Fortinet NSE4_FGT-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.2 Online Questions & Answers

• Question 141:

  What are two functions of ZTNA? (Choose two.)

  A. ZTNA manages access through the client only.
  B. ZTNA manages access for remote users only.
  C. ZTNA provides a security posture check.
  D. ZTNA provides role-based access.
  C. ZTNA provides a security posture check.
  D. ZTNA provides role-based access.

  ---

  Explanation/Reference:

  ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all

  access to network resources is subject to strict verification and authentication.

  Two functions of ZTNA are:

  ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources.

  This can include checks on the device's software and hardware configurations, security settings, and the presence of malware.

  ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is

  denied.

  This helps to prevent unauthorized access and minimize the risk of data breaches.

  Reference:

  https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/8ddfc8d2-9b21-11ec-9fd1-fa163e15d75b/Zero_Trust_Network_Access-7.0-Deployment_Guide.pdf

• Question 142:

  In an explicit proxy setup, where is the authentication method and database configured?

  A. Proxy Policy
  B. Authentication Rule
  C. Firewall Policy
  D. Authentication scheme
  D. Authentication scheme

• Question 143:

  Refer to the exhibits.

  The exhibits contain a network interface configuration, firewall policies, and a CLI console configuration.

  

  

  How will the FortiGate device handle user authentication for traffic that arrives on the LAN interface?

  A. All users will be prompted for authentication; users from the HR group can authenticate successfully with the correct credentials.
  B. If there is a fall-through policy in place, users will not be prompted for authentication.
  C. All users will be prompted for authentication; users from the sales group can authenticate successfully with the correct credentials.
  D. Authentication is enforced only at a policy level; all users will be prompted for authentication.
  A. All users will be prompted for authentication; users from the HR group can authenticate successfully with the correct credentials.

  ---

  Explanation/Reference:

• Question 144:

  Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
  B. ADVPN is only supported with IKEv2.
  C. Tunnels are negotiated dynamically between spokes.
  D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
  C. Tunnels are negotiated dynamically between spokes.

• Question 145:

  Refer to the exhibit, which contains a session diagnostic output.

  

  Which statement is true about the session diagnostic output?

  A. The session is a UDP unidirectional state.
  B. The session is in TCP ESTABLISHED state.
  C. The session is a bidirectional UDP connection.
  D. The session is a bidirectional TCP connection.
  C. The session is a bidirectional UDP connection.

  ---

  Explanation/Reference:

  https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

• Question 146:

  An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?

  A. The administrator can register the same FortiToken on more than one FortiGate.
  B. The administrator must use a FortiAuthenticator device
  C. The administrator can use a third-party radius OTP server.
  D. The administrator must use the user self-registration server.
  B. The administrator must use a FortiAuthenticator device

• Question 147:

  Which three statements are true regarding session-based authentication? (Choose three.)

  A. HTTP sessions are treated as a single user.
  B. IP sessions from the same source IP address are treated as a single user.
  C. It can differentiate among multiple clients behind the same source IP address.
  D. It requires more resources.
  E. It is not recommended if multiple users are behind the source NAT
  A. HTTP sessions are treated as a single user.
  C. It can differentiate among multiple clients behind the same source IP address.
  D. It requires more resources.

• Question 148:

  An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

  Which DPD mode on FortiGate will meet the above requirement?

  A. Disabled
  B. On Demand
  C. Enabled
  D. On Idle
  D. On Idle

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD40813

• Question 149:

  Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

  A. Heartbeat interfaces have virtual IP addresses that are manually assigned.
  B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
  C. Virtual IP addresses are used to distinguish between cluster members.
  D. The primary device in the cluster is always assigned IP address 169.254.0.1.
  B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
  C. Virtual IP addresses are used to distinguish between cluster members.

  ---

  Explanation/Reference:

• Question 150:

  Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

  A. Subject Key Identifier value
  B. SMMIE Capabilities value
  C. Subject value
  D. Subject Alternative Name value
  A. Subject Key Identifier value