(Jan-2024) NSE4_FGT-7.0 Exam Dumps Contains FREE Real Quesions from the Actual Exam
Free Test Engine Verified By Fortinet NSE 4 Certified Experts
NEW QUESTION # 82
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- A. Enable Dead Peer Detection.
- B. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
- C. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
- D. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
Answer: A,B
Explanation:
B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.
C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination.
NEW QUESTION # 83
View the exhibit.
A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?
- A. Addcting.Games is allowed based on the Categories configuration.
- B. Addicting.Games is blocked on the Filter Overrides configuration.
- C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
- D. Addicting.Games is allowed based on the Application Overrides configuration.
Answer: D
NEW QUESTION # 84
Refer to the exhibit.
Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
- A. The IPS engine was unable to prevent an intrusion attack.
- B. The IPS engine was blocking all traffic.
- C. The IPS engine will continue to run in a normal state.
- D. The IPS engine was inspecting high volume of traffic.
Answer: D
NEW QUESTION # 85
Refer to the exhibit.
The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
- A. If there is a full-through policy in place, users will not be prompted for authentication.
- B. Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.
- C. Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.
- D. Authentication is enforced at a policy level; all users will be prompted for authentication.
Answer: D
NEW QUESTION # 86
Refer to the exhibit, which contains a static route configuration.
An administrator created a static route for Amazon Web Services.
What CLI command must the administrator use to view the route?
- A. get internet service route list
- B. get router info routing-table all
- C. diagnose firewall proute list
- D. get router info routing-table database
Answer: C
NEW QUESTION # 87
An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?
- A. Configure Source IP Pools.
- B. Configure different SSL VPN realms.
- C. Configure split tunneling in tunnel mode.
- D. Configure host check.
Answer: D
NEW QUESTION # 88
View the exhibit:
Which the FortiGate handle web proxy traffic rue? (Choose two.)
- A. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
- B. port-VLAN1 is the native VLAN for the port1 physical interface.
- C. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
- D. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
Answer: A,C
NEW QUESTION # 89
What devices form the core of the security fabric?
- A. One FortiGate device and one FortiAnalyzer device
- B. Two FortiGate devices and one FortiManager device
- C. Two FortiGate devices and one FortiAnalyzer device
- D. One FortiGate device and one FortiManager device
Answer: C
NEW QUESTION # 90
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
- A. On HQ-FortiGate, enable Diffie-Hellman Group 2.
- B. On HQ-FortiGate, enable Auto-negotiate.
- C. On Remote-FortiGate, set Seconds to 43200.
- D. On HQ-FortiGate, set Encryption to AES256.
Answer: D
Explanation:
Reference:
Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.
NEW QUESTION # 91
Which of statement is true about SSL VPN web mode?
- A. It assigns a virtual IP address to the client.
- B. The external network application sends data through the VPN.
- C. The tunnel is up while the client is connected.
- D. It supports a limited number of protocols.
Answer: D
Explanation:
FortiGate_Security_6.4 page 575 - Web mode requires only a web browser, but supports a limited number of protocols.
NEW QUESTION # 92
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. A session for denied traffic is created.
- B. The number of logs generated by denied traffic is reduced.
- C. Denied users are blocked for 30 minutes.
- D. Device detection on all interfaces is enforced for 30 minutes.
Answer: A,B
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46328
NEW QUESTION # 93
Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?
- A. The public key of the web server certificate must be installed on the browser.
- B. The CA certificate that signed the web-server certificate must be installed on the browser.
- C. The private key of the CA certificate that signed the browser certificate must be installed on the browser.
- D. The web-server certificate must be installed on the browser.
Answer: B
NEW QUESTION # 94
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
- B. The volume of traffic being inspected is too high for this model of FortiGate.
- C. The firewall policy performs the full content inspection on the file.
- D. The flow-based inspection is used, which resets the last packet to the user.
Answer: D
Explanation:
Explanation
* "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file.
Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened.
The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.
NEW QUESTION # 95
Which feature in the Security Fabric takes one or more actions based on event triggers?
- A. Automation Stitches
- B. Fabric Connectors
- C. Logical Topology
- D. Security Rating
Answer: A
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/286973/fortinet-security-fabric
NEW QUESTION # 96
Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?
- A. Automated Response
- B. Fabric Coverage
- C. Security Posture
- D. Optimization
Answer: C
Explanation:
Reference:
https://www.fortinet.com/content/dam/fortinet/assets/support/fortinet-recommended-security-bestpractices.pdf Description of the three major scorecards is seen in Security fabric > Security rating>Security posture.
Security Posture Identify configuration weaknesses and best practice violations in your deployment. Fabric Coverage Identify in your overall network, where Security Fabric can enhance visibility and control.
Optimization Optimize your fabric deployment.
NEW QUESTION # 97
An organization's employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?
- A. Change the udp idle timer.
- B. Change the session-ttl.
- C. Change the idle-timeout.
- D. Change the login timeout.
Answer: D
Explanation:
Explanation
FortiGate_Security_7.0 page 607
NEW QUESTION # 98
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)
- A. Server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- B. The client FortiGate requires a manually added route to remote subnets.
- C. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
- D. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
Answer: A,C
NEW QUESTION # 99
An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?
- A. By Sequence view will be disabled.
- B. Search option will be disabled
- C. Interface Pair view will be disabled.
- D. Policy lookup will be disabled.
Answer: C
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47821
NEW QUESTION # 100
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
- A. NTP
- B. FortiGate hostname
- C. DNS
- D. FortiGuard web filter cache
Answer: A,C
NEW QUESTION # 101
Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?
- A. Application control
- B. Web application firewall
- C. Antivirus
- D. Denial of Service
Answer: B
Explanation:
Reference:
WAF is situated or facing internal servers such as Web Servers with purpose of protecting them from attacks such as XSS,SQL Inj, DOS,...
NEW QUESTION # 102
Which of the following SD-WAN load -balancing method use interface weight value to distribute traffic? (Choose two.)
- A. Spillover
- B. Source IP
- C. Volume
- D. Session
Answer: C,D
Explanation:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/49719/configuring-sd-wan-load-balancing
NEW QUESTION # 103
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?
- A. Forward traffic logs
- B. Security logs
- C. Local traffic logs
- D. System event logs
Answer: C
NEW QUESTION # 104
Refer to the exhibit.
Which contains a session list output. Based on the information shown in the exhibit, which statement is true?
- A. Destination NAT is disabled in the firewall policy.
- B. Overload NAT IP pool is used in the firewall policy.
- C. Port block allocation IP pool is used in the firewall policy.
- D. One-to-one NAT IP pool is used in the firewall policy.
Answer: D
Explanation:
Explanation
FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.
NEW QUESTION # 105
Examine this output from a debug flow:
Why did the FortiGate drop the packet?
- A. It failed the RPF check.
- B. The next-hop IP address is unreachable.
- C. It matched an explicitly configured firewall policy with the action DENY.
- D. It matched the default implicit firewall policy.
Answer: D
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
If it was dropped by RPF, the log would've been "reverse path check fail, drop" See KB ==> https://kb.fortinet.com/kb/documentLink.do?externalID=FD31702
NEW QUESTION # 106
In which two ways can RPF checking be disabled? (Choose two )
- A. Disable the RPF check at the FortiGate interface level for the source check
- B. Enable asymmetric routing.
- C. Disable strict-arc-check under system settings.
- D. Enable anti-replay in firewall policy.
Answer: B,C
NEW QUESTION # 107
......
Use Real Fortinet Achieve the NSE4_FGT-7.0 Dumps - 100% Exam Passing Guarantee: https://www.lead2passed.com/Fortinet/NSE4_FGT-7.0-practice-exam-dumps.html
Verified NSE4_FGT-7.0 Q&As - Pass Guarantee NSE4_FGT-7.0 Exam Dumps: https://drive.google.com/open?id=1wTqX2Mt-5-piVxbMGkOLwR5F36MIkQCu
