Home / Fortinet / NSE4_FGT-7.2

Fortinet NSE4_FGT-7.2 Practice Test - Questions Answers, Page 19

Question list

List of questions

Question 181

(0)

What is the primary FortiGate election process when the HA override setting is disabled?

Question 182

(0)

Refer to the exhibit to view the firewall policy Why would the firewall policy not block a well-known virus, for example eicar?

Question 183

(0)

Refer to the exhibits. Exhibit A Exhibit B The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authenti

Question 184

(0)

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

Question 181

What is the primary FortiGate election process when the HA override setting is disabled?

Connected monitored ports > Priority > HA uptime > FortiGate serial number

Connected monitored ports > Priority > System uptime > FortiGate serial number

Connected monitored ports > HA uptime > Priority > FortiGate serial number

Connected monitored ports > System uptime > Priority > FortiGate serial number

Show Answer Comment (0)

Question 182

Refer to the exhibit to view the firewall policy

Why would the firewall policy not block a well-known virus, for example eicar?

Web filter is not enabled on the firewall policy to complement the antivirus profile.

The firewall policy does not apply deep content inspection.

The firewall policy is not configured in proxy-based inspection mode.

The action on the firewall policy is not set to deny

Show Answer Comment (0)

Question 183

Refer to the exhibits.

Exhibit A

Exhibit B

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.

How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

If there is a fall-through policy in place, users will not be prompted for authentication.

Authentication is enforced at a policy level; all users will be prompted for authentication.

All users will be prompted for authentication, users from the Sales group can authenticate successfully with the correct credentials.

All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.

Show Answer Comment (0)

Question 184

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The host field in the HTTP header

The serial number in the server certificate

The subject field in the server certificate

Show Answer Comment (0)

Suggested answer: A, B, E

Explanation:

A) The server name indication (SNI) extension in the client hello message. This is correct. This is a piece of information that FortiGate uses to identify the hostname of the SSL server when SSL certificate inspection is enabled. The SNI extension is a feature of the TLS protocol that allows a client to indicate the hostname of the server it wants to connect to during the TLS handshake.This helps the server to present the appropriate certificate for the requested hostname, especially when the server hosts multiple domains on the same IP address1.FortiGate can use the SNI extension in the client hello message to identify the hostname of the SSL server and verify it against the server certificate2.

B) The subject alternative name (SAN) field in the server certificate. This is correct. This is a piece of information that FortiGate uses to identify the hostname of the SSL server when SSL certificate inspection is enabled. The SAN field is an extension of the X.509 certificate standard that allows a certificate to specify multiple hostnames or IP addresses that are valid for the certificate.This helps the certificate to support multiple domains or subdomains on the same server, or multiple servers with different IP addresses3.FortiGate can use the SAN field in the server certificate to identify the hostname of the SSL server and verify it against the client request2.

E) The subject field in the server certificate. This is correct. This is a piece of information that FortiGate uses to identify the hostname of the SSL server when SSL certificate inspection is enabled. The subject field is a part of the X.509 certificate standard that contains information about the identity of the entity that owns the certificate, such as common name, organization, country, and so on.The common name usually specifies the hostname or domain name of the server that owns the certificate4.FortiGate can use the subject field in the server certificate to identify the hostname of the SSL server and verify it against the client request2.

Total 184 questions