Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 71:

  How do you format the FortiGate flash disk?

  A. Load a debug FortiOS image.

  B. Load the hardware test (HQIP) image.

  C. Execute the CLI command execute formatlogdisk.

  D. Select the format boot device option from the BIOS menu.

  Correct Answer: D

• Question 72:

  The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.

  What order must FortiGate use when the web filter profile has features enabled, such as safe search?

  A. DNS-based web filter and proxy-based web filter

  B. Static URL filter, FortiGuard category filter, and advanced filters

  C. Static domain filter, SSL inspection filter, and external connectors filters

  D. FortiGuard category filter and rating filter

  Correct Answer: B

  Reference: https://fortinet121.rssing.com/chan-67705148/all_p1.html

• Question 73:

  Refer to the exhibit.

  

  

  

  The exhibit contains a network diagram, firewall policies, and a firewall address object configuration.

  An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2. Remote-user2 is still able to access Webserver.

  Which two changes can the administrator make to deny Webserver access for Remote- User2? (Choose two.)

  A. Disable match-vip in the Deny policy.

  B. Set the Destination address as Deny_IP in the Allow-access policy.

  C. Enable match vip in the Deny policy.

  D. Set the Destination address as Web_server in the Deny policy.

  Correct Answer: CD

• Question 74:

  Which two statements are true about the RPF check? (Choose two.)

  A. The RPF check is run on the first sent packet of any new session.

  B. The RPF check is run on the first reply packet of any new session.

  C. The RPF check is run on the first sent and reply packet of any new session.

  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

  Correct Answer: AD

  Reference: https://www.programmersought.com/article/16383871634/

• Question 75:

  Refer to the exhibit to view the firewall policy.

  

  Which statement is correct if well-known viruses are not being blocked?

  A. The firewall policy does not apply deep content inspection.

  B. The firewall policy must be configured in proxy-based inspection mode.

  C. The action on the firewall policy must be set to deny.

  D. Web filter should be enabled on the firewall policy to complement the antivirus profile.

  Correct Answer: A

• Question 76:

  Refer to the exhibit.

  

  

  The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.

  How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

  A. If there is a full-through policy in place, users will not be prompted for authentication.

  B. Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.

  C. Authentication is enforced at a policy level; all users will be prompted for authentication.

  D. Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.

  Correct Answer: C

• Question 77:

  Which scanning technique on FortiGate can be enabled only on the CLI?

  A. Heuristics scan

  B. Trojan scan

  C. Antivirus scan

  D. Ransomware scan

  Correct Answer: A

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/567568/enabling-scanning

• Question 78:

  If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

  A. IP address

  B. Once Internet Service is selected, no other object can be added

  C. User or User Group

  D. FQDN address

  Correct Answer: B

  Reference: https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-inpolicy

• Question 79:

  An administrator has a requirement to keep an application session from timing out on port 80.

  What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

  A. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

  B. Create a new service object for HTTP service and set the session TTL to never

  C. Set the TTL value to never under config system-ttl

  D. Set the session TTL on the HTTP policy to maximum

  Correct Answer: BC

• Question 80:

  What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

  A. It limits the scanning of application traffic to the DNS protocol only.

  B. It limits the scanning of application traffic to use parent signatures only.

  C. It limits the scanning of application traffic to the browser-based technology category only.

  D. It limits the scanning of application traffic to the application category only.

  Correct Answer: C