Steps Necessary To Pass The NSE4_FGT-7.0 Exam from Training Expert Lead2Passed
Valid Way To Pass Fortinet NSE 4's NSE4_FGT-7.0 Exam
NEW QUESTION # 88
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)
- A. On both FortiGate devices, set Dead Peer Detection to On Demand.
- B. On HQ-FortiGate, set IKE mode to Main (ID protection).
- C. On HQ-FortiGate, disable Diffie-Helman group 2.
- D. On Remote-FortiGate, set port2 as Interface.
Answer: B,D
NEW QUESTION # 89
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The host field in the HTTP header
- B. The server name indication (SNI) extension in the client hello message
- C. The subject field in the server certificate
- D. The serial number in the server certificate
- E. The subject alternative name (SAN) field in the server certificate
Answer: B,C,E
NEW QUESTION # 90
An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?
- A. Enable asymmetric routing at the interface level.
- B. Enable asymmetric routing, so the RPF check will be bypassed.
- C. Disable the RPF check at the FortiGate interface level for the reply check.
- D. Disable the RPF check at the FortiGate interface level for the source check.
Answer: D
NEW QUESTION # 91
An administrator wants to configure timeouts for users. Regardless of the user's behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?
- A. hard-timeout
- B. idle-timeout
- C. new-session
- D. soft-timeout
- E. auth-on-demand
Answer: A
NEW QUESTION # 92
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
- A. On HQ-FortiGate, set Encryption to AES256.
- B. On HQ-FortiGate, enable Diffie-Hellman Group 2.
- C. On Remote-FortiGate, set Seconds to 43200.
- D. On HQ-FortiGate, enable Auto-negotiate.
Answer: A
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/168495 Explanation:
Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.
NEW QUESTION # 93
Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?
- A. Security Posture
- B. Automated Response
- C. Fabric Coverage
- D. Optimization
Answer: A
NEW QUESTION # 94
Refer to the exhibit.
Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?
- A. Custom permission for Network
- B. Read/Write permission for Firewall
- C. Read/Write permission for Log & Report
- D. CLI diagnostics commands permission
Answer: D
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220
NEW QUESTION # 95
Which three statements about a flow-based antivirus profile are correct? (Choose three.)
- A. Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.
- B. FortiGate buffers the whole file but transmits to the client simultaneously.
- C. IPS engine handles the process as a standalone.
- D. If the virus is detected, the last packet is delivered to the client.
- E. Optimized performance compared to proxy-based inspection.
Answer: A,B,E
NEW QUESTION # 96
A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?
- A. The browser requires a software update.
- B. There are network connectivity issues.
- C. FortiGate does not support full SSL inspection when web filtering is enabled.
- D. The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.
Answer: D
NEW QUESTION # 97
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster?
(Choose two.)
- A. NTP
- B. DNS
- C. FortiGuard web filter cache
- D. FortiGate hostname
Answer: A,B
Explanation:
Explanation
Fortigate Hostname is not synchronized between cluster member. Hostname and Licences (Foritguard) are not synchronized
NEW QUESTION # 98
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration?
(Choose three.)
- A. The IP version of the sources and destinations in a policy must match.
- B. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.
- C. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.
- D. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.
- E. The IP version of the sources and destinations in a firewall policy must be different.
Answer: A,C,D
NEW QUESTION # 99
Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?
- A. FortiGuard maintains only one signature of each web application that is unique.
- B. FortiGate can inspect sub-application traffic regardless where it was originated.
- C. The security actions applied on the web applications will also be explicitly applied on the third-party websites.
- D. The application signature database inspects traffic only from the original web application server.
Answer: B
Explanation:
Reference:
https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/303d_FortiGu
NEW QUESTION # 100
Refer to the exhibit showing a debug flow output.
Which two statements about the debug flow output are correct? (Choose two.)
- A. A firewall policy allowed the connection.
- B. A new traffic session is created.
- C. The debug flow is of ICMP traffic.
- D. The default route is required to receive a reply.
Answer: B,C
NEW QUESTION # 101
Refer to the exhibit.
The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?
- A. Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.
- B. Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.
- C. Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.
- D. Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.
Answer: A
NEW QUESTION # 102
Refer to the exhibit.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
- A. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"
- B. Execute a debug flow.
- C. Run a sniffer on the web server.
- D. Capture the traffic using an external sniffer connected to port1.
Answer: B
NEW QUESTION # 103
......
All NSE4_FGT-7.0 Dumps and Fortinet NSE 4 - FortiOS 7.0 Training Courses: https://www.lead2passed.com/Fortinet/NSE4_FGT-7.0-practice-exam-dumps.html
Free Test Engine For Fortinet NSE 4 - FortiOS 7.0 Certification Exams: https://drive.google.com/open?id=1wTqX2Mt-5-piVxbMGkOLwR5F36MIkQCu
