Fortinet Fortinet Certifications NSE4_FGT-7.2 Questions & Answers

• Question 151:

  When configuring a firewall virtual wire pair policy, which following statement is true?

  A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

  B. Only a single virtual wire pair can be included in each policy.

  C. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

  D. Exactly two virtual wire pairs need to be included in each policy.

  Correct Answer: A

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48690

• Question 152:

  Refer to the exhibit.

  

  The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?

  A. port2

  B. port4

  C. port3

  D. port1

  Correct Answer: D

  Port 1 shows the lowest latency.

• Question 153:

  Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

  

  

  Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

  A. The firewall policy performs the full content inspection on the file.

  B. The flow-based inspection is used, which resets the last packet to the user.

  C. The volume of traffic being inspected is too high for this model of FortiGate.

  D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

  Correct Answer: B

  ONL"; If the virus is detected at the";STAR"; of the connection, the IPS engine sends the block replacement message immediately When a virus is detected on a TCP session (FIRST TIME), but where";SOME PACKET"; have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again. In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

• Question 154:

  Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

  A. System time

  B. FortiGuaid update servers

  C. Operating mode

  D. NGFW mode

  Correct Answer: CD

  C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.

  D:

  "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide

• Question 155:

  Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

  A. diagnose wad session list

  B. diagnose wad session list | grep hook-preandandhook-out

  C. diagnose wad session list | grep hook=preandandhook=out

  D. diagnose wad session list | grep "hook=pre"and"hook=out"

  Correct Answer: A

• Question 156:

  Which statement is correct regarding the security fabric?

  A. FortiManager is one of the required member devices.

  B. FortiGate devices must be operating in NAT mode.

  C. A minimum of two Fortinet devices is required.

  D. FortiGate Cloud cannot be used for logging purposes.

  Correct Answer: B

  FortiGate Security 7.2 Study Guide (p.428): "You must have a minimum of two FortiGate devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode."

• Question 157:

  An administrator configures outgoing interface any in a firewall policy. What is the result of the policy list view?

  A. Search option is disabled.

  B. Policy lookup is disabled.

  C. By Sequence view is disabled.

  D. Interface Pair view is disabled.

  Correct Answer: D

  "If you use multiple source or destination interfaces, or the any interface in a firewall policy, you cannot separate policies into sections by interface pairs--some would be triplets or more. So instead, policies are then always displayed in a single list (By Sequence)."

• Question 158:

  Refer to the exhibit to view the application control profile.

  

  

  Based on the configuration, what will happen to Apple FaceTime?

  A. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration

  B. Apple FaceTime will be allowed, based on the Apple filter configuration.

  C. Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn

  D. Apple FaceTime will be allowed, based on the Categories configuration.

  Correct Answer: A

• Question 159:

  In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

  A. The IP version of the sources and destinations in a firewall policy must be different.

  B. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

  C. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

  D. The IP version of the sources and destinations in a policy must match.

  E. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

  Correct Answer: BDE

• Question 160:

  Refer to the exhibit.

  

  Based on the raw log, which two statements are correct? (Choose two.)

  A. Traffic is blocked because Action is set to DENY in the firewall policy.

  B. Traffic belongs to the root VDOM.

  C. This is a security log.

  D. Log severity is set to error on FortiGate.

  Correct Answer: BC