Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 11:

  Which feature in the Security Fabric takes one or more actions based on event triggers?

  A. Fabric Connectors

  B. Automation Stitches

  C. Security Rating

  D. Logical Topology

  Correct Answer: B

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/286973/fortinet-security-fabric

• Question 12:

  Refer to the exhibit.

  

  

  

  The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

  The WAN (port1) interface has the IP address 10.200.1.1/24.

  The LAN (port3) interface has the IP address 10.0.1.254/24.

  A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

  Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.

  Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP

  address of Remote-FortiGate (10.200.3.1)?

  A. 10.200.1.149

  B. 10.200.1.1

  C. 10.200.1.49

  D. 10.200.1.99

  Correct Answer: D

• Question 13:

  Which two types of traffic are managed only by the management VDOM? (Choose two.)

  A. FortiGuard web filter queries

  B. PKI

  C. Traffic shaping

  D. DNS

  Correct Answer: AD

• Question 14:

  Which two statements are correct about a software switch on FortiGate? (Choose two.)

  A. It can be configured only when FortiGate is operating in NAT mode

  B. Can act as a Layer 2 switch as well as a Layer 3 router

  C. All interfaces in the software switch share the same IP address

  D. It can group only physical interfaces

  Correct Answer: AC

• Question 15:

  Examine the two static routes shown in the exhibit, then answer the following question.

  

  Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

  A. FortiGate will load balance all traffic across both routes.

  B. FortiGate will use the port1 route as the primary candidate.

  C. FortiGate will route twice as much traffic to the port2 route

  D. FortiGate will only actuate the port1 route in the routing table

  Correct Answer: B

  "If multiple static routes have the same distance, they are all active; however, only the one with the lowest priority is considered the best path."

• Question 16:

  Examine the exhibit, which contains a virtual IP and firewall policy configuration.

  

  

  The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.

  The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

  Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

  A. 10.200.1.10

  B. Any available IP address in the WAN (port1) subnet 10.200.1.0/24

  C. 10.200.1.1

  D. 10.0.1.254

  Correct Answer: A

  https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Objects/Virtual% 20IPs.htm

• Question 17:

  Refer to the exhibit.

  

  Based on the raw log, which two statements are correct? (Choose two.)

  A. Traffic is blocked because Action is set to DENY in the firewall policy.

  B. Traffic belongs to the root VDOM.

  C. This is a security log.

  D. Log severity is set to error on FortiGate.

  Correct Answer: AC

• Question 18:

  FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.

  Which two other security profiles can you apply to the security policy? (Choose two.)

  A. Antivirus scanning

  B. File filter

  C. DNS filter

  D. Intrusion prevention

  Correct Answer: AD

• Question 19:

  What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

  A. Traffic to botnetservers

  B. Traffic to inappropriate web sites

  C. Server information disclosure attacks

  D. Credit card data leaks

  E. SQL injection attacks

  Correct Answer: CDE

• Question 20:

  Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

  A. Web filter in flow-based inspection

  B. Antivirus in flow-based inspection

  C. DNS filter

  D. Web application firewall

  E. Application control

  Correct Answer: ABE