Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 21:

  An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

  A. A phase 2 configuration is not required.

  B. This VPN cannot be used as part of a hub-and-spoke topology.

  C. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

  D. The IPsec firewall policies must be placed at the top of the list.

  Correct Answer: C

  In a route-based configuration, FortiGate automatically adds a virtual interface eith the VPN name (Infrastructure Study Guide, 206)

• Question 22:

  Which statement about the IP authentication header (AH) used by IPsec is true?

  A. AH does not provide any data integrity or encryption.

  B. AH does not support perfect forward secrecy.

  C. AH provides data integrity bur no encryption.

  D. AH provides strong data integrity but weak encryption.

  Correct Answer: C

• Question 23:

  Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

  A. Denial of Service

  B. Web application firewall

  C. Antivirus

  D. Application control

  Correct Answer: B

  Reference: https://docs.fortinet.com/document/fortiweb/6.3.3/administration-guide/60895/introduction

• Question 24:

  What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

  A. FortiGate automatically negotiates different local and remote addresses with the remote peer.

  B. FortiGate automatically negotiates a new security association after the existing security association expires.

  C. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

  D. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

  Correct Answer: D

  https://kb.fortinet.com/kb/documentLink.do?externalID=12069

• Question 25:

  Which of the following statements about central NAT are true? (Choose two.)

  A. IP tool references must be removed from existing firewall policies before enabling central NAT.

  B. Central NAT can be enabled or disabled from the CLI only.

  C. Source NAT, using central NAT, requires at least one central SNAT policy.

  D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

  Correct Answer: AB

• Question 26:

  Which statement regarding the firewall policy authentication timeout is true?

  A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

  B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

  C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

  D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

  Correct Answer: A

• Question 27:

  An administrator is running the following sniffer command:

  

  Which three pieces of Information will be Included in me sniffer output? {Choose three.)

  A. Interface name

  B. Packet payload

  C. Ethernet header

  D. IP header

  E. Application header

  Correct Answer: ABD

• Question 28:

  Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

  A. DNS

  B. ping

  C. udp-echo

  D. TWAMP

  Correct Answer: CD

• Question 29:

  Which three statements are true regarding session-based authentication? (Choose three.)

  A. HTTP sessions are treated as a single user.

  B. IP sessions from the same source IP address are treated as a single user.

  C. It can differentiate among multiple clients behind the same source IP address.

  D. It requires more resources.

  E. It is not recommended if multiple users are behind the source NAT

  Correct Answer: ACD

• Question 30:

  Refer to the exhibit, which contains a radius server configuration.

  

  An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option. What will be the impact of using Include in every user group option in a RADIUS configuration?

  A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

  B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

  C. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

  D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

  Correct Answer: A

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/634373/authentication-servers