Summer Sale - Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpt65

NSE4_FGT-7.0 Questions and Answers

Note! Following NSE4_FGT-7.0 Exam is Retired now. Please select the alternative replacement for your Exam Certification. The new exam code is NSE4_FGT-7.2

NSE4_FGT-7.0 Questions and Answers

Question # 6

An administrator wants to configure timeouts for users. Regardless of the userג€™s behavior, the timer should start as soon as the user authenticates and expire after the configured value.

Which timeout option should be configured on FortiGate?

A.

auth-on-demand

B.

soft-timeout

C.

idle-timeout

D.

new-session

E.

hard-timeout

Full Access
Question # 7

Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

A.

The signature setting uses a custom rating threshold.

B.

The signature setting includes a group of other signatures.

C.

Traffic matching the signature will be allowed and logged.

D.

Traffic matching the signature will be silently dropped and logged.

Full Access
Question # 8

Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

A.

FortiGate uses the AD server as the collector agent.

B.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

C.

FortiGate does not support workstation check.

D.

FortiGate directs the collector agent to use a remote LDAP server.

Full Access
Question # 9

Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

A.

Proxy-based inspection

B.

Certificate inspection

C.

Flow-based inspection

D.

Full Content inspection

Full Access
Question # 10

How does FortiGate act when using SSL VPN in web mode?

A.

FortiGate acts as an FDS server.

B.

FortiGate acts as an HTTP reverse proxy.

C.

FortiGate acts as DNS server.

D.

FortiGate acts as router.

Full Access
Question # 11

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

A.

To detect intermediary NAT devices in the tunnel path.

B.

To dynamically change phase 1 negotiation mode aggressive mode.

C.

To encapsulation ESP packets in UDP packets using port 4500.

D.

To force a new DH exchange with each phase 2 rekey.

Full Access
Question # 12

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

A.

Source defined as Internet Services in the firewall policy.

B.

Destination defined as Internet Services in the firewall policy.

C.

Highest to lowest priority defined in the firewall policy.

D.

Services defined in the firewall policy.

E.

Lowest to highest policy ID number.

Full Access
Question # 13

When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

A.

remote user’s public IP address

B.

The public IP address of the FortiGate device.

C.

The remote user’s virtual IP address.

D.

The internal IP address of the FortiGate device.

Full Access
Question # 14

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

A.

On HQ-FortiGate, set IKE mode to Main (ID protection).

B.

On both FortiGate devices, set Dead Peer Detection to On Demand.

C.

On HQ-FortiGate, disable Diffie-Helman group 2.

D.

On Remote-FortiGate, set port2 as Interface.

Full Access
Question # 15

Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

A.

DNS

B.

ping

C.

udp-echo

D.

TWAMP

Full Access
Question # 16

Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

A.

The firmware image must be manually uploaded to each FortiGate.

B.

Only secondary FortiGate devices are rebooted.

C.

Uninterruptable upgrade is enabled by default.

D.

Traffic load balancing is temporally disabled while upgrading the firmware.

Full Access
Question # 17

Which scanning technique on FortiGate can be enabled only on the CLI?

A.

Antivirus scan

B.

Trojan scan

C.

Machine learning scan

D.

Ransomware scan

Full Access
Question # 18

An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?

A.

A phase 2 configuration is not required.

B.

This VPN cannot be used as part of a hub-and-spoke topology.

C.

A virtual IPsec interface is automatically created after the phase 1 configuration is completed.

D.

The IPsec firewall policies must be placed at the top of the list.

Full Access
Question # 19

Refer to the exhibit.

Which contains a session diagnostic output. Which statement is true about the session diagnostic output?

A.

The session is in SYN_SENT state.

B.

The session is in FIN_ACK state.

C.

The session is in FTN_WAIT state.

D.

The session is in ESTABLISHED state.

Full Access
Question # 20

Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

A.

Root VDOM

B.

FG-traffic VDOM

C.

Customer VDOM

D.

Global VDOM

Full Access
Question # 21

Which two statements ate true about the Security Fabric rating? (Choose two.)

A.

It provides executive summaries of the four largest areas of security focus.

B.

Many of the security issues can be fixed immediately by clicking Apply where available.

C.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

D.

The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

Full Access
Question # 22

What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

A.

FortiGate automatically negotiates different local and remote addresses with the remote peer.

B.

FortiGate automatically negotiates a new security association after the existing security association expires.

C.

FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

D.

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

Full Access
Question # 23

NGFW mode allows policy-based configuration for most inspection rules. Which security profile’s configuration does not change when you enable policy-based inspection?

A.

Web filtering

B.

Antivirus

C.

Web proxy

D.

Application control

Full Access
Question # 24

In which two ways can RPF checking be disabled? (Choose two )

A.

Enable anti-replay in firewall policy.

B.

Disable the RPF check at the FortiGate interface level for the source check

C.

Enable asymmetric routing.

D.

Disable strict-arc-check under system settings.

Full Access
Question # 25

Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)

A.

SSH

B.

HTTPS

C.

FTM

D.

FortiTelemetry

Full Access