Home / Fortinet / NSE4_FGT-7.2

Fortinet NSE4_FGT-7.2 Practice Test - Questions Answers, Page 11

Question list

List of questions

Question 101

(0)

In which two ways can RPF checking be disabled? (Choose two )

Question 102

(0)

Which feature in the Security Fabric takes one or more actions based on event triggers?

Question 103

(0)

Consider the topology: Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server. An administrator is investigating a problem where an application establishes a Telne

Question 104

(0)

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

Question 105

(0)

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

Question 106

(0)

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

Question 107

(0)

Refer to the exhibit, which contains a session diagnostic output. Which statement is true about the session diagnostic output?

Question 108

(0)

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pr

Question 109

(0)

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

Question 110

(0)

An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services

Question 101

In which two ways can RPF checking be disabled? (Choose two )

Enable anti-replay in firewall policy.

Disable the RPF check at the FortiGate interface level for the source check

Enable asymmetric routing.

Disable strict-arc-check under system settings.

Show Answer Comment (0)

Question 102

Which feature in the Security Fabric takes one or more actions based on event triggers?

Fabric Connectors

Automation Stitches

Security Rating

Logical Topology

Show Answer Comment (0)

Question 103

Consider the topology:

Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.

An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.

The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.

What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Set the maximum session TTL value for the TELNET service object.

Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Create a new service object for TELNET and set the maximum session TTL.

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

Show Answer Comment (0)

Question 104

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.

ADVPN is only supported with IKEv2.

Tunnels are negotiated dynamically between spokes.

Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Show Answer Comment (0)

Question 105

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

It limits the scanning of application traffic to the DNS protocol only.

It limits the scanning of application traffic to use parent signatures only.

It limits the scanning of application traffic to the browser-based technology category only.

It limits the scanning of application traffic to the application category only.

Show Answer Comment (0)

Question 106

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides

(client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

Show Answer Comment (0)

Question 107

Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is a UDP unidirectional state.

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a bidirectional TCP connection.

Show Answer Comment (0)

Question 108

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

Show Answer Comment (0)

Question 109

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

To detect intermediary NAT devices in the tunnel path.

To dynamically change phase 1 negotiation mode aggressive mode.

To encapsulation ESP packets in UDP packets using port 4500.

To force a new DH exchange with each phase 2 rekey.

Show Answer Comment (0)

Question 110

An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

Create a new service object for HTTP service and set the session TTL to never

Set the TTL value to never under config system-ttl

Set the session TTL on the HTTP policy to maximum

Show Answer Comment (0)

Total 184 questions