Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 151:

  Refer to the exhibit.

  

  The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

  The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem.

  With this configuration, which statement is true?

  A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

  B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.

  C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.

  D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.

  Correct Answer: A

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46542

• Question 152:

  When configuring a firewall virtual wire pair policy, which following statement is true?

  A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

  B. Only a single virtual wire pair can be included in each policy.

  C. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

  D. Exactly two virtual wire pairs need to be included in each policy.

  Correct Answer: A

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48690

• Question 153:

  Refer to the exhibit.

  

  Which contains a session list output. Based on the information shown in the exhibit, which statement is

  true?

  A. Destination NAT is disabled in the firewall policy.

  B. One-to-one NAT IP pool is used in the firewall policy.

  C. Overload NAT IP pool is used in the firewall policy.

  D. Port block allocation IP pool is used in the firewall policy.

  Correct Answer: B

  FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.

• Question 154:

  Refer to the exhibit.

  

  Which contains a session diagnostic output. Which statement is true about the session diagnostic output?

  A. The session is in SYN_SENT state.

  B. The session is in FIN_ACK state.

  C. The session is in FTN_WAIT state.

  D. The session is in ESTABLISHED state.

  Correct Answer: A

  Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

• Question 155:

  Refer to the exhibit.

  

  Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

  A. Traffic between port2 and port2-vlan1 is allowed by default.

  B. port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

  C. port1 is a native VLAN.

  D. port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

  Correct Answer: CD

  https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOMinterface/ta-p/197640?externalID=FD31639 https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883

• Question 156:

  Which two statements are true about the FGCP protocol? (Choose two.)

  A. Not used when FortiGate is in Transparent mode

  B. Elects the primary FortiGate device

  C. Runs only over the heartbeat links

  D. Is used to discover FortiGate devices in different HA groups

  Correct Answer: BC

  Reference: https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/564712/fgcp-fortigateclustering-protocol

• Question 157:

  Refer to the exhibit.

  

  A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.

  Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

  A. On HQ-FortiGate, enable Auto-negotiate.

  B. On Remote-FortiGate, set Seconds to 43200.

  C. On HQ-FortiGate, enable Diffie-Hellman Group 2.

  D. On HQ-FortiGate, set Encryption to AES256.

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/168495

  Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.

• Question 158:

  Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

  A. To allow for out-of-order packets that could arrive after the FIN/ACK packets

  B. To finish any inspection operations

  C. To remove the NAT operation

  D. To generate logs

  Correct Answer: A

  TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an

  entry in the firewall session table.

• Question 159:

  Refer to the exhibits.

  

  Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

  A. Administrators can access FortiGate only through the console port.

  B. FortiGate has entered conserve mode.

  C. FortiGate will start sending all files to FortiSandbox for inspection.

  D. Administrators cannot change the configuration.

  Correct Answer: BD

  Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/

• Question 160:

  How does FortiGate act when using SSL VPN in web mode?

  A. FortiGate acts as an FDS server.

  B. FortiGate acts as an HTTP reverse proxy.

  C. FortiGate acts as DNS server.

  D. FortiGate acts as router.

  Correct Answer: B

  Reference: https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigatesslvpn-40-mr3.pdf