Fortinet NSE4_FGT-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.0 Online Questions & Answers

• Question 141:

  Which two statements ate true about the Security Fabric rating? (Choose two.)

  A. It provides executive summaries of the four largest areas of security focus.
  B. Many of the security issues can be fixed immediately by clicking Apply where available.
  C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
  D. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
  B. Many of the security issues can be fixed immediately by clicking Apply where available.
  C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

  ---

  Reference: https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/292634/security-rating

• Question 142:

  Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

  A. DNS
  B. ping
  C. udp-echo
  D. TWAMP
  C. udp-echo
  D. TWAMP

• Question 143:

  Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

  A. Web filter in flow-based inspection
  B. Antivirus in flow-based inspection
  C. DNS filter
  D. Web application firewall
  E. Application control
  A. Web filter in flow-based inspection
  B. Antivirus in flow-based inspection
  E. Application control

• Question 144:

  Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

  A. The public key of the web server certificate must be installed on the browser.
  B. The web-server certificate must be installed on the browser.
  C. The CA certificate that signed the web-server certificate must be installed on the browser.
  D. The private key of the CA certificate that signed the browser certificate must be installed on the browser.
  C. The CA certificate that signed the web-server certificate must be installed on the browser.

• Question 145:

  Refer to the exhibits.

  

  The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.

  Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

  Which part of the policy configuration must you change to resolve the issue?

  A. The SSL inspection needs to be a deep content inspection.
  B. Force access to Facebook using the HTTP service.
  C. Additional application signatures are required to add to the security policy.
  D. Add Facebook in the URL category in the security policy.
  A. The SSL inspection needs to be a deep content inspection.

  ---

  The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.

• Question 146:

  How do you format the FortiGate flash disk?

  A. Load a debug FortiOS image.
  B. Load the hardware test (HQIP) image.
  C. Execute the CLI command execute formatlogdisk.
  D. Select the format boot device option from the BIOS menu.
  D. Select the format boot device option from the BIOS menu.

• Question 147:

  Which two statements are true about the RPF check? (Choose two.)

  A. The RPF check is run on the first sent packet of any new session.
  B. The RPF check is run on the first reply packet of any new session.
  C. The RPF check is run on the first sent and reply packet of any new session.
  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.
  A. The RPF check is run on the first sent packet of any new session.
  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

  ---

  Reference: https://www.programmersought.com/article/16383871634/

• Question 148:

  When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

  A. remote user's public IP address
  B. The public IP address of the FortiGate device.
  C. The remote user's virtual IP address.
  D. The internal IP address of the FortiGate device.
  D. The internal IP address of the FortiGate device.

  ---

  Source IP seen by the remote resources is FortiGate's internal IP address and not the user's IP address

• Question 149:

  Refer to the exhibit.

  

  The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

  A. If there is a full-through policy in place, users will not be prompted for authentication.
  B. Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.
  C. Authentication is enforced at a policy level; all users will be prompted for authentication.
  D. Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.
  C. Authentication is enforced at a policy level; all users will be prompted for authentication.

• Question 150:

  Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

  

  When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

  A. SMTP.Login.Brute.Force
  B. IMAP.Login.brute.Force
  C. ip_src_session
  D. Location: server Protocol: SMTP
  B. IMAP.Login.brute.Force