Fortinet NSE4_FGT-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.2 Online Questions & Answers

• Question 121:

  Which two statements describe how the RPF check is used? (Choose two.)

  A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
  B. The RPF check is run on the first sent and reply packet of any new session.
  C. The RPF check is run on the first sent packet of any new session.
  D. The RPF check is run on the first reply packet of any new session.
  A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
  C. The RPF check is run on the first sent packet of any new session.

  ---

  Explanation/Reference:

  FortiGate Infrastructure 7.2 Study Guide (p.41): "The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table." "FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn't perform any additional RPF checks on that session."

  A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks. This is true because the RPF check verifies that the source IP address of an incoming packet matches the reverse route for that address, meaning that the packet came from a legitimate source and not from an attacker who is trying to impersonate another host. This prevents IP spoofing attacks, where an attacker sends packets with a forged source IP address to bypass security policies or launch denial-of-service attacks1 C. The RPF check is run on the first sent packet of any new session. This is true because the RPF check is performed only once per session, on the first packet sent by either the client or the server, depending on the direction of the session initiation. This reduces the processing overhead and improves performance2

• Question 122:

  An administrator has a requirement to keep an application session from timing out on port 80.

  What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

  A. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.
  B. Create a new service object for HTTP service and set the session TTL to never
  C. Set the TTL value to never under config system-ttl
  D. Set the session TTL on the HTTP policy to maximum
  B. Create a new service object for HTTP service and set the session TTL to never
  C. Set the TTL value to never under config system-ttl

  ---

  Explanation/Reference:

• Question 123:

  Refer to the exhibit.

  

  The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

  The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet.

  The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem .

  With this configuration, which statement is true?

  A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
  B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
  C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
  D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
  A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46542

• Question 124:

  An administrator must disable RPF check to investigate an issue.

  Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

  A. Enable asymmetric routing, so the RPF check will be bypassed.
  B. Disable the RPF check at the FortiGate interface level for the source check.
  C. Disable the RPF check at the FortiGate interface level for the reply check .
  D. Enable asymmetric routing at the interface level.
  B. Disable the RPF check at the FortiGate interface level for the source check.

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

• Question 125:

  Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

  A. FortiGate uses the AD server as the collector agent.
  B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
  C. FortiGate does not support workstation check .
  D. FortiGate directs the collector agent to use a remote LDAP server.
  B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
  C. FortiGate does not support workstation check .

  ---

  Explanation/Reference:

  You can deploy FSSO w/o installing an agent. FG polls the DCs directly, instead of receiving logon info indirectly from a collector agent.

  Because FG collects all of the data itself, agentless polling mode requires greater system resources, and it doesn't scale as easily.

  Agentless polling mode operates in a similar way to WinSecLog, but with only two event IDs: 4768 and 4769. Because there's no collector agent, FG uses the SMB protocol to read the event viewer logs from the DCs.

  FG acts as a collector. It 's responsible for polling on top of its normal FSSO tasks but does not have all the extra features, such as workstation checks, that are available with the external collector agent.

  Reference: https://kb.fortinet.com/kb/documentLink .do?externalID=FD47732 https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-FSSO-agentless-polling/ta-p/214349

• Question 126:

  Which two types of traffic are managed only by the management VDOM? (Choose two.)

  A. FortiGuard web filter queries
  B. PKI
  C. Traffic shaping
  D. DNS
  A. FortiGuard web filter queries
  D. DNS

• Question 127:

  Refer to the exhibit.

  

  Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

  A. There are five devices that are part of the security fabric.
  B. Device detection is disabled on all FortiGate devices.
  C. This security fabric topology is a logical topology view.
  D. There are 19 security recommendations for the security fabric.
  C. This security fabric topology is a logical topology view.
  D. There are 19 security recommendations for the security fabric.

  ---

  Explanation/Reference:

  References: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology

• Question 128:

  What is a reason for triggering IPS fail open?

  A. The IPS socket buffer is full and the IPS engine cannot process additional packets.
  B. The IPS engine cannot decode a packet.
  C. The IPS engine is upgraded.
  D. The administrator enabled NTurbo acceleration.
  A. The IPS socket buffer is full and the IPS engine cannot process additional packets.

  ---

  Explanation/Reference:

• Question 129:

  Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

  A. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
  B. The client FortiGate requires a manually added route to remote subnets.
  C. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
  D. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
  C. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
  D. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.

  ---

  Explanation/Reference:

  https://docs.fortinet.com/document/fortigate/7.0.9/administration-guide/508779/fortigate-as-ssl-vpn-client To establish an SSL VPN connection between two FortiGate devices, the following two settings are required: The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate will use a CA (Certificate Authority) certificate to verify the client FortiGate certificate, ensuring that the client device is trusted and

  allowed to establish an SSL VPN connection.

  The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: The client FortiGate must have an SSL VPN tunnel interface type configured in order to establish an SSL VPN connection. This interface type will be used

  to connect to the server FortiGate over the SSL VPN.

• Question 130:

  Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

  A. diagnose wad session list
  B. diagnose wad session list | grep hook-preandandhook-out
  C. diagnose wad session list | grep hook=preandandhook=out
  D. diagnose wad session list | grep "hook=pre"and"hook=out"
  A. diagnose wad session list