Fortinet NSE4_FGT-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.0 Online Questions & Answers

• Question 81:

  Which statement about the IP authentication header (AH) used by IPsec is true?

  A. AH does not provide any data integrity or encryption.
  B. AH does not support perfect forward secrecy.
  C. AH provides data integrity bur no encryption.
  D. AH provides strong data integrity but weak encryption.
  C. AH provides data integrity bur no encryption.

• Question 82:

  Examine this FortiGate configuration:

  

  How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

  A. It always authorizes the traffic without requiring authentication.
  B. It drops the traffic.
  C. It authenticates the traffic using the authentication scheme SCHEME2.
  D. It authenticates the traffic using the authentication scheme SCHEME1.
  D. It authenticates the traffic using the authentication scheme SCHEME1.

  ---

  "What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting"

• Question 83:

  If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy? A User or User Group

  A. IP address
  B. No other object can be added
  C. FQDN address
  B. No other object can be added

• Question 84:

  When configuring a firewall virtual wire pair policy, which following statement is true?

  A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.
  B. Only a single virtual wire pair can be included in each policy.
  C. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.
  D. Exactly two virtual wire pairs need to be included in each policy.
  A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

  ---

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48690

• Question 85:

  Refer to the exhibit.

  

  Examine the intrusion prevention system (IPS) diagnostic command.

  Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

  A. The IPS engine was inspecting high volume of traffic.
  B. The IPS engine was unable to prevent an intrusion attack.
  C. The IPS engine was blocking all traffic.
  D. The IPS engine will continue to run in a normal state.
  A. The IPS engine was inspecting high volume of traffic.

  ---

  Reference: https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage

• Question 86:

  Refer to the exhibit, which contains a session diagnostic output.

  

  Which statement is true about the session diagnostic output?

  A. The session is a UDP unidirectional state.
  B. The session is in TCP ESTABLISHED state.
  C. The session is a bidirectional UDP connection.
  D. The session is a bidirectional TCP connection.
  C. The session is a bidirectional UDP connection.

• Question 87:

  Examine this output from a debug flow:

  

  Why did the FortiGate drop the packet?

  A. The next-hop IP address is unreachable.
  B. It failed the RPF check.
  C. It matched an explicitly configured firewall policy with the action DENY.
  D. It matched the default implicit firewall policy.
  D. It matched the default implicit firewall policy.

  ---

  https://kb.fortinet.com/kb/documentLink.do?externalID=13900

• Question 88:

  Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

  A. System event logs
  B. Forward traffic logs
  C. Local traffic logs
  D. Security logs
  C. Local traffic logs

  ---

  Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/476970

• Question 89:

  An administrator needs to increase network bandwidth and provide redundancy.

  What interface type must the administrator select to bind multiple FortiGate interfaces?

  A. VLAN interface
  B. Software Switch interface
  C. Aggregate interface
  D. Redundant interface
  C. Aggregate interface

  ---

  Reference: https://forum.fortinet.com/tm.aspx?m=120324

• Question 90:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.
  B. To dynamically change phase 1 negotiation mode aggressive mode.
  C. To encapsulation ESP packets in UDP packets using port 4500.
  D. To force a new DH exchange with each phase 2 rekey.
  A. To detect intermediary NAT devices in the tunnel path.
  C. To encapsulation ESP packets in UDP packets using port 4500.