New Year Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Fortinet NSE4_FGT-7.0 Fortinet NSE 4 - FortiOS 7.0 Exam Practice Test

Demo: 25 questions
Total 173 questions

Fortinet NSE 4 - FortiOS 7.0 Questions and Answers

Question 1

A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

Options:

A.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

B.

The two VLAN sub interfaces must have different VLAN IDs.

C.

The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

D.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

Question 2

Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.

The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Options:

A.

10.200.1.10

B.

Any available IP address in the WAN (port1) subnet 10.200.1.0/24

C.

10.200.1.1

D.

10.0.1.254

Question 3

In which two ways can RPF checking be disabled? (Choose two )

Options:

A.

Enable anti-replay in firewall policy.

B.

Disable the RPF check at the FortiGate interface level for the source check

C.

Enable asymmetric routing.

D.

Disable strict-arc-check under system settings.

Question 4

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

Options:

A.

Subject Key Identifier value

B.

SMMIE Capabilities value

C.

Subject value

D.

Subject Alternative Name value

Question 5

View the exhibit:

Which the FortiGate handle web proxy traffic rue? (Choose two.)

Options:

A.

Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

B.

port-VLAN1 is the native VLAN for the port1 physical interface.

C.

C. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

D.

Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Question 6

You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.

What is the default behavior when the local disk is full?

Options:

A.

Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.

B.

No new log is recorded until you manually clear logs from the local disk.

C.

Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.

D.

No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.

Question 7

Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

Options:

A.

It always authorizes the traffic without requiring authentication.

B.

It drops the traffic.

C.

It authenticates the traffic using the authentication scheme SCHEME2.

D.

It authenticates the traffic using the authentication scheme SCHEME1.

Question 8

An organization’s employee needs to connect to the office through a high-latency internet connection.

Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

Options:

A.

Change the session-ttl.

B.

Change the login timeout.

C.

Change the idle-timeout.

D.

Change the udp idle timer.

Question 9

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Options:

A.

Firewall policy

B.

Policy rule

C.

Security policy

D.

SSL inspection and authentication policy

Question 10

An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24. How must the administrator configure the local quick mode selector for site B?

Options:

A.

192.168.3.0/24

B.

192.168.2.0/24

C.

192.168.1.0/24

D.

192.168.0.0/8

Question 11

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

Options:

A.

The interface has been configured for one-arm sniffer.

B.

The interface is a member of a virtual wire pair.

C.

The operation mode is transparent.

D.

The interface is a member of a zone.

E.

Captive portal is enabled in the interface.

Question 12

Refer to the exhibit.

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.

How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

Options:

A.

If there is a full-through policy in place, users will not be prompted for authentication.

B.

Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.

C.

Authentication is enforced at a policy level; all users will be prompted for authentication.

D.

Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.

Question 13

Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

Options:

A.

Fabric Coverage

B.

Automated Response

C.

Security Posture

D.

Optimization

Question 14

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

Which DPD mode on FortiGate will meet the above requirement?

Options:

A.

Disabled

B.

On Demand

C.

Enabled

D.

On Idle

Question 15

Refer to the exhibit.

Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

Options:

A.

Destination NAT is disabled in the firewall policy.

B.

One-to-one NAT IP pool is used in the firewall policy.

C.

Overload NAT IP pool is used in the firewall policy.

D.

Port block allocation IP pool is used in the firewall policy.

Question 16

Refer to the web filter raw logs.

Based on the raw logs shown in the exhibit, which statement is correct?

Options:

A.

Social networking web filter category is configured with the action set to authenticate.

B.

The action on firewall policy ID 1 is set to warning.

C.

Access to the social networking web filter category was explicitly blocked to all users.

D.

The name of the firewall policy is all_users_web.

Question 17

Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10 .0.1.254. /24.

The first firewall policy has NAT enabled using IP Pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

Options:

A.

10.200.1.1

B.

10.200.3.1

C.

10.200.1.100

D.

10.200.1.10

Question 18

Which three statements about a flow-based antivirus profile are correct? (Choose three.)

Options:

A.

IPS engine handles the process as a standalone.

B.

FortiGate buffers the whole file but transmits to the client simultaneously.

C.

If the virus is detected, the last packet is delivered to the client.

D.

Optimized performance compared to proxy-based inspection.

E.

Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.

Question 19

Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Options:

A.

Traffic between port2 and port2-vlan1 is allowed by default.

B.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

C.

port1 is a native VLAN.

D.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Question 20

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

Options:

A.

The firewall policy performs the full content inspection on the file.

B.

The flow-based inspection is used, which resets the last packet to the user.

C.

The volume of traffic being inspected is too high for this model of FortiGate.

D.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

Question 21

Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

Options:

A.

The signature setting uses a custom rating threshold.

B.

The signature setting includes a group of other signatures.

C.

Traffic matching the signature will be allowed and logged.

D.

Traffic matching the signature will be silently dropped and logged.

Question 22

A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.

What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

Options:

A.

Static IP Address

B.

Dialup User

C.

Dynamic DNS

D.

Pre-shared Key

Question 23

Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.

Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

Options:

A.

The Detection Mode setting is not set to Passive.

B.

Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.

C.

The configured participants are not SD-WAN members.

D.

The Enable probe packets setting is not enabled.

Question 24

Which statement about video filtering on FortiGate is true?

Options:

A.

Full SSL Inspection is not required.

B.

It is available only on a proxy-based firewall policy.

C.

It inspects video files hosted on file sharing services.

D.

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

Question 25

FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

Options:

A.

www.example.com:443

B.

www.example.com

C.

example.com

D.

www.example.com/index.html

Demo: 25 questions
Total 173 questions