Fortinet NSE4_FGT-7.2 Exam Dumps Opportunity To acquire Highest Result 2023

Jonnie Karnath2023-03-08T05:47:42+00:00

If you are preparing for the Fortinet NSE 4 – FortiOS 7.2 exam, then you should consider using Fortinet NSE4_FGT-7.2 exam dumps from Certspots. These questions are designed to help you acquire the highest possible result on the exam. Fortinet NSE4_FGT-7.2 exam dumps from Certspots are updated regularly to ensure that they are aligned with the latest exam syllabus and exam pattern. This ensures that you are getting the most relevant and up-to-date information. By using these Fortinet NSE4_FGT-7.2 exam dumps, you can increase your chances of passing the exam on your first attempt and acquiring the highest possible result.

Page 1 of 5

1. Which statement regarding the firewall policy authentication timeout is true?

It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source I

It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MA

It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

2. Which statement correctly describes the use of reliable logging on FortiGate?

Reliable logging is enabled by default in all configuration scenarios.

Reliable logging is required to encrypt the transmission of logs.

Reliable logging can be configured only using the CL

Reliable logging prevents the loss of logs when the local disk is full.

3. On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?

System event logs

Forward traffic logs

Local traffic logs

Security logs

4. Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.

Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

5. View the exhibit.

Which of the following statements are correct? (Choose two.)

This setup requires at least two firewall policies with the action set to IPsec.

Dead peer detection must be disabled to support this type of IPsec setup.

The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

This is a redundant IPsec setup.

6. A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

The two VLAN sub interfaces must have different VLAN IDs.

The two VLAN sub interfaces can have the same VLAN ID, only if they belong to different VDOMs.

The two VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

7. Which statement is correct regarding the use of application control for inspecting web applications?

Application control can identity child and parent applications, and perform different actions on them.

Application control signatures are organized in a nonhierarchical structure.

Application control does not require SSL inspection to identity web applications.

Application control does not display a replacement message for a blocked web application.

8. Refer to the exhibit.

The exhibit shows the output of a diagnose command.

What does the output reveal about the policy route?

It is an ISDB route in policy route.

It is a regular policy route.

It is an ISDB policy route with an SDWAN rule.

It is an SDWAN rule in policy route.

9. Which statement about video filtering on FortiGate is true?

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

It does not require a separate FortiGuard license.

Full SSL inspection is not required.

Otis available only on a proxy-based firewall policy.

10. Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

DNS

ping

udp-echo

TWAMP

Page 2 of 5

11. Which three statements are true regarding session-based authentication? (Choose three.)

HTTP sessions are treated as a single user.

IP sessions from the same source IP address are treated as a single user.

It can differentiate among multiple clients behind the same source IP address.

It requires more resources.

It is not recommended if multiple users are behind the source NAT

12. A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

The browser requires a software update.

FortiGate does not support full SSL inspection when web filtering is enabled.

The CA certificate set on the SSL/SSH inspection profile has not been imported into the browser.

There are network connectivity issues.

13. In an explicit proxy setup, where is the authentication method and database configured?

Proxy Policy

Authentication Rule

Firewall Policy

Authentication scheme

14. If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

IP address

Once Internet Service is selected, no other object can be added

User or User Group

FQDN address

15. An administrator has configured a strict RPF check on FortiGate.

Which statement is true about the strict RPF check?

The strict RPF check is run on the first sent and reply packet of any new session.

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

16. Which statement about the policy ID number of a firewall policy is true?

It is required to modify a firewall policy using the CL

It represents the number of objects used in the firewall policy.

It changes when firewall policies are reordered.

It defines the order in which rules are processed.

17. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

FortiCache

FortiSIEM

FortiAnalyzer

FortiSandbox

FortiCloud

18. An administrator needs to increase network bandwidth and provide redundancy.

What interface type must the administrator select to bind multiple FortiGate interfaces?

VLAN interface

Software Switch interface

Aggregate interface

Redundant interface

19. An administrator has configured outgoing Interface any in a firewall policy.

Which statement is true about the policy list view?

Policy lookup will be disabled.

By Sequence view will be disabled.

Search option will be disabled

Interface Pair view will be disabled.

20. Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets

To finish any inspection operations

To remove the NAT operation

To generate logs

Page 3 of 5

21. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

22. What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

Full Content inspection

Proxy-based inspection

Certificate inspection

Flow-based inspection

23. Refer to exhibit.

An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

On the FortiGuard Category Based Filter configuration, set Action to Warning for Social Networking

On the Static URL Filter configuration, set Type to Simple

On the Static URL Filter configuration, set Action to Exempt.

On the Static URL Filter configuration, set Action to Monitor.

24. Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Antivirus engine

Intrusion prevention system engine

Flow engine

Detection engine

25. What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

FortiGate automatically negotiates different local and remote addresses with the remote peer.

FortiGate automatically negotiates a new security association after the existing security association expires.

FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

26. Which statement describes a characteristic of automation stitches?

They can have one or more triggers.

They can be run only on devices in the Security Fabric.

They can run multiple actions simultaneously.

They can be created on any device in the fabric.

27. Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24.

The LAN (port3) interface has the IP address 10.0. 1.254/24.

A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).

Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.

Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

10.200. 1. 149

10.200. 1. 1

10.200. 1.49

10.200. 1.99

28. Which two statements are correct about SLA targets? (Choose two.)

You can configure only two SLA targets per one Performance SL

SLA targets are optional.

SLA targets are required for SD-WAN rules with a Best Quality strategy.

SLA targets are used only when referenced by an SD-WAN rule.

29. Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep "hook=pre"&"hook=out"

30. Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem.

With this configuration, which statement is true?

Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

A static route is required on the To_Internet VDOM to allow LAN users to access the internet.

Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.

Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDO

Page 4 of 5

31. Which two statements are correct about a software switch on FortiGate? (Choose two.)

It can be configured only when FortiGate is operating in NAT mode

Can act as a Layer 2 switch as well as a Layer 3 router

All interfaces in the software switch share the same IP address

It can group only physical interfaces

32. Which statement about video filtering on FortiGate is true?

Full SSL Inspection is not required.

It is available only on a proxy-based firewall policy.

It inspects video files hosted on file sharing services.

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

33. An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.

What must an administrator do to achieve this objective?

The administrator can register the same FortiToken on more than one FortiGate.

The administrator must use a FortiAuthenticator device

The administrator can use a third-party radius OTP server.

The administrator must use the user self-registration server.

34. Refer to the exhibit.

Which contains a network diagram and routing table output.

The Student is unable to access Webserver.

What is the cause of the problem and what is the solution for the problem?

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

35. CORRECT TEXT

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Security policy

SSL inspection and authentication policy

36. Refer to the exhibits.

Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

The traffic sourced from the client and destined to the server is sent to FGT-1.

The cluster can load balance ICMP connections to the secondary.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

37. Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It always authorizes the traffic without requiring authentication.

It drops the traffic.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

38. Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

The client FortiGate requires a client certificate signed by the CA on the server FortiGate.

The client FortiGate requires a manually added route to remote subnets.

The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VP

The server FortiGate requires a CA certificate to verify the client FortiGate certificate.

39. Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLA

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

40. Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Source defined as Internet Services in the firewall policy.

Destination defined as Internet Services in the firewall policy.

Highest to lowest priority defined in the firewall policy.

Services defined in the firewall policy.

Lowest to highest policy ID number.

Page 5 of 5

41. Which of the following SD-WAN load balancing method use interface weight value to distribute traffic? (Choose two.)

Source IP

Spillover

Volume

Session

42. Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep "hook=pre"&"hook=out"

43. What are two benefits of flow-based inspection compared to proxy-based inspection? (Choose two.)

FortiGate uses fewer resources.

FortiGate performs a more exhaustive inspection on traffic.

FortiGate adds less latency to traffic.

FortiGate allocates two sessions per connection.

44. Refer to the exhibit.

The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.

Which interface will be selected as an outgoing interface?

port2

port4

port3

port1

45. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

Enable Dead Peer Detection.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

46. Refer to the exhibits.

Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10.0.1.254/24.

If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

10.0.1.254, 10.0.1.10, and 443, respectively

10.0.1.254, 10.0.1.10, and 10443, respectively

10.200.3.1, 10.0.1.10, and 443, respectively

47. Examine this PAC file configuration.

Which of the following statements are true? (Choose two.)

Browsers can be configured to retrieve this PAC file from the FortiGate.

Any web request to the 172.25. 120.0/24 subnet is allowed to bypass the proxy.

All requests not made to Fortinet.com or the 172.25. 120.0/24 subnet, have to go through altproxy.corp.com: 8060.

Any web request fortinet.com is allowed to bypass the proxy.

By Jonnie Karnath Fortinet Free Dumps Fortinet NSE 4 - FortiOS 7.2, Fortinet NSE4_FGT-7.2 free dumps, NSE4_FGT-7.2, NSE4_FGT-7.2 practice test questions 0 Comments

Facebook Twitter LinkedIn Google + Email