Fortinet NSE4_FGT-7.2 Online Practice Questions and Exam Preparation

Fortinet NSE4_FGT-7.2 Online Questions & Answers

• Question 51:

  Which two statements are correct about a software switch on FortiGate? (Choose two.)

  A. It can be configured only when FortiGate is operating in NAT mode
  B. Can act as a Layer 2 switch as well as a Layer 3 router
  C. All interfaces in the software switch share the same IP address
  D. It can group only physical interfaces
  A. It can be configured only when FortiGate is operating in NAT mode
  C. All interfaces in the software switch share the same IP address

• Question 52:

  Which two statements are true about the RPF check? (Choose two.)

  A. The RPF check is run on the first sent packet of any new session.
  B. The RPF check is run on the first reply packet of any new session.
  C. The RPF check is run on the first sent and reply packet of any new session.
  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.
  A. The RPF check is run on the first sent packet of any new session.
  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

  ---

  Explanation/Reference:

  Reference: https://www.programmersought.com/article/16383871634/

• Question 53:

  Which two configuration settings are synchronized when FortiGate devices are in an active- active HA cluster? (Choose two.)

  A. FortiGuard web filter cache
  B. FortiGate hostname
  C. NTP
  D. DNS
  C. NTP
  D. DNS

  ---

  Explanation/Reference:

  In the 7.2 Infrastructure Guide (page 306) the list of configuration settings that are NOT synchronized includes both 'FortiGate host name' and 'Cache'

• Question 54:

  Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

  A. Warning
  B. Exempt
  C. Allow
  D. Learn
  A. Warning
  C. Allow

• Question 55:

  Which three statements explain a flow-based antivirus profile? (Choose three.)

  A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
  B. If a virus is detected, the last packet is delivered to the client.
  C. The IPS engine handles the process as a standalone.
  D. FortiGate buffers the whole file but transmits to the client at the same time.
  E. Flow-based inspection optimizes performance compared to proxy-based inspection.
  A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
  D. FortiGate buffers the whole file but transmits to the client at the same time.
  E. Flow-based inspection optimizes performance compared to proxy-based inspection.

  ---

  Explanation/Reference:

  Reference: https://forum.fortinet.com/tm .aspx?m=192309

• Question 56:

  Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services.

  

  Which CLI command must the administrator use to view the route?

  A. get router info routing-table database
  B. diagnose firewall route list
  C. get internet-service route list
  D. get router info routing-table all
  B. diagnose firewall route list

  ---

  Explanation/Reference:

  ISDB static route will not create entry directly in routing-table. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-for- Predefined-Internet/ta-p/198756 and here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Verify-the-matching- policy-route/ta-p/190640

  FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command."

• Question 57:

  Refer to the exhibit.

  The exhibit shows the output of a diagnose command.

  

  What does the output reveal about the policy route?

  A. It is an ISDB route in policy route.
  B. It is a regular policy route.
  C. It is an ISDB policy route with an SDWAN rule.
  D. It is an SDWAN rule in policy route.
  D. It is an SDWAN rule in policy route.

  ---

  Explanation/Reference:

  FortiGate Infrastructure 7.2 Study Guide (p.59): "ISDB routes and SD-WAN rules are assigned an ID higher than 65535. However, SD-WAN rule entries include the vwl_service field, and ISDB route entries don't."

• Question 58:

  Which two statements ate true about the Security Fabric rating? (Choose two.)

  A. It provides executive summaries of the four largest areas of security focus.
  B. Many of the security issues can be fixed immediately by clicking Apply where available.
  C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
  D. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
  B. Many of the security issues can be fixed immediately by clicking Apply where available.
  C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

  ---

  Explanation/Reference:

  Reference: https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/292634/security-rating

• Question 59:

  Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

  A. Proxy-based inspection
  B. Certificate inspection
  C. Flow-based inspection
  D. Full Content inspection
  A. Proxy-based inspection
  C. Flow-based inspection

• Question 60:

  Which two statements are true when FortiGate is in transparent mode? (Choose two.)

  A. By default, all interfaces are part of the same broadcast domain.
  B. The existing network IP schema must be changed when installing a transparent mode.
  C. Static routes are required to allow traffic to the next hop.
  D. FortiGate forwards frames without changing the MAC address.
  A. By default, all interfaces are part of the same broadcast domain.
  D. FortiGate forwards frames without changing the MAC address.

  ---

  Explanation/Reference:

  Reference: https://kb.fortinet.com/kb/viewAttachment.do?attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdfanddo cumentID=FD33113