Fortinet Fortinet Certifications NSE4_FGT-7.2 Questions & Answers

• Question 31:

  Consider the topology:

  Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.

  An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to

  increase or disable this timeout.

  The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.

  What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

  A. Set the maximum session TTL value for the TELNET service object.

  B. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

  C. Create a new service object for TELNET and set the maximum session TTL.

  D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

  Correct Answer: CD

• Question 32:

  Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

  A. The public key of the web server certificate must be installed on the browser.

  B. The web-server certificate must be installed on the browser.

  C. The CA certificate that signed the web-server certificate must be installed on the browser.

  D. The private key of the CA certificate that signed the browser certificate must be installed on the browser.

  Correct Answer: C

• Question 33:

  Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

  A. DNS

  B. ping

  C. udp-echo

  D. TWAMP

  Correct Answer: CD

• Question 34:

  View the exhibit.

  

  Which of the following statements are correct? (Choose two.)

  A. This setup requires at least two firewall policies with the action set to IPsec.

  B. Dead peer detection must be disabled to support this type of IPsec setup.

  C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

  D. This is a redundant IPsec setup.

  Correct Answer: CD

  https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/632796/ospf-with-ipsec-vpn-for-network-redundancy

• Question 35:

  Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

  A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

  B. ADVPN is only supported with IKEv2.

  C. Tunnels are negotiated dynamically between spokes.

  D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

  Correct Answer: AC

• Question 36:

  An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.

  What is true about the DNS connection to a FortiGuard server?

  A. It uses UDP 8888.

  B. It uses UDP 53.

  C. It uses DNS over HTTPS.

  D. It uses DNS overTLS.

  Correct Answer: D

  FortiGate Security 7.2 Study Guide (p.15): "When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic."

  When using FortiGuard servers for DNS, FortiOS defaults to using DNS over TLS (DoT) to secure the DNS traffic1. DNS over TLS is a protocol that encrypts and authenticates DNS queries and responses using the Transport Layer Security (TLS) protocol2. This prevents eavesdropping, tampering, and spoofing of DNS data by third parties. The default FortiGuard DNS servers are 96.45.45.45 and 96.45.46.46, and they use the hostname globalsdns.fortinet.net1. The FortiGate verifies the server hostname using the server-hostname setting in the system dns configuration1.

• Question 37:

  Refer to the exhibit.

  

  Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

  A. Destination NAT is disabled in the firewall policy.

  B. One-to-one NAT IP pool is used in the firewall policy.

  C. Overload NAT IP pool is used in the firewall policy.

  D. Port block allocation IP pool is used in the firewall policy.

  Correct Answer: B

  FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.

• Question 38:

  Which statement regarding the firewall policy authentication timeout is true?

  A. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

  B. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

  C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

  D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

  Correct Answer: A

• Question 39:

  Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

  A. FortiGate uses the AD server as the collector agent.

  B. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

  C. FortiGate does not support workstation check .

  D. FortiGate directs the collector agent to use a remote LDAP server.

  Correct Answer: BC

  You can deploy FSSO w/o installing an agent. FG polls the DCs directly, instead of receiving logon info indirectly from a collector agent.

  Because FG collects all of the data itself, agentless polling mode requires greater system resources, and it doesn't scale as easily.

  Agentless polling mode operates in a similar way to WinSecLog, but with only two event IDs: 4768 and 4769. Because there's no collector agent, FG uses the SMB protocol to read the event viewer logs from the DCs.

  FG acts as a collector. It 's responsible for polling on top of its normal FSSO tasks but does not have all the extra features, such as workstation checks, that are available with the external collector agent.

  Reference: https://kb.fortinet.com/kb/documentLink .do?externalID=FD47732 https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-FSSO-agentless-polling/ta-p/214349

• Question 40:

  Which of the following statements about central NAT are true? (Choose two.)

  A. IP tool references must be removed from existing firewall policies before enabling central NAT .

  B. Central NAT can be enabled or disabled from the CLI only.

  C. Source NAT, using central NAT, requires at least one central SNAT policy.

  D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

  Correct Answer: AB