answer: A

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48294

• Question 118:

  Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

  A. System time

  B. FortiGuaid update servers

  C. Operating mode

  D. NGFW mode

  Correct Answer: CD

  C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.

  D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide

• Question 119:

  Refer to the web filter raw logs.

  

  Based on the raw logs shown in the exhibit, which statement is correct?

  A. Social networking web filter category is configured with the action set to authenticate.

  B. The action on firewall policy ID 1 is set to warning.

  C. Access to the social networking web filter category was explicitly blocked to all users.

  D. The name of the firewall policy is all_users_web.

  Correct Answer: A

• Question 120:

  Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

  A. System event logs

  B. Forward traffic logs

  C. Local traffic logs

  D. Security logs

  Correct Answer: C

  Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/476970