Fortinet Fortinet Certifications NSE4_FGT-7.2 Questions & Answers

• Question 141:

  An administrator needs to increase network bandwidth and provide redundancy.

  What interface type must the administrator select to bind multiple FortiGate interfaces?

  A. VLAN interface

  B. Software Switch interface

  C. Aggregate interface

  D. Redundant interface

  Correct Answer: C

  An aggregate interface is a logical interface that combines two or more physical interfaces into one virtual interface1. An aggregate interface can increase network bandwidth and provide redundancy by distributing traffic across multiple physical interfaces using a load balancing algorithm1. An aggregate interface can also support link aggregation control protocol (LACP) to negotiate the link aggregation settings with the connected device1.

  Reference: https://forum.fortinet.com/tm .aspx?m=120324 https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/567758/aggregation-and-redundancy

• Question 142:

  Which statement describes a characteristic of automation stitches?

  A. They can have one or more triggers.

  B. They can be run only on devices in the Security Fabric.

  C. They can run multiple actions simultaneously.

  D. They can be created on any device in the fabric.

  Correct Answer: C

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/351998/creating-automation-stitches https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/139441/automation-stitches

• Question 143:

  A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

  1.

  All traffic must be routed through the primary tunnel when both tunnels are up

  2.

  The secondary tunnel must be used only if the primary tunnel goes down

  3.

  In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

  Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

  A. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

  B. Enable Dead Peer Detection.

  C. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

  D. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

  Correct Answer: BC

  Study Guide IPsec VPN IPsec configuration Phase 1 Network.

  When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same

  destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.

  There are three DPD modes. On demand is the default mode.

  Study Guide IPsec VPN Redundant VPNs.

  Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.

  Add at least one phase 2 definition for each phase 1.

  Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.

  Configure FW policies for each IPsec interface.

• Question 144:

  Refer to the exhibits.

  

  

  The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .

  Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

  Which part of the policy configuration must you change to resolve the issue?

  A. Make SSL inspection needs to be a deep content inspection.

  B. Force access to Facebook using the HTTP service.

  C. Get the additional application signatures are required to add to the security policy.

  D. Add Facebook in the URL category in the security policy.

  Correct Answer: A

  They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts. This indicate that the rule are partially working as they can watch video but cant react, i.e. liking the content. So must be an issue with the SSL inspection rather then adding an app rule.

• Question 145:

  An administrator wants to configure timeouts for users. Regardless of the userTMs behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should be configured on FortiGate?

  A. auth-on-demand

  B. soft-timeout

  C. idle-timeout

  D. new-session

  E. hard-timeout

  Correct Answer: E

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221#:~:text=Hard%20timeout%3A%20User%20 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-auth-timeout-types-for-Firewall/ta-p/189423

• Question 146:

  Refer to the exhibit showing a debug flow output.

  

  Which two statements about the debug flow output are correct? (Choose two.)

  A. The debug flow is of ICMP traffic.

  B. A firewall policy allowed the connection.

  C. A new traffic session is created.

  D. The default route is required to receive a reply.

  Correct Answer: AC

  Reference: https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/54688/debugging-the-packet-flow

• Question 147:

  Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

  A. Web filter in flow-based inspection

  B. Antivirus in flow-based inspection

  C. DNS filter

  D. Web application firewall

  E. Application control

  Correct Answer: ABE

  https://docs.fortinet.com/document/fortigate/7.0.0/new-features/739623/dns-filter-handled-by-ips-engine-in-flow-mode

• Question 148:

  Refer to the exhibit.

  An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.

  

  What is the impact of using the Include in every user group option in a RADIUS configuration?

  A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

  B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

  C. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

  D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

  Correct Answer: A

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/634373/authentication-servers

• Question 149:

  Refer to the exhibit.

  

  An administrator is running a sniffer command as shown in the exhibit.

  Which three pieces of information are included in the sniffer output? (Choose three.)

  A. Interface name

  B. Ethernet header

  C. IP header

  D. Application header

  E. Packet payload

  Correct Answer: ACE

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=11186

  Study Guide Routing Diagnostics Packet Capture Verbosity Level.

  # diagnose sniffer packet `'

  In the example, verbosity is 5.

  The verbosity level specifies how much info you want to display.

  1 (default): IP Headers.

  2: IP Headers, Packet Payload.

  3. IP Headers, Packet Payload, Ethernet Headers.

  4: IP Headers, Interface Name.

  5: IP Headers, Packet Payload, Interface Name.

  6: IP Headers, Packet Payload, Ethernet Headers, Interface Name.

• Question 150:

  An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192. 168. 1.0/24 and the remote quick

  mode selector is 192.

  168.2.0/24.

  Which subnet must the administrator configure for the local quick mode selector for site B?

  A. 192. 168. 1.0/24

  B. 192. 168.0.0/24

  C. 192. 168.2.0/24

  D. 192. 168.3.0/24

  Correct Answer: C

  For an IPsec VPN between site A and site B, the administrator has configured the local quick mode selector for site A as 192.168.1.0/24 and the remote quick mode selector as 192.168.2.0/24. This means that the VPN will allow traffic to and from the 192.168.1.0/24 subnet at site A to reach the 192.168.2.0/24 subnet at site B.

  To complete the configuration, the administrator must configure the local quick mode selector for site B. To do this, the administrator must use the same subnet as the remote quick mode selector for site A, which is 192.168.2.0/24. This will allow traffic to and from the 192.168.2.0/24 subnet at site B to reach the 192.168.1.0/24 subnet at site A.

  Therefore, the administrator must configure the local quick mode selector for site B as 192.168.2.0/24.