Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 161:

  Refer to the exhibits. Exhibit A.

  

  Exhibit B.

  

  An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

  What must the administrator do to synchronize the address object?

  A. Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.

  B. Change the csf setting on ISFW (downstream) to sec configuracion-sync local.

  C. Change the csf setting on Local-FortiGate (root) to sec fabric-objecc-unificacion defaulc.

  D. Change the csf setting on ISFW (downstream) to sec fabric-objecc-unificacion defaulc.

  Correct Answer: A

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43820

• Question 162:

  Which two statements are correct about NGFW Policy-based mode? (Choose two.)

  A. NGFW policy-based mode does not require the use of central source NAT policy

  B. NGFW policy-based mode can only be applied globally and not on individual VDOMs

  C. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

  D. NGFW policy-based mode policies support only flow inspection

  Correct Answer: CD

• Question 163:

  An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

  Which DPD mode on FortiGate will meet the above requirement?

  A. Disabled

  B. On Demand

  C. Enabled

  D. On Idle

  Correct Answer: D

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD40813

• Question 164:

  Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

  A. The keyUsage extension must be set to keyCertSign.

  B. The common name on the subject field must use a wildcard name.

  C. The issuer must be a public CA.

  D. The CA extension must be set to TRUE.

  Correct Answer: AD

  Reference: https://www.reddit.com/r/fortinet/comments/c7j6jg/recommended_ssl_cert/

• Question 165:

  Refer to the exhibits.

  

  

  The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.

  Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

  Which part of the policy configuration must you change to resolve the issue?

  A. The SSL inspection needs to be a deep content inspection.

  B. Force access to Facebook using the HTTP service.

  C. Additional application signatures are required to add to the security policy.

  D. Add Facebook in the URL category in the security policy.

  Correct Answer: A

  The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.

• Question 166:

  Which two statements are correct about SLA targets? (Choose two.)

  A. You can configure only two SLA targets per one Performance SLA.

  B. SLA targets are optional.

  C. SLA targets are required for SD-WAN rules with a Best Quality strategy.

  D. SLA targets are used only when referenced by an SD-WAN rule.

  Correct Answer: BD

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/382233/performance-sla-sla-targets

• Question 167:

  Refer to the exhibit.

  

  The exhibit shows the IPS sensor configuration.

  If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

  A. The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.

  B. The sensor will block all attacks aimed at Windows servers.

  C. The sensor will reset all connections that match these signatures.

  D. The sensor will gather a packet log for all matched traffic.

  Correct Answer: AB

• Question 168:

  Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

  A. The security actions applied on the web applications will also be explicitly applied on the third-party websites.

  B. The application signature database inspects traffic only from the original web application server.

  C. FortiGuard maintains only one signature of each web application that is unique.

  D. FortiGate can inspect sub-application traffic regardless where it was originated.

  Correct Answer: D

  Reference: https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPXAdminGuide/300_System/303d_FortiGuard.htm

• Question 169:

  An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.

  Which subnet must the administrator configure for the local quick mode selector for site B?

  A. 192.168.1.0/24

  B. 192.168.0.0/24

  C. 192.168.2.0/24

  D. 192.168.3.0/24

  Correct Answer: C

• Question 170:

  Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

  A. get system status

  B. get system performance status

  C. diagnose sys top

  D. get system arp

  Correct Answer: D

  "If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look at the ARP table."