Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 31:

  Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

  A. Fabric Coverage

  B. Automated Response

  C. Security Posture

  D. Optimization

  Correct Answer: C

  Reference: https://www.fortinet.com/content/dam/fortinet/assets/support/fortinet-recommended-securitybestpractices.pdf

• Question 32:

  Refer to the FortiGuard connection debug output.

  

  Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

  A. A local FortiManager is one of the servers FortiGate communicates with.

  B. One server was contacted to retrieve the contract information.

  C. There is at least one server that lost packets consecutively.

  D. FortiGate is using default FortiGuard communication settings.

  Correct Answer: BD

• Question 33:

  Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

  A. The subject field in the server certificate

  B. The serial number in the server certificate

  C. The server name indication (SNI) extension in the client hello message

  D. The subject alternative name (SAN) field in the server certificate

  E. The host field in the HTTP header

  Correct Answer: ACD

  Reference: https://checkthefirewall.com/blogs/fortinet/ssl-inspection

• Question 34:

  What is the primary FortiGate election process when the HA override setting is disabled?

  A. Connected monitored ports > System uptime > Priority > FortiGate Serial number

  B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number

  C. Connected monitored ports > Priority > HA uptime > FortiGate Serial number

  D. Connected monitored ports > Priority > System uptime > FortiGate Serial number

  Correct Answer: B

  Reference: http://myitmicroblog.blogspot.com/2018/11/what-should-you-know-about-ha-override.html

• Question 35:

  When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

  A. Log ID

  B. Universally Unique Identifier

  C. Policy ID

  D. Sequence ID

  Correct Answer: B

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/554066/firewall-policies

• Question 36:

  Examine this output from a debug flow:

  

  Why did the FortiGate drop the packet?

  A. The next-hop IP address is unreachable.

  B. It failed the RPF check.

  C. It matched an explicitly configured firewall policy with the action DENY.

  D. It matched the default implicit firewall policy.

  Correct Answer: D

  https://kb.fortinet.com/kb/documentLink.do?externalID=13900

• Question 37:

  Which of statement is true about SSL VPN web mode?

  A. The tunnel is up while the client is connected.

  B. It supports a limited number of protocols.

  C. The external network application sends data through the VPN.

  D. It assigns a virtual IP address to the client.

  Correct Answer: B

  FortiGate_Security_6.4 page 575 - Web mode requires only a web browser, but supports a limited number of protocols.

• Question 38:

  Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

  A. Root VDOM

  B. FG-traffic VDOM

  C. Customer VDOM

  D. Global VDOM

  Correct Answer: A

• Question 39:

  View the exhibit:

  

  Which the FortiGate handle web proxy traffic rue? (Choose two.)

  A. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

  B. port-VLAN1 is the native VLAN for the port1 physical interface.

  C. C. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

  D. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

  Correct Answer: AC

• Question 40:

  Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

  A. hard-timeout

  B. auth-on-demand

  C. soft-timeout

  D. new-session

  E. Idle-timeout

  Correct Answer: ADE

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221