NSE4_FGT-7.2 Practice Questions Preview

Question 1

Single choice

When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

A
Log ID
B
Universally Unique Identifier
C
Policy ID
D
Sequence ID

Question 2

Multiple choice

Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

A
The port3 default route has the lowest metric.
B
The port1 and port2 default routes are active in the routing table.
C
The ports default route has the highest distance.
D
There will be eight routes active in the routing table.

Question 3

Single choice

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

A
A CRL
B
A person
C
A subordinate CA
D
A root CA

Question 4

Multiple choice

Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

A
hard-timeout
B
auth-on-demand
C
soft-timeout
D
new-session
E
Idle-timeout

Question 5

Multiple choice

FortiGuard categories can be overridden and defined in different categories. To create a web rating
override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

A
www.example.com:443
B
www.example.com
C
example.com
D
www.example.com/index.html

Question 6

Single choice

Examine this output from a debug flow:

Why did the FortiGate drop the packet?

A
The next-hop IP address is unreachable.
B
It failed the RPF check .
C
It matched an explicitly configured firewall policy with the action DENY.
D
It matched the default implicit firewall policy.

Question 7

Multiple choice

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

A
Heartbeat interfaces have virtual IP addresses that are manually assigned.
B
A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
C
Virtual IP addresses are used to distinguish between cluster members.
D
The primary device in the cluster is always assigned IP address 169.254.0.1.

Question 8

Multiple choice

Which two statements ate true about the Security Fabric rating? (Choose two.)

A
It provides executive summaries of the four largest areas of security focus.
B
Many of the security issues can be fixed immediately by clicking Apply where available.
C
The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
D
The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

Question 9

Multiple choice

Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.

Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully.
However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.

Based on the information shown in the exhibit, which three configuration changes should the administrator make to fix the connectivity issue for PC3? (Choose three.)

A
In the IP pool configuration, set type to overload. Most Voted
B
Configure 192.2.0.12/24 as the secondary IP address on port1.
C
In the firewall policy configuration, disable ippool. Most Voted
D
In the IP pool configuration, set endip to 192.2.0.12. Most Voted
E
Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

Question 10

Single choice

An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.

What is true about the DNS connection to a FortiGuard server?

A
It uses UDP 8888.
B
It uses UDP 53.
C
It uses DNS over HTTPS.
D
It uses DNS overTLS.

Question 11

Multiple choice

FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.

In this scenario, what are two requirements for the VLAN ID? (Choose two.)

A
The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
B
The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
C
The two VLAN subinterfaces must have different VLAN IDs.
D
The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

Question 12

Multiple choice

What are two functions of the ZTNA rule? (Choose two.)

A
It redirects the client request to the access proxy.
B
It applies security profiles to protect traffic.
C
It defines the access proxy.
D
It enforces access control.

Question 13

Single choice

Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings.

Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

A
The signature setting uses a custom rating threshold.
B
The signature setting includes a group of other signatures.
C
Traffic matching the signature will be allowed and logged.
D
Traffic matching the signature will be silently dropped and logged.

Question 14

Single choice

Refer to the exhibit to view the firewall policy.

Why would the firewall policy not block a well-known virus, for example eicar?

A
Web filter is not enabled on the firewall policy to complement the antivirus profile.
B
The firewall policy is not configured in proxy-based inspection mode.
C
The firewall policy does not apply deep content inspection.
D
The action on the firewall policy is not set to deny.

Question 15

Single choice

An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken.
Each site has a FortiGate VPN gateway.

What must the administrator do to achieve this objective?

A
The administrator must register the same FortiToken on more than one FortiGate device.
B
The administrator must use the user self-registration server.
C
The administrator must use a FortiAuthenticator device.
D
The administrator must use a third-party RADIUS OTP server.

Question 16

Single choice

Which of statement is true about SSL VPN web mode?

A
The tunnel is up while the client is connected.
B
It supports a limited number of protocols.
C
The external network application sends data through the VPN.
D
It assigns a virtual IP address to the client.

Question 17

Single choice

Refer to the exhibit.

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

A
Custom permission for Network
B
Read/Write permission for Log & Report
C
CLI diagnostics commands permission
D
Read/Write permission for Firewall

Question 18

Single choice

Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.

When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

A
Configure a loopback interface with address 203.0.113.2/32.
B
In the VIP configuration, enable arp-reply.
C
Enable port forwarding on the server to map the external service port to the internal service port.
D
In the firewall policy configuration, enable match-vip.

Question 19

Single choice

Refer to the exhibit.

The exhibit shows the output of a diagnose command.

What does the output reveal about the policy route?

A
It is an ISDB route in policy route.
B
It is a regular policy route.
C
It is an ISDB policy route with an SDWAN rule.
D
It is an SDWAN rule in policy route.

Question 20

Single choice

Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24.

The LAN (port3) interface has the IP address 10.0. 1.254/24.

A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.

Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.
1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

A
10.200. 1. 149
B
10.200. 1. 1
C
10.200. 1.49
D
10.200. 1.99

Question 21

Multiple choice

Refer to the exhibits.

The exhibits show a network diagram and firewall configurations.

An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.

In this scenario, which two changes can the administrator make to deny Webserver access for Remote- User2? (Choose two.)

A
Disable match-vip in the Deny policy.
B
Set the Destination address as Deny_IP in the Allow-access policy.
C
Enable match vip in the Deny policy.
D
Set the Destination address as Web_server in the Deny policy.

Question 22

Multiple choice

View the exhibit.

Which of the following statements are correct? (Choose two.)

A
This setup requires at least two firewall policies with the action set to IPsec.
B
Dead peer detection must be disabled to support this type of IPsec setup.
C
The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
D
This is a redundant IPsec setup.

Question 23

Single choice

Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

A
Social networking web filter category is configured with the action set to authenticate.
B
The action on firewall policy ID 1 is set to warning.
C
Access to the social networking web filter category was explicitly blocked to all users.
D
The name of the firewall policy is all_users_web.

Question 24

Single choice

Which statement is correct regarding the security fabric?

A
FortiManager is one of the required member devices.
B
FortiGate devices must be operating in NAT mode.
C
A minimum of two Fortinet devices is required.
D
FortiGate Cloud cannot be used for logging purposes.

Question 25

Single choice

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

A
On Remote-FortiGate, set Seconds to 43200.
B
On HQ-FortiGate, set Encryption to AES256.
C
On HQ-FortiGate, enable Diffie-Hellman Group 2.
D
On HQ-FortiGate, enable Auto-negotiate.

Question 26

Single choice

Refer to the exhibits.

Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

The administrator disabled the WebServer firewall policy.

Which IP address will be used to source NAT the traffic, if a user with address 10.0.1.10 connects over SSH to the host with address 10.200.3.1?

A
10.200.1.10
B
10.0.1.254
C
10.200.1.1
D
10.200.3.1

Question 27

Single choice

What is a reason for triggering IPS fail open?

A
The IPS socket buffer is full and the IPS engine cannot process additional packets.
B
The IPS engine cannot decode a packet.
C
The IPS engine is upgraded.
D
The administrator enabled NTurbo acceleration.

Question 28

Multiple choice

What are two scanning techniques supported by FortiGate? (Choose two.)

A
Machine learning scan
B
Antivirus scan
C
Ransomware scan
D
Trojan scan