Fortinet Fortinet Certifications NSE4_FGT-7.2 Questions & Answers

• Question 81:

  Examine this FortiGate configuration: How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

  

  A. It always authorizes the traffic without requiring authentication.

  B. It drops the traffic.

  C. It authenticates the traffic using the authentication scheme SCHEME2.

  D. It authenticates the traffic using the authentication scheme SCHEME1.

  Correct Answer: D

  "What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting"

• Question 82:

  Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

  A. To remove the NAT operation.

  B. To generate logs

  C. To finish any inspection operations.

  D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.

  Correct Answer: D

• Question 83:

  Refer to the exhibit.

  

  Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

  A. Custom permission for Network

  B. Read/Write permission for Log and Report

  C. CLI diagnostics commands permission

  D. Read/Write permission for Firewall

  Correct Answer: C

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220

• Question 84:

  Refer to the exhibits.

  Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

  

  Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

  A. For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

  B. The traffic sourced from the client and destined to the server is sent to FGT-1.

  C. The cluster can load balance ICMP connections to the secondary.

  D. For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

  Correct Answer: AD

  FortiGate Infrastructure 7.2 Study Guide (p.317 and p.320): "To forward traffic correctly, a FortiGate HA solution uses virtual MAC addresses." "The primary forwards the SYN packet to the selected secondary. (...) This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session. The encapsulated packet includes the original packet plus session information that the secondary requires to process the traffic."

• Question 85:

  Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

  A. Subject Key Identifier value

  B. SMMIE Capabilities value

  C. Subject value

  D. Subject Alternative Name value

  Correct Answer: A

• Question 86:

  When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

  A. Log ID

  B. Universally Unique Identifier

  C. Policy ID

  D. Sequence ID

  Correct Answer: B

  FortiGate Security 7.2 Study Guide (p.67): "When creating firewall objects or policies, a universally unique identifier (UUID) attribute is added so that logs can record these UUIDs and improve functionality when integrating with FortiManager or FortiAnalyzer."

  Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/554066/firewall-policies

• Question 87:

  An administrator is running the following sniffer command:

  Which three pieces of Information will be Included in me sniffer output? {Choose three.)

  A. Interface name

  B. Packet payload

  C. Ethernet header

  D. IP header

  E. Application header

  Correct Answer: ABD

• Question 88:

  Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

  A. To detect intermediary NAT devices in the tunnel path.

  B. To dynamically change phase 1 negotiation mode aggressive mode.

  C. To encapsulation ESP packets in UDP packets using port 4500.

  D. To force a new DH exchange with each phase 2 rekey.

  Correct Answer: AC

• Question 89:

  Which two types of traffic are managed only by the management VDOM? (Choose two.)

  A. FortiGuard web filter queries

  B. PKI

  C. Traffic shaping

  D. DNS

  Correct Answer: AD

• Question 90:

  Which two statements are true about the RPF check? (Choose two.)

  A. The RPF check is run on the first sent packet of any new session.

  B. The RPF check is run on the first reply packet of any new session.

  C. The RPF check is run on the first sent and reply packet of any new session.

  D. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

  Correct Answer: AD

  Reference: https://www.programmersought.com/article/16383871634/