What are two functions of the ZTNA rule? (Choose two.)

It applies security profiles to protect traffic.

It redirects the client request to the access proxy.

It applies security profiles to protect traffic.

An administrator configures outgoing interface any in a firewall policy.What is the result of the policy list view?

Interface Pair view is disabled.

Refer to the exhibit showing a debug flow output. What two conclusions can you make from the debug flow output? (Choose two.)

The debug flow is for ICMP traffic.

Anew traffic session was created.

The debug flow is for ICMP traffic.

The default route is required to receive a reply.

Anew traffic session was created.

A firewall policy allowed the connection.

Refer to the exhibit.The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device. Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)

FortiGate allocates port blocks on a first-come, first-served basis.

FortiGate generates a system event log for every port block allocation made per user.

FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.

FortiGate allocates port blocks on a first-come, first-served basis.

FortiGate generates a system event log for every port block allocation made per user.

FortiGate allocates 128 port blocks per user.

Which statement about video filtering on FortiGate is true?

its available only on a proxy-based firewall policy.

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

It does not require a separate FortiGuard license.

Full SSL inspection is not required.

its available only on a proxy-based firewall policy.

Which statement describes a characteristic of automation stitches?

They can run multiple actions simultaneously.

They can have one or more triggers.

They can be run only on devices in the Security Fabric.

They can run multiple actions simultaneously.

They can be created on any device in the fabric.

Refer to the exhibits.Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration.The WAN (port1) interface has the IP address 10.200.1.1/24.The LAN (port3) interface has the IP address 10.0.1.254/24. If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

10.200.3.1, 10.0.1.10, and 443, respectively

10.0.1.254, 10.0.1.10, and 443, respectively

10.0.1.254, 10.200.1.10, and 443, respectively

10.200.3.1, 10.0.1.10, and 443, respectively

10.0.1.254, 10.0.1.10, and 10443, respectively

Refer to the exhibit.The exhibit shows the output of a diagnose command. What does the output reveal about the policy route?

It is an SDWAN rule in policy route.

It is an ISDB route in policy route.

It is an ISDB policy route with an SDWAN rule.

It is an SDWAN rule in policy route.

Refer to the exhibit.A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

On HQ-FortiGate, set Encryption to AES256.

On Remote-FortiGate, set Seconds to 43200.

On HQ-FortiGate, set Encryption to AES256.

On HQ-FortiGate, enable Diffie-Hellman Group 2.

On HQ-FortiGate, enable Auto-negotiate.

Which two statements describe how the RPF check is used? (Choose two.)

The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

The RPF check is run on the first sent packet of any new session.

The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

The RPF check is run on the first sent and reply packet of any new session.

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

What is a reason for triggering IPS fail open?

The IPS socket buffer is full and the IPS engine cannot process additional packets.

The IPS engine cannot decode a packet.

The administrator enabled NTurbo acceleration.

How can you disable RPF checking?

Disable src-check on the interface level settings

Disable strict-src-check under system settings.

Disable src-check on the interface level settings

Unset fail-alert-interfaces on the interface level settings.

Disable fail-detect on the interface level settings.

What are two features of the NGFW policy-based mode? (Choose two.)

NGFW policy-based mode policies support only flow inspection.

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

NGFW policy-based mode does not require the use of central source NAT policy.

NGFW policy-based mode can only be applied globally and not on individual VDOMs_

NGFW policy-based mode policies support only flow inspection.

NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

Refer to the exhibit. The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.Two PCS, PCI and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the Intarnet_Based on the information shown in the exhibit, which three configuration changes should the administrator make to fix the connectivity issue for PC3? (Choose three.)

In the IP pool configuration, set type to overload.

In the IP pool configuration, set endip to 192.2. O .12

In the firewall policy configuration, disable ippool.

In the IP pool configuration, set type to overload.

Configure 192.2. O. 12/24 as the secondary IP address on port1

Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

In the IP pool configuration, set endip to 192.2. O .12

In the firewall policy configuration, disable ippool.

Refer to the exhibit. In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.What should the administrator do next to troubleshoot the problem?

Run a sniffer on the web server.

Capture the traffic using an external sniffer connected to port1.

Execute another sniffer in the FortiGate, this time with the filter host 10.0.1.10

What is the primary FortiGate election process when the HA override setting is disabled?

Connected monitored ports > HA uptime > Priority > FortiGate serial number

Connected monitored ports > Priority > HA uptime > FortiGate serial number

Connected monitored ports > Priority > System uptime > FortiGate serial number

Connected monitored ports > HA uptime > Priority > FortiGate serial number

Connected monitored ports > System uptime > Priority > FortiGate serial number

Refer to the exhibit to view the firewall policyWhy would the firewall policy not block a well-known virus, for example eicar?

The firewall policy does not apply deep content inspection.

Web filter is not enabled on the firewall policy to complement the antivirus profile.

The firewall policy does not apply deep content inspection.

The firewall policy is not configured in proxy-based inspection mode.

The action on the firewall policy is not set to deny

Refer to the exhibits.Exhibit A Exhibit B The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.

If there is a fall-through policy in place, users will not be prompted for authentication.

Authentication is enforced at a policy level; all users will be prompted for authentication.

All users will be prompted for authentication, users from the Sales group can authenticate successfully with the correct credentials.

All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The subject field in the server certificate

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The host field in the HTTP header

The serial number in the server certificate

The subject field in the server certificate

Fortinet NSE4_FGT-7.2 Practice Test 5 - Free Online Exam Questions 161-184

Refer to the exhibit, which contains a static route configuration.

An administrator created a static route for Amazon Web Services.

Fortinet NSE4_FGT-7.2 image Question 161 26234 09182024185939000000

Which CLI command must the administrator use to view the route?

Become a Premium Member for full access

Unlock Premium Member

Fortinet NSE4_FGT-7.2 Practice Test 5

Question

Fortinet NSE4_FGT-7.2 Practice Tests

Practice Tests