The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile. What order must FortiGate use when the web filter profile has features enabled, such as safe search?

Static URL filter, FortiGuard category filter, and advanced filters

DNS-based web filter and proxy-based web filter

Static URL filter, FortiGuard category filter, and advanced filters

Static domain filter, SSL inspection filter, and external connectors filters

FortiGuard category filter and rating filter

If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

Once Internet Service is selected, no other object can be added

Which statement about the IP authentication header (AH) used by IPsec is true?

AH provides data integrity bur no encryption.

AH does not provide any data integrity or encryption.

AH does not support perfect forward secrecy.

AH provides data integrity bur no encryption.

AH provides strong data integrity but weak encryption.

Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)

Uninterruptable upgrade is enabled by default.

Traffic load balancing is temporally disabled while upgrading the firmware.

The firmware image must be manually uploaded to each FortiGate.

Only secondary FortiGate devices are rebooted.

Uninterruptable upgrade is enabled by default.

Traffic load balancing is temporally disabled while upgrading the firmware.

Which two statements ate true about the Security Fabric rating? (Choose two.)

Many of the security issues can be fixed immediately by clicking Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

It provides executive summaries of the four largest areas of security focus.

Many of the security issues can be fixed immediately by clicking Apply where available.

The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.

The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.

An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

Configure split tunneling in tunnel mode.

Configure different SSL VPN realms.

Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

The CA certificate that signed the web-server certificate must be installed on the browser.

The public key of the web server certificate must be installed on the browser.

The web-server certificate must be installed on the browser.

The CA certificate that signed the web-server certificate must be installed on the browser.

The private key of the CA certificate that signed the browser certificate must be installed on the browser.

Which two statements are correct about NGFW Policy-based mode? (Choose two.)

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

NGFW policy-based mode policies support only flow inspection

NGFW policy-based mode does not require the use of central source NAT policy

NGFW policy-based mode can only be applied globally and not on individual VDOMs

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

NGFW policy-based mode policies support only flow inspection

Refer to the exhibit. Which contains a session diagnostic output. Which statement is true about the session diagnostic output?

The session is in SYN_SENT state.

The session is in FIN_ACK state.

The session is in FTN_WAIT state.

The session is in ESTABLISHED state.

Which two statements explain antivirus scanning modes? (Choose two.)

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

In proxy-based inspection mode, files bigger than the buffer size are scanned.

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

In flow-based inspection mode, files bigger than the buffer size are scanned.

Refer to the exhibit.Refer to the web filter raw logs. Based on the raw logs shown in the exhibit, which statement is correct?

Social networking web filter category is configured with the action set to authenticate.

The action on firewall policy ID 1 is set to warning.

Access to the social networking web filter category was explicitly blocked to all users.

The name of the firewall policy is all_users_web.

Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets

To finish any inspection operations

Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command.Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

The IPS engine was inspecting high volume of traffic.

The IPS engine was unable to prevent an intrusion attack .

The IPS engine was blocking all traffic.

The IPS engine will continue to run in a normal state.

By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

set webfilter-force-off disable

How does FortiGate act when using SSL VPN in web mode?

FortiGate acts as an HTTP reverse proxy.

FortiGate acts as an FDS server.

FortiGate acts as an HTTP reverse proxy.

Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

FortiGate buffers the whole file but transmits to the client at the same time.

Flow-based inspection optimizes performance compared to proxy-based inspection.

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

If a virus is detected, the last packet is delivered to the client.

The IPS engine handles the process as a standalone.

FortiGate buffers the whole file but transmits to the client at the same time.

Flow-based inspection optimizes performance compared to proxy-based inspection.

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B). Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

The flow-based inspection is used, which resets the last packet to the user.

The firewall policy performs the full content inspection on the file.

The flow-based inspection is used, which resets the last packet to the user.

The volume of traffic being inspected is too high for this model of FortiGate.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.* All traffic must be routed through the primary tunnel when both tunnels are up* The secondary tunnel must be used only if the primary tunnel goes down* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failoverWhich two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.

Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Intrusion prevention system engine

Refer to the exhibit. Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Which statement about video filtering on FortiGate is true?

It is available only on a proxy-based firewall policy.

Full SSL Inspection is not required.

It is available only on a proxy-based firewall policy.

It inspects video files hosted on file sharing services.

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

Refer to the exhibit. Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

There are five devices that are part of the security fabric.

Device detection is disabled on all FortiGate devices.

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.What is the reason for the failed virus detection by FortiGate?

The website is exempted from SSL inspection.

The selected SSL inspection profile has certificate inspection enabled.

The website is exempted from SSL inspection.

The EICAR test file exceeds the protocol options oversize limit.

The selected SSL inspection profile has certificate inspection enabled.

The browser does not trust the FortiGate self-signed CA certificate.

Refer to the exhibits. Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

FortiGate has entered conserve mode.

Administrators cannot change the configuration.

Administrators can access FortiGate only through the console port.

FortiGate has entered conserve mode.

FortiGate will start sending all files to FortiSandbox for inspection.

Administrators cannot change the configuration.

Refer to the exhibits. An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).What must the administrator do to synchronize the address object?

Change the csf setting on both devices to set downstream-access enable.

Change the csf setting on ISFW (downstream) to set configuration-sync local.

Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.

Change the csf setting on both devices to set downstream-access enable.

Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

51 Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

FortiGate can inspect sub-application traffic regardless where it was originated.

The security actions applied on the web applications will also be explicitly applied on the third-party websites.

The application signature database inspects traffic only from the original web application server.

FortiGuard maintains only one signature of each web application that is unique.

FortiGate can inspect sub-application traffic regardless where it was originated.

Refer to the exhibit. The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

Enable restrict access to trusted hosts

Enable two-factor authentication

Which two statements are correct about SLA targets? (Choose two.)

SLA targets are used only when referenced by an SD-WAN rule.

You can configure only two SLA targets per one Performance SLA.

SLA targets are required for SD-WAN rules with a Best Quality strategy.

SLA targets are used only when referenced by an SD-WAN rule.

Refer to the exhibit. Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port1 and port2 default routes are active in the routing table.

The ports default route has the highest distance.

The port3 default route has the lowest metric.

The port1 and port2 default routes are active in the routing table.

The ports default route has the highest distance.

There will be eight routes active in the routing table.

When configuring a firewall virtual wire pair policy, which following statement is true?

Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

Only a single virtual wire pair can be included in each policy.

Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

Exactly two virtual wire pairs need to be included in each policy.

An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?

Add user accounts to the Ignore User List.

Add the support of NTLM authentication.

Add user accounts to Active Directory (AD).

Add user accounts to the FortiGate group fitter.

Add user accounts to the Ignore User List.

Fortinet NSE4_FGT-7.2 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

Heartbeat interfaces have virtual IP addresses that are manually assigned.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Virtual IP addresses are used to distinguish between cluster members.

The primary device in the cluster is always assigned IP address 169.254.0.1.

Comment (0)

Fortinet NSE4_FGT-7.2 Practice Test 1

Question

Fortinet NSE4_FGT-7.2 Practice Tests

Practice Tests