Fortinet NSE4_FGT-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.2 Online Questions & Answers

• Question 91:

  Which statement is correct regarding the use of application control for inspecting web applications?

  A. Application control can identity child and parent applications, and perform different actions on them.
  B. Application control signatures are organized in a nonhierarchical structure.
  C. Application control does not require SSL inspection to identity web applications.
  D. Application control does not display a replacement message for a blocked web application.
  A. Application control can identity child and parent applications, and perform different actions on them.

  ---

  Explanation/Reference:

  Application control is a feature that allows FortiGate to inspect and control the use of specific web applications on the network. When application control is enabled, FortiGate can identify child and parent applications, and can perform different actions on them based on the configuration.

• Question 92:

  Refer to the exhibits.

  The exhibits show the firewall policies and the objects used in the firewall policies.

  The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

  

  Which policy will be highlighted, based on the input criteria?

  A. Policy with ID 4.
  B. Policy with ID 5.
  C. Policies with ID 2 and 3.
  D. Policy with ID 4.
  B. Policy with ID 5.

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/497952/policy-views-and-policy-lookup

  We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted

• Question 93:

  Which statement about the deployment of the Security Fabric in a multi-VDOM environment is true?

  A. VDOMs without ports with connected devices are not displayed in the topology.
  B. Downstream devices can connect to the upstream device from any of their VDOMs.
  C. Security rating reports can be run individually for each configured VDOM.
  D. Each VDOM in the environment can be part of a different Security Fabric.
  A. VDOMs without ports with connected devices are not displayed in the topology.

  ---

  Explanation/Reference:

  FortiGate Security 7.2 Study Guide (p.436): "When you configure FortiGate devices in multi-vdom mode and add them to the Security Fabric, each VDOM with its assigned ports is displayed when one or more devices are detected. Only the ports with discovered and connected devices appear in the Security Fabric view and, because of this, you must enable Device Detection on ports you want to have displayed in the Security Fabric. VDOMs without ports with connected devices are not displayed. All VDOMs configured must be part of a single Security Fabric."

• Question 94:

  Which statement correctly describes the use of reliable logging on FortiGate?

  A. Reliable logging is enabled by default in all configuration scenarios.
  B. Reliable logging is required to encrypt the transmission of logs.
  C. Reliable logging can be configured only using the CLI.
  D. Reliable logging prevents the loss of logs when the local disk is full.
  B. Reliable logging is required to encrypt the transmission of logs.

  ---

  Explanation/Reference:

  FortiGate Security 7.2 Study Guide (p.192): "if using reliable logging, you can encrypt communications using SSL-encrypted OFTP traffic, so when a log message is generated, it is safely transmitted across an unsecure network. You can choose the level of SSL protection used by configuring the enc-algorithm setting on the CLI."

• Question 95:

  Refer to the exhibits.

  

  Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

  A. Administrators can access FortiGate only through the console port.
  B. FortiGate has entered conserve mode.
  C. FortiGate will start sending all files to FortiSandbox for inspection.
  D. Administrators cannot change the configuration.
  B. FortiGate has entered conserve mode.
  D. Administrators cannot change the configuration.

  ---

  Explanation/Reference:

  Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502

  configurable thresholds

  Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.

  Default values are :

  -red : 88% of total memory is considered "used memory"

  -extreme : 95% of total memory is considered "used memory"

  -green : 82% of total memory is considered "used memory"

• Question 96:

  Which feature in the Security Fabric takes one or more actions based on event triggers?

  A. Fabric Connectors
  B. Automation Stitches
  C. Security Rating
  D. Logical Topology
  B. Automation Stitches

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/286973/fortinet-security-fabric

• Question 97:

  Refer to the exhibit.

  

  The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?

  A. port2
  B. port4
  C. port3
  D. port1
  D. port1

  ---

  Explanation/Reference:

  Port 1 shows the lowest latency.

• Question 98:

  An employee needs to connect to the office through a high-latency internet connection.

  Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?

  A. idle-timeout
  B. login-timeout
  C. udp-idle-timer
  D. session-ttl
  B. login-timeout

  ---

  Explanation/Reference:

  FortiGate Infrastructure 7.2 Study Guide (p.222):

  "When connected to SSL VPN over high latency connections, FortiGate can time out the client before the client can finish the negotiation process, such as DNS lookup and time to enter a token. Two new CLI commands under config vpn ssl

  settings have been added to address this. The first command allows you to set up the login timeout, replacing the previous hard timeout value. The second command allows you to set up the maximum DTLS hello timeout for SSL VPN

  connections."

• Question 99:

  Examine this output from a debug flow:

  

  Why did the FortiGate drop the packet?

  A. The next-hop IP address is unreachable.
  B. It failed the RPF check .
  C. It matched an explicitly configured firewall policy with the action DENY.
  D. It matched the default implicit firewall policy.
  D. It matched the default implicit firewall policy.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/documentLink.do?externalID=13900 https://www.fortinetguru.com/2016/03/what-is-policy-id-0-and-why-lot-of-denied-traffic-on-this-policy/

• Question 100:

  Consider the topology:

  Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.

  An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to

  increase or disable this timeout.

  The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.

  What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

  A. Set the maximum session TTL value for the TELNET service object.
  B. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.
  C. Create a new service object for TELNET and set the maximum session TTL.
  D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.
  C. Create a new service object for TELNET and set the maximum session TTL.
  D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.