Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 41:

  Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.

  

  An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.

  What is a possible reason for this?

  A. The IPS filter is missing the Protocol: HTTPS option.

  B. The HTTPS signatures have not been added to the sensor.

  C. A DoS policy should be used, instead of an IPS sensor.

  D. A DoS policy should be used, instead of an IPS sensor.

  E. The firewall policy is not using a full SSL inspection profile.

  Correct Answer: E

• Question 42:

  If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy? A User or User Group

  A. IP address

  B. No other object can be added

  C. FQDN address

  Correct Answer: B

• Question 43:

  An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

  A. Configure Source IP Pools.

  B. Configure split tunneling in tunnel mode.

  C. Configure different SSL VPN realms.

  D. Configure host check.

  Correct Answer: D

• Question 44:

  When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

  A. remote user's public IP address

  B. The public IP address of the FortiGate device.

  C. The remote user's virtual IP address.

  D. The internal IP address of the FortiGate device.

  Correct Answer: D

  Source IP seen by the remote resources is FortiGate's internal IP address and not the user's IP address

• Question 45:

  Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

  A. FortiGate points the collector agent to use a remote LDAP server.

  B. FortiGate uses the AD server as the collector agent.

  C. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

  D. FortiGate queries AD by using the LDAP to retrieve user group information.

  Correct Answer: CD

  Fortigate Infrastructure 7.0 Study Guide P.272-273 https://kb.fortinet.com/kb/documentLink.do?externalID=FD47732

• Question 46:

  If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

  A. The Services field prevents SNAT and DNAT from being combined in the same policy.

  B. The Services field is used when you need to bundle several VIPs into VIP groups.

  C. The Services field removes the requirement to create multiple VIPs for different services.

  D. The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.

  Correct Answer: C

• Question 47:

  Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

  A. The firmware image must be manually uploaded to each FortiGate.

  B. Only secondary FortiGate devices are rebooted.

  C. Uninterruptable upgrade is enabled by default.

  D. Traffic load balancing is temporally disabled while upgrading the firmware.

  Correct Answer: CD

• Question 48:

  Refer to the exhibit.

  

  According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

  A. A user

  B. A root CA

  C. A bridge CA

  D. A subordinate

  Correct Answer: A

• Question 49:

  Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

  A. By default, FortiGate uses WINS servers to resolve names.

  B. By default, the SSL VPN portal requires the installation of a client's certificate.

  C. By default, split tunneling is enabled.

  D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.

  Correct Answer: D

• Question 50:

  Refer to the exhibit.

  

  Which contains a Performance SLA configuration.

  An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

  A. Participants configured are not SD-WAN members.

  B. There may not be a static route to route the performance SLA traffic.

  C. The Ping protocol is not supported for the public servers that are configured.

  D. You need to turn on the Enable probe packets switch.

  Correct Answer: D

  Reference:https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performance-slalinkmonitoring