Which statement regarding the firewall policy authentication timeout is true?

It is an idle timeout. The FortiGate considers a user to be 'idle' if it does not see any packets coming from the user's source IP.

It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

It is an idle timeout. The FortiGate considers a user to be 'idle' if it does not see any packets coming from the user's source MAC.

It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

Which of statement is true about SSL VPN web mode?

It supports a limited number of protocols.

The tunnel is up while the client is connected.

It supports a limited number of protocols.

The external network application sends data through the VPN.

It assigns a virtual IP address to the client.

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep 'hook=pre'&'hook=out'

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

Tunnels are negotiated dynamically between spokes.

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

By default, the admin GUI and SSL VPN portal use the same HTTPS port.

By default, FortiGate uses WINS servers to resolve names.

By default, the SSL VPN portal requires the installation of a client's certificate.

By default, split tunneling is enabled.

By default, the admin GUI and SSL VPN portal use the same HTTPS port.

FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.In this scenario, which statement about VLAN IDs is true?

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in the same subnet.

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in different subnets.

The two VLAN subinterfaces can have the same VLAN ID only if they belong to different VDOMs.

The two VLAN subinterfaces must have different VLAN IDs.

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in the same subnet.

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in different subnets.

Which statement correctly describes the use of reliable logging on FortiGate?

Reliable logging is required to encrypt the transmission of logs.

Reliable logging is enabled by default in all configuration scenarios.

Reliable logging is required to encrypt the transmission of logs.

Reliable logging can be configured only using the CLI.

Reliable logging prevents the loss of logs when the local disk is full.

Refer to the exhibit.The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output. Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

In the VIP configuration, enable arp-reply.

Configure a loopback interface with address 203.0.113.2/32.

In the VIP configuration, enable arp-reply.

Enable port forwarding on the server to map the external service port to the internal service port.

In the firewall policy configuration, enable match-vip.

What are two benefits of flow-based inspection compared to proxy-based inspection? (Choose two.)

FortiGate uses fewer resources.

FortiGate adds less latency to traffic.

FortiGate uses fewer resources.

FortiGate performs a more exhaustive inspection on traffic.

FortiGate adds less latency to traffic.

FortiGate allocates two sessions per connection.

Refer to exhibit.An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page. Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

On the Static URL Filter configuration, set Action to Exempt.

On the FortiGuard Category Based Filter configuration, set Action to Warning for Social Networking

On the Static URL Filter configuration, set Type to Simple

On the Static URL Filter configuration, set Action to Exempt.

On the Static URL Filter configuration, set Action to Monitor.

What are two functions of ZTNA? (Choose two.)

ZTNA provides a security posture check.

ZTNA provides role-based access.

ZTNA manages access through the client only.

ZTNA manages access for remote users only.

ZTNA provides a security posture check.

ZTNA provides role-based access.

Which timeout setting can be responsible for deleting SSL VPN associated sessions?

SSL VPN http-request-body-timeout

Which statement is correct regarding the use of application control for inspecting web applications?

Application control can identity child and parent applications, and perform different actions on them.

Application control signatures are organized in a nonhierarchical structure.

Application control does not require SSL inspection to identity web applications.

Application control does not display a replacement message for a blocked web application.

Refer to the exhibits.Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command. Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

The traffic sourced from the client and destined to the server is sent to FGT-1.

The cluster can load balance ICMP connections to the secondary.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

Refer to the exhibit. Based on the ZTNA tag, the security posture of the remote endpoint has changed.What will happen to endpoint active ZTNA sessions?

They will be re-evaluated to match the ZTNA policy.

They will be re-evaluated to match the endpoint policy.

They will be re-evaluated to match the firewall policy.

They will be re-evaluated to match the ZTNA policy.

They will be re-evaluated to match the security policy.

What are two features of collector agent advanced mode? (Choose two.)

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode supports nested or inherited groups.

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

In advanced mode, security profiles can be applied only to user groups, not individual users.

Advanced mode uses the Windows convention---NetBios: Domain\Username.

Advanced mode supports nested or inherited groups.

What are two characteristics of FortiGate HA cluster virtual IP addresses? (Choose two.)

Virtual IP addresses are used to distinguish between cluster members.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Virtual IP addresses are used to distinguish between cluster members.

Heartbeat interfaces have virtual IP addresses that are manually assigned.

The primary device in the cluster is always assigned IP address 169.254.0.1.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Refer to the exhibit.The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category. What are two solutions for satisfying the requirement? (Choose two.)

Configure a web override rating for download.com and select Malicious Websites as the subcategory.

Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

Configure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.

Configure a web override rating for download.com and select Malicious Websites as the subcategory.

Set the Freeware and Software Downloads category Action to Warning.

Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

Which statement about the deployment of the Security Fabric in a multi-VDOM environment is true?

VDOMs without ports with connected devices are not displayed in the topology.

Downstream devices can connect to the upstream device from any of their VDOMs.

Security rating reports can be run individually for each configured VDOM.

Each VDOM in the environment can be part of a different Security Fabric.

Refer to the exhibits.Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Apple FaceTime will be allowed, based on the Categories configuration.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Which statement is correct regarding the security fabric?

FortiGate devices must be operating in NAT mode.

FortiManager is one of the required member devices.

FortiGate devices must be operating in NAT mode.

A minimum of two Fortinet devices is required.

FortiGate Cloud cannot be used for logging purposes.

Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

Extended authentication (XAuth) to request the remote peer to provide a username and password

Pre-shared key and certificate signature as authentication methods

Extended authentication (XAuth) for faster authentication because fewer packets are exchanged

Extended authentication (XAuth) to request the remote peer to provide a username and password

No certificate is required on the remote peer when you set the certificate signature as the authentication method

Pre-shared key and certificate signature as authentication methods

You have enabled logging on a FortiGate device for event logs and all security logs, and you have set up logging to use the FortiGate local disk.What is the default behavior when the local disk is full?

Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%.

No new log is recorded after the warning is issued when log disk use reaches the threshold of 95%.

No new log is recorded until you manually clear logs from the local disk.

Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%.

Logs are overwritten and the only warning is issued when log disk use reaches the threshold of 95%.

Refer to the exhibit. Based on the raw log, which two statements are correct? (Choose two.)

Traffic belongs to the root VDOM.

Traffic is blocked because Action is set to DENY in the firewall policy.

Traffic belongs to the root VDOM.

Log severity is set to error on FortiGate.

View the exhibit. Which of the following statements are correct? (Choose two.)

The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

This is a redundant IPsec setup.

This setup requires at least two firewall policies with the action set to IPsec.

Dead peer detection must be disabled to support this type of IPsec setup.

The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

This is a redundant IPsec setup.

Examine the exhibit, which contains a virtual IP and firewall policy configuration. The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

Any available IP address in the WAN (port1) subnet 10.200. 1.0/24 66 of 108

Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

Shut down/reboot a downstream FortiGate device.

Disable FortiAnalyzer logging for a downstream FortiGate device.

Shut down/reboot a downstream FortiGate device.

Disable FortiAnalyzer logging for a downstream FortiGate device.

Log in to a downstream FortiSwitch device.

Ban or unban compromised hosts.

The IPS engine is used by which three security features? (Choose three.)

Antivirus in flow-based inspection

Web filter in flow-based inspection

Antivirus in flow-based inspection

Web filter in flow-based inspection

Fortinet NSE4_FGT-7.2 Practice Test 4 - Free Online Exam Prep & Questions

Which three statements are true regarding session-based authentication? (Choose three.)

Become a Premium Member for full access

Unlock Premium Member

Fortinet NSE4_FGT-7.2 Practice Test 4

Question

Fortinet NSE4_FGT-7.2 Practice Tests

Practice Tests