An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

The interface has been configured for one-arm sniffer.

The interface is a member of a virtual wire pair.

The operation mode is transparent.

The interface has been configured for one-arm sniffer.

The interface is a member of a virtual wire pair.

The operation mode is transparent.

The interface is a member of a zone.

Captive portal is enabled in the interface.

Which two statements are correct about a software switch on FortiGate? (Choose two.)

It can be configured only when FortiGate is operating in NAT mode

All interfaces in the software switch share the same IP address

It can be configured only when FortiGate is operating in NAT mode

Can act as a Layer 2 switch as well as a Layer 3 router

All interfaces in the software switch share the same IP address

It can group only physical interfaces

Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate queries AD by using the LDAP to retrieve user group information.

FortiGate points the collector agent to use a remote LDAP server.

FortiGate uses the AD server as the collector agent.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate queries AD by using the LDAP to retrieve user group information.

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

It limits the scope of application control to scan application traffic based on application category only.

It limits the scope of application control to the browser-based technology category only.

It limits the scope of application control to scan application traffic based on application category only.

It limits the scope of application control to scan application traffic using parent signatures only

It limits the scope of application control to scan application traffic on DNS protocol only.

Examine this output from a debug flow: Why did the FortiGate drop the packet?

It matched the default implicit firewall policy.

The next-hop IP address is unreachable.

It matched an explicitly configured firewall policy with the action DENY.

It matched the default implicit firewall policy.

Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

Web filter in flow-based inspection

Antivirus in flow-based inspection

Web filter in flow-based inspection

Antivirus in flow-based inspection

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Log downloads from the GUI are limited to the current filter view

Log backups from the CLI cannot be restored to another FortiGate. C. Log backups from the CLI can be configured to upload to FTP as a scheduled time D. Log downloads from the GUI are stored as LZ4 compressed files.

Log downloads from the GUI are limited to the current filter view

Log backups from the CLI cannot be restored to another FortiGate. C. Log backups from the CLI can be configured to upload to FTP as a scheduled time D. Log downloads from the GUI are stored as LZ4 compressed files.

Refer to the exhibit.An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option. What is the impact of using the Include in every user group option in a RADIUS configuration?

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

Refer to the exhibit. Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

CLI diagnostics commands permission

Read/Write permission for Log & Report

CLI diagnostics commands permission

Read/Write permission for Firewall

Refer to the exhibits.The exhibits show a network diagram and firewall configurations.An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver. In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)

Set the Destination address as Deny_IP in the Allow-access policy.

Enable match vip in the Deny policy.

Disable match-vip in the Deny policy.

Set the Destination address as Deny_IP in the Allow-access policy.

Enable match vip in the Deny policy.

Set the Destination address as Web_server in the Deny policy.

Refer to the exhibit.Refer to the FortiGuard connection debug output. Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

One server was contacted to retrieve the contract information.

FortiGate is using default FortiGuard communication settings.

A local FortiManager is one of the servers FortiGate communicates with.

One server was contacted to retrieve the contract information.

There is at least one server that lost packets consecutively.

FortiGate is using default FortiGuard communication settings.

FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.In this scenario, what are two requirements for the VLAN ID? (Choose two.)

The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.

The two VLAN subinterfaces must have different VLAN IDs.

The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.

The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.

The two VLAN subinterfaces must have different VLAN IDs.

The two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

FortiGate automatically negotiates different local and remote addresses with the remote peer.

FortiGate automatically negotiates a new security association after the existing security association expires.

FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

The Services field removes the requirement to create multiple VIPs for different services.

The Services field prevents SNAT and DNAT from being combined in the same policy.

The Services field is used when you need to bundle several VIPs into VIP groups.

The Services field removes the requirement to create multiple VIPs for different services.

The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.

In which two ways can RPF checking be disabled? (Choose two )

Disable strict-arc-check under system settings.

Enable anti-replay in firewall policy.

Disable the RPF check at the FortiGate interface level for the source check

Disable strict-arc-check under system settings.

Consider the topology:Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Create a new service object for TELNET and set the maximum session TTL.

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

Set the maximum session TTL value for the TELNET service object.

Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Create a new service object for TELNET and set the maximum session TTL.

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

Tunnels are negotiated dynamically between spokes.

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

It limits the scanning of application traffic to the browser-based technology category only.

It limits the scanning of application traffic to the DNS protocol only.

It limits the scanning of application traffic to use parent signatures only.

It limits the scanning of application traffic to the browser-based technology category only.

It limits the scanning of application traffic to the application category only.

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides(client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Refer to the exhibit, which contains a session diagnostic output. Which statement is true about the session diagnostic output?

The session is a bidirectional UDP connection.

The session is a UDP unidirectional state.

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a bidirectional TCP connection.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match. Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On Remote-FortiGate, set port2 as Interface.

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

To detect intermediary NAT devices in the tunnel path.

To encapsulation ESP packets in UDP packets using port 4500.

To detect intermediary NAT devices in the tunnel path.

To dynamically change phase 1 negotiation mode aggressive mode.

To encapsulation ESP packets in UDP packets using port 4500.

To force a new DH exchange with each phase 2 rekey.

An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

Create a new service object for HTTP service and set the session TTL to never

Set the TTL value to never under config system-ttl

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

Create a new service object for HTTP service and set the session TTL to never

Set the TTL value to never under config system-ttl

Set the session TTL on the HTTP policy to maximum

A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?

Implement web filter authentication for the specified website.

Implement a web filter category override for the specified website

Implement a DNS filter for the specified website.

Implement web filter quotas for the specified website

Implement web filter authentication for the specified website.

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.What is the reason for the certificate warning errors?

The browser does not trust the certificate used by FortiGate for SSL inspection.

The matching firewall policy is set to proxy inspection mode.

The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

The full SSL inspection feature does not have a valid license.

The browser does not trust the certificate used by FortiGate for SSL inspection.

Which two statements are true about the RPF check? (Choose two.)

The RPF check is run on the first sent packet of any new session.

RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

The RPF check is run on the first sent and reply packet of any new session.

RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?

The administrator must use a FortiAuthenticator device

The administrator can register the same FortiToken on more than one FortiGate.

The administrator must use a FortiAuthenticator device

The administrator can use a third-party radius OTP server.

The administrator must use the user self-registration server.

Which two statements are true when FortiGate is in transparent mode? (Choose two.)

By default, all interfaces are part of the same broadcast domain.

FortiGate forwards frames without changing the MAC address.

By default, all interfaces are part of the same broadcast domain.

The existing network IP schema must be changed when installing a transparent mode.

Static routes are required to allow traffic to the next hop.

FortiGate forwards frames without changing the MAC address.

Examine this PAC file configuration.Which of the following statements are true? (Choose two.)

Browsers can be configured to retrieve this PAC file from the FortiGate.

Any web request fortinet.com is allowed to bypass the proxy.

Browsers can be configured to retrieve this PAC file from the FortiGate.

Any web request to the 172.25. 120.0/24 subnet is allowed to bypass the proxy.

All requests not made to Fortinet.com or the 172.25. 120.0/24 subnet, have to go through altproxy.corp.com: 8060.

Any web request fortinet.com is allowed to bypass the proxy.

Fortinet NSE4_FGT-7.2 Practice Test 3 - Free Online Exam Prep & Questions

Which of the following statements about central NAT are true? (Choose two.)

IP tool references must be removed from existing firewall policies before enabling central NAT .

Central NAT can be enabled or disabled from the CLI only.

Source NAT, using central NAT, requires at least one central SNAT policy.

Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

Comment (0)

Fortinet NSE4_FGT-7.2 Practice Test 3

Question

Fortinet NSE4_FGT-7.2 Practice Tests

Practice Tests