[Jan-2022] Use Real NSE4_FGT-7.0 Dumps - 100% Free NSE4_FGT-7.0 Exam Dumps
NSE4_FGT-7.0 PDF Dumps Exam Questions – Valid NSE4_FGT-7.0 Dumps
NEW QUESTION 26
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
- A. To dynamically change phase 1 negotiation mode aggressive mode.
- B. To encapsulation ESP packets in UDP packets using port 4500.
- C. To detect intermediary NAT devices in the tunnel path.
- D. To force a new DH exchange with each phase 2 rekey.
Answer: B,C
NEW QUESTION 27
Examine the exhibit, which contains a virtual IP and firewall policy configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port2) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
- A. 10.200.1.1
- B. 10.0.1.254
- C. 10.200.1.10
- D. Any available IP address in the WAN (port1) subnet 10.200.1.0/24
Answer: C
Explanation:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Objects/Virtual%20IPs.htm
NEW QUESTION 28
Which two statements are correct about NGFW Policy-based mode? (Choose two.)
- A. NGFW policy-based mode can only be applied globally and not on individual VDOMs
- B. NGFW policy-based mode policies support only flow inspection
- C. NGFW policy-based mode does not require the use of central source NAT policy
- D. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
Answer: B,D
NEW QUESTION 29
Refer to the exhibit.
Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?
- A. Custom permission for Network
- B. Read/Write permission for Log & Report
- C. Read/Write permission for Firewall
- D. CLI diagnostics commands permission
Answer: D
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220
NEW QUESTION 30
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
- A. By default, FortiGate uses WINS servers to resolve names.
- B. By default, the SSL VPN portal requires the installation of a client's certificate.
- C. By default, split tunneling is enabled.
- D. By default, the admin GUI and SSL VPN portal use the same HTTPS port.
Answer: D
NEW QUESTION 31
An administrator is running the following sniffer command:
Which three pieces of Information will be Included in me sniffer output? {Choose three.)
- A. Ethernet header
- B. Interface name
- C. Packet payload
- D. Application header
- E. IP header
Answer: B,C,E
NEW QUESTION 32
Examine the network diagram shown in the exhibit, then answer the following question:
Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?
- A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
- B. 10.4.200.0/30 is directly connected, port2
- C. 0.0.0.0/0 [20/0] via 10.4.200.2, port2
- D. 172.16.32.0/24 is directly connected, port1
Answer: D
NEW QUESTION 33
Which scanning technique on FortiGate can be enabled only on the CLI?
- A. Heuristics scan
- B. Antivirus scan
- C. Trojan scan
- D. Ransomware scan
Answer: A
NEW QUESTION 34
Which feature in the Security Fabric takes one or more actions based on event triggers?
- A. Fabric Connectors
- B. Logical Topology
- C. Automation Stitches
- D. Security Rating
Answer: C
NEW QUESTION 35
Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate uses the AD server as the collector agent.
- B. FortiGate queries AD by using the LDAP to retrieve user group information.
- C. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- D. FortiGate points the collector agent to use a remote LDAP server.
Answer: B,C
Explanation:
Fortigate Infrastructure 7.0 Study Guide P.272-273
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47732
NEW QUESTION 36
Examine this FortiGate configuration:
Examine the output of the following debug command:
Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?
- A. It is allowed and inspected as long as the inspection is flow based
- B. It is allowed and inspected, as long as the only inspection required is antivirus.
- C. It is allowed, but with no inspection
- D. It is dropped.
Answer: D
NEW QUESTION 37
An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
- A. Add the support of NTLM authentication.
- B. Add user accounts to Active Directory (AD).
- C. Add user accounts to the FortiGate group fitter.
- D. Add user accounts to the Ignore User List.
Answer: D
NEW QUESTION 38
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To generate logs
- B. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- C. To remove the NAT operation
- D. To finish any inspection operations
Answer: B
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
NEW QUESTION 39
How does FortiGate act when using SSL VPN in web mode?
- A. FortiGate acts as router.
- B. FortiGate acts as an FDS server.
- C. FortiGate acts as DNS server.
- D. FortiGate acts as an HTTP reverse proxy.
Answer: D
NEW QUESTION 40
Refer to the exhibit.
The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.
Which interface will be selected as an outgoing interface?
- A. port3
- B. port1
- C. port2
- D. port4
Answer: B
Explanation:
Port 1 shows the lowest latency.
NEW QUESTION 41
View the exhibit.
A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?
- A. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
- B. Addcting.Games is allowed based on the Categories configuration.
- C. Addicting.Games is allowed based on the Application Overrides configuration.
- D. Addicting.Games is blocked on the Filter Overrides configuration.
Answer: C
NEW QUESTION 42
When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?
- A. Universally Unique Identifier
- B. Log ID
- C. Sequence ID
- D. Policy ID
Answer: A
NEW QUESTION 43
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The volume of traffic being inspected is too high for this model of FortiGate.
- B. The flow-based inspection is used, which resets the last packet to the user.
- C. The firewall policy performs the full content inspection on the file.
- D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
Answer: B
Explanation:
* "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.
NEW QUESTION 44
In which two ways can RPF checking be disabled? (Choose two )
- A. Enable asymmetric routing.
- B. Disable strict-arc-check under system settings.
- C. Disable the RPF check at the FortiGate interface level for the source check
- D. Enable anti-replay in firewall policy.
Answer: A,B
NEW QUESTION 45
......
Ultimate NSE4_FGT-7.0 Guide to Prepare Free Latest Fortinet Practice Tests Dumps: https://killexams.practicevce.com/Fortinet/NSE4_FGT-7.0-practice-exam-dumps.html