Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

The keyUsage extension must be set to keyCertSign.

The CA extension must be set to TRUE.

The keyUsage extension must be set to keyCertSign.

The common name on the subject field must use a wildcard name.

The issuer must be a public CA.

The CA extension must be set to TRUE.

Refer to the exhibit. The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem .With this configuration, which statement is true?

Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.

A static route is required on the To_Internet VDOM to allow LAN users to access the internet.

Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.

Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.

Refer to the exhibit. The exhibit shows the IPS sensor configuration.If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will reset all connections that match these signatures.

The sensor will gather a packet log for all matched traffic.

Refer to the exhibit showing a debug flow output. Which two statements about the debug flow output are correct? (Choose two.)

The debug flow is of ICMP traffic.

A new traffic session is created.

The debug flow is of ICMP traffic.

A firewall policy allowed the connection.

A new traffic session is created.

The default route is required to receive a reply.

Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.

The server FortiGate requires a CA certificate to verify the client FortiGate certificate.

The client FortiGate requires a client certificate signed by the CA on the server FortiGate.

The client FortiGate requires a manually added route to remote subnets.

The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.

The server FortiGate requires a CA certificate to verify the client FortiGate certificate.

Which statement about the policy ID number of a firewall policy is true?

It is required to modify a firewall policy using the CLI.

It represents the number of objects used in the firewall policy.

It changes when firewall policies are reordered.

It defines the order in which rules are processed.

Refer to the exhibits. The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?

Change the SSL VPN port on the client.

Change the SSL VPN portal to the tunnel.

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

Strict RPF checks the best route back to the source using the incoming interface.

The strict RPF check is run on the first sent and reply packet of any new session.

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

Refer to the exhibits. The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.Which part of the policy configuration must you change to resolve the issue?

Make SSL inspection needs to be a deep content inspection.

Force access to Facebook using the HTTP service.

Get the additional application signatures are required to add to the security policy.

Add Facebook in the URL category in the security policy.

Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check .

FortiGate uses the AD server as the collector agent.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check .

FortiGate directs the collector agent to use a remote LDAP server.

Refer to the exhibit. Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

Traffic matching the signature will be silently dropped and logged.

The signature setting uses a custom rating threshold.

The signature setting includes a group of other signatures.

Traffic matching the signature will be allowed and logged.

Traffic matching the signature will be silently dropped and logged.

Refer to the exhibit. An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.

The Enable probe packets setting is not enabled.

The Detection Mode setting is not set to Passive.

Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.

The configured participants are not SD-WAN members.

The Enable probe packets setting is not enabled.

Refer to the exhibit. Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

One-to-one NAT IP pool is used in the firewall policy.

Destination NAT is disabled in the firewall policy.

One-to-one NAT IP pool is used in the firewall policy.

Overload NAT IP pool is used in the firewall policy.

Port block allocation IP pool is used in the firewall policy.

Refer to the exhibit. The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate SN FGVM010000064692 has the higher HA priority.

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

Refer to the exhibit. The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate SN FGVM010000064692 has the higher HA priority.

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

On HQ-FortiGate, set Encryption to AES256.

On HQ-FortiGate, enable Auto-negotiate.

On Remote-FortiGate, set Seconds to 43200.

On HQ-FortiGate, enable Diffie-Hellman Group 2.

On HQ-FortiGate, set Encryption to AES256.

An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?

Interface Pair view will be disabled.

Policy lookup will be disabled.

By Sequence view will be disabled.

Interface Pair view will be disabled.

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

The NetSession Enum function is used to track user logouts.

The collector agent uses a Windows API to query DCs for user logins.

NetAPI polling can increase bandwidth usage in large networks.

The collector agent must search security event logs.

The NetSession Enum function is used to track user logouts.

An administrator has configured the following settings: What are the two results of this configuration? (Choose two.)

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

Device detection on all interfaces is enforced for 30 minutes.

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

Examine this FortiGate configuration: How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It authenticates the traffic using the authentication scheme SCHEME1.

It always authorizes the traffic without requiring authentication.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

Refer to the exhibit. Which contains a network diagram and routing table output.The Student is unable to access Webserver.What is the cause of the problem and what is the solution for the problem?

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

The first reply packet for Student failed the RPF check . This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port3.

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep 'hook=pre'&'hook=out'

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Source defined as Internet Services in the firewall policy.

Destination defined as Internet Services in the firewall policy.

Services defined in the firewall policy.

Source defined as Internet Services in the firewall policy.

Destination defined as Internet Services in the firewall policy.

Highest to lowest priority defined in the firewall policy.

Services defined in the firewall policy.

Lowest to highest policy ID number.

Refer to the exhibit to view the application control profile. Based on the configuration, what will happen to Apple FaceTime?

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn

Apple FaceTime will be allowed, based on the Categories configuration.

An administrator must disable RPF check to investigate an issue.Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Disable the RPF check at the FortiGate interface level for the source check.

Enable asymmetric routing, so the RPF check will be bypassed.

Disable the RPF check at the FortiGate interface level for the source check.

Disable the RPF check at the FortiGate interface level for the reply check .

Enable asymmetric routing at the interface level.

Fortinet NSE4_FGT-7.2 Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

Which two statements are true about the FGCP protocol? (Choose two.)

FGCP elects the primary FortiGate device.

FGCP is not used when FortiGate is in transparent mode.

FGCP runs only over the heartbeat links.

FGCP is used to discover FortiGate devices in different HA groups.

Comment (0)

Fortinet NSE4_FGT-7.2 Practice Test 2

Question

Fortinet NSE4_FGT-7.2 Practice Tests

Practice Tests