Fortinet NSE4_FGT-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.2 Online Questions & Answers

• Question 1:

  An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

  A. Configure Source IP Pools.
  B. Configure split tunneling in tunnel mode.
  C. Configure different SSL VPN realms.
  D. Configure host check .
  D. Configure host check .

• Question 2:

  In which two ways can RPF checking be disabled? (Choose two )

  A. Enable anti-replay in firewall policy.
  B. Disable the RPF check at the FortiGate interface level for the source check
  C. Enable asymmetric routing.
  D. Disable strict-arc-check under system settings.
  C. Enable asymmetric routing.
  D. Disable strict-arc-check under system settings.

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

• Question 3:

  Which two statements are true about the FGCP protocol? (Choose two.)

  A. FGCP elects the primary FortiGate device.
  B. FGCP is not used when FortiGate is in transparent mode.
  C. FGCP runs only over the heartbeat links.
  D. FGCP is used to discover FortiGate devices in different HA groups.
  A. FGCP elects the primary FortiGate device.
  C. FGCP runs only over the heartbeat links.

  ---

  Explanation/Reference:

  The FGCP (FortiGate Clustering Protocol) is a protocol that is used to manage high availability (HA) clusters of FortiGate devices. It performs several functions, including the following:

  FGCP elects the primary FortiGate device: In an HA cluster, FGCP is used to determine which FortiGate device will be the primary device, responsible for handling traffic and making decisions about what to allow or block. FGCP uses a

  variety of factors, such as the device's priority, to determine which device should be the primary.

  FGCP runs only over the heartbeat links: FGCP communicates between FortiGate devices in the HA cluster using the heartbeat links. These are dedicated links that are used to exchange status and control information between the devices.

  FGCP does not run over other types of links, such as data links.

  Reference:

  https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/564712/fgcp-fortigate-clustering-protocol

  FortiGate Infrastructure 7.2 Study Guide (p.292): "FortiGate HA uses the Fortinet- proprietary FortiGate Clustering Protocol (FGCP) to discover members, elect the primary FortiGate, synchronize data among members, and monitor the health

  of members. To discover and monitor members, the members broadcast heartbeat packets over all configured heartbeat interfaces."

• Question 4:

  Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

  A. Shut down/reboot a downstream FortiGate device.
  B. Disable FortiAnalyzer logging for a downstream FortiGate device.
  C. Log in to a downstream FortiSwitch device.
  D. Ban or unban compromised hosts.
  A. Shut down/reboot a downstream FortiGate device.
  B. Disable FortiAnalyzer logging for a downstream FortiGate device.

• Question 5:

  Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

  A. Log downloads from the GUI are limited to the current filter view
  B. Log backups from the CLI cannot be restored to another FortiGate.
  C. Log backups from the CLI can be configured to upload to FTP as a scheduled time
  D. Log downloads from the GUI are stored as LZ4 compressed files.
  A. Log downloads from the GUI are limited to the current filter view
  B. Log backups from the CLI cannot be restored to another FortiGate.

  ---

  Explanation/Reference:

• Question 6:

  Refer to the exhibits.

  

  An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW). What must the administrator do to synchronize the address object?

  A. Change the csf setting on ISFW (downstream) to set configuration-sync local.
  B. Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.
  C. Change the csf setting on both devices to set downstream-access enable.
  D. Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
  C. Change the csf setting on both devices to set downstream-access enable.

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/880913/synchronizing-objects-across-the-security-fabric

• Question 7:

  Refer to the exhibit.

  

  A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

  A. On HQ-FortiGate, enable Auto-negotiate.
  B. On Remote-FortiGate, set Seconds to 43200.
  C. On HQ-FortiGate, enable Diffie-Hellman Group 2.
  D. On HQ-FortiGate, set Encryption to AES256.
  D. On HQ-FortiGate, set Encryption to AES256.

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/168495

  Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.

• Question 8:

  Refer to the exhibit.

  

  Examine the intrusion prevention system (IPS) diagnostic command.

  Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

  A. The IPS engine was inspecting high volume of traffic.
  B. The IPS engine was unable to prevent an intrusion attack .
  C. The IPS engine was blocking all traffic.
  D. The IPS engine will continue to run in a normal state.
  A. The IPS engine was inspecting high volume of traffic.

  ---

  Explanation/Reference:

  fortinet-fortigate-security-study-guide-for-fortios-72 page 417 If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.

  Reference: https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage

• Question 9:

  Refer to the exhibits.

  

  

  The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .

  Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

  Which part of the policy configuration must you change to resolve the issue?

  A. Make SSL inspection needs to be a deep content inspection.
  B. Force access to Facebook using the HTTP service.
  C. Get the additional application signatures are required to add to the security policy.
  D. Add Facebook in the URL category in the security policy.
  A. Make SSL inspection needs to be a deep content inspection.

  ---

  Explanation/Reference:

  They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts. This indicate that the rule are partially working as they can watch video but cant react, i.e. liking the content. So must be an issue with the SSL inspection rather then adding an app rule.

• Question 10:

  Which of statement is true about SSL VPN web mode?

  A. The tunnel is up while the client is connected.
  B. It supports a limited number of protocols.
  C. The external network application sends data through the VPN.
  D. It assigns a virtual IP address to the client.
  B. It supports a limited number of protocols.

  ---

  Explanation/Reference:

  FortiGate_Security_6.4 page 575 - Web mode requires only a web browser, but supports a limited number of protocols.