Fortinet NSE4_FGT-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.0 Online Questions & Answers

• Question 51:

  Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

  A. Heartbeat interfaces have virtual IP addresses that are manually assigned.
  B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
  C. Virtual IP addresses are used to distinguish between cluster members.
  D. The primary device in the cluster is always assigned IP address 169.254.0.1.
  B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
  D. The primary device in the cluster is always assigned IP address 169.254.0.1.

• Question 52:

  An administrator is running the following sniffer command:

  

  Which three pieces of Information will be Included in me sniffer output? {Choose three.)

  A. Interface name
  B. Packet payload
  C. Ethernet header
  D. IP header
  E. Application header
  A. Interface name
  B. Packet payload
  D. IP header

• Question 53:

  Examine the network diagram shown in the exhibit, then answer the following question:

  

  Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?

  A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
  B. 0.0.0.0/0 [20/0] via 10.4.200.2, port2
  C. 10.4.200.0/30 is directly connected, port2
  D. 172.16.32.0/24 is directly connected, port1
  D. 172.16.32.0/24 is directly connected, port1

• Question 54:

  What inspection mode does FortiGate use if it is configured as a policy-based next- generation firewall (NGFW)?

  A. Full Content inspection
  B. Proxy-based inspection
  C. Certificate inspection
  D. Flow-based inspection
  D. Flow-based inspection

• Question 55:

  Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

  A. Root VDOM
  B. FG-traffic VDOM
  C. Customer VDOM
  D. Global VDOM
  A. Root VDOM

• Question 56:

  A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors. What is the reason for the certificate warning errors?

  A. The browser requires a software update.
  B. FortiGate does not support full SSL inspection when web filtering is enabled.
  C. The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.
  D. There are network connectivity issues.
  C. The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.

  ---

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41394

• Question 57:

  Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

  A. Proxy-based inspection
  B. Certificate inspection
  C. Flow-based inspection
  D. Full Content inspection
  A. Proxy-based inspection
  C. Flow-based inspection

• Question 58:

  Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

  A. To allow for out-of-order packets that could arrive after the FIN/ACK packets
  B. To finish any inspection operations
  C. To remove the NAT operation
  D. To generate logs
  A. To allow for out-of-order packets that could arrive after the FIN/ACK packets

  ---

  TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.

• Question 59:

  An administrator wants to configure timeouts for users. Regardless of the userTMs behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should be configured on FortiGate?

  A. auth-on-demand
  B. soft-timeout
  C. idle-timeout
  D. new-session
  E. hard-timeout
  E. hard-timeout

  ---

  Reference:

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221#:~:text=Hard%20timeout %3A%20User%20entry%20will,(5%20minutes%20by%20default)

• Question 60:

  Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

  A. The firmware image must be manually uploaded to each FortiGate.
  B. Only secondary FortiGate devices are rebooted.
  C. Uninterruptable upgrade is enabled by default.
  D. Traffic load balancing is temporally disabled while upgrading the firmware.
  C. Uninterruptable upgrade is enabled by default.
  D. Traffic load balancing is temporally disabled while upgrading the firmware.