Fortinet Fortinet Certifications NSE4_FGT-7.0 Questions & Answers

• Question 81:

  Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

  A. Log downloads from the GUI are limited to the current filter view

  B. Log backups from the CLI cannot be restored to another FortiGate.

  C. Log backups from the CLI can be configured to upload to FTP as a scheduled time

  D. Log downloads from the GUI are stored as LZ4 compressed files.

  Correct Answer: AB

• Question 82:

  Refer to the exhibit.

  

  A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the preshared key on both FortiGate devices to make sure they match.

  Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

  A. On HQ-FortiGate, set IKE mode to Main (ID protection).

  B. On both FortiGate devices, set Dead Peer Detection to On Demand.

  C. On HQ-FortiGate, disable Diffie-Helman group 2.

  D. On Remote-FortiGate, set port2 as Interface.

  Correct Answer: AD

• Question 83:

  If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

  A. A CRL

  B. A person

  C. A subordinate CA

  D. A root CA

  Correct Answer: D

• Question 84:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.

  B. To dynamically change phase 1 negotiation mode aggressive mode.

  C. To encapsulation ESP packets in UDP packets using port 4500.

  D. To force a new DH exchange with each phase 2 rekey.

  Correct Answer: AC

• Question 85:

  Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

  

  When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

  A. SMTP.Login.Brute.Force

  B. IMAP.Login.brute.Force

  C. ip_src_session

  D. Location: server Protocol: SMTP

  Correct Answer: B

• Question 86:

  An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.

  What must an administrator do to achieve this objective?

  A. The administrator can register the same FortiToken on more than one FortiGate.

  B. The administrator must use a FortiAuthenticator device.

  C. The administrator can use a third-party radius OTP server.

  D. The administrator must use the user self-registration server.

  Correct Answer: B

• Question 87:

  In an explicit proxy setup, where is the authentication method and database configured?

  A. Proxy Policy

  B. Authentication Rule

  C. Firewall Policy

  D. Authentication scheme

  Correct Answer: D

• Question 88:

  An administrator must disable RPF check to investigate an issue.

  Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

  A. Enable asymmetric routing, so the RPF check will be bypassed.

  B. Disable the RPF check at the FortiGate interface level for the source check.

  C. Disable the RPF check at the FortiGate interface level for the reply check.

  D. Enable asymmetric routing at the interface level.

  Correct Answer: B

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

• Question 89:

  Which two statements ate true about the Security Fabric rating? (Choose two.)

  A. It provides executive summaries of the four largest areas of security focus.

  B. Many of the security issues can be fixed immediately by clicking Apply where available.

  C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

  D. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

  Correct Answer: BC

  Reference: https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/292634/security-rating

• Question 90:

  Refer to the exhibit.

  

  The exhibits show a network diagram and the explicit web proxy configuration.

  In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?

  A. `host 192.168.0.2 and port 8080'

  B. `host 10.0.0.50 and port 80'

  C. `host 192.168.0.1 and port 80'

  D. `host 10.0.0.50 and port 8080'

  Correct Answer: A