Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 51:

  Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

  A. Subject Key Identifier value

  B. SMMIE Capabilities value

  C. Subject value

  D. Subject Alternative Name value

  Correct Answer: A

• Question 52:

  Refer to the exhibit.

  

  The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses. How does FortiGate process the traffic sent to http://www.fortinet.com?

  A. Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.

  B. Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.

  C. Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.

  D. Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.

  Correct Answer: D

• Question 53:

  Which two statements are true when FortiGate is in transparent mode? (Choose two.)

  A. By default, all interfaces are part of the same broadcast domain.

  B. The existing network IP schema must be changed when installing a transparent mode.

  C. Static routes are required to allow traffic to the next hop.

  D. FortiGate forwards frames without changing the MAC address.

  Correct Answer: AD

  Reference: https://kb.fortinet.com/kb/viewAttachment.do? attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdfanddo cumentID=FD33113

• Question 54:

  To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

  A. FortiManager

  B. Root FortiGate

  C. FortiAnalyzer

  D. Downstream FortiGate

  Correct Answer: B

• Question 55:

  View the exhibit.

  

  A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

  A. Addicting.Games is allowed based on the Application Overrides configuration.

  B. Addicting.Games is blocked on the Filter Overrides configuration.

  C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

  D. Addcting.Games is allowed based on the Categories configuration.

  Correct Answer: A

• Question 56:

  View the exhibit.

  

  Which of the following statements are correct? (Choose two.)

  A. This setup requires at least two firewall policies with the action set to IPsec.

  B. Dead peer detection must be disabled to support this type of IPsec setup.

  C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

  D. This is a redundant IPsec setup.

  Correct Answer: CD

• Question 57:

  Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

  A. To remove the NAT operation.

  B. To generate logs

  C. To finish any inspection operations.

  D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

  Correct Answer: D

• Question 58:

  Examine this PAC file configuration.

  

  Which of the following statements are true? (Choose two.)

  A. Browsers can be configured to retrieve this PAC file from the FortiGate.

  B. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.

  C. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.

  D. Any web request fortinet.com is allowed to bypass the proxy.

  Correct Answer: AD

• Question 59:

  A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

  Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

  A. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

  B. The two VLAN sub interfaces must have different VLAN IDs.

  C. The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

  D. The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

  Correct Answer: B

  FortiGate_Infrastructure_6.0_Study_Guide_v2-Online.pdf ?gt; page 147 "Multiple VLANs can coexist in the same physical interface, provide they have different VLAN ID"

• Question 60:

  Refer to the exhibit.

  

  In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.

  What should the administrator do next to troubleshoot the problem?

  A. Run a sniffer on the web server.

  B. Capture the traffic using an external sniffer connected to port1.

  C. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"

  D. Execute a debug flow.

  Correct Answer: D