ExamGecko
Login
Home / Fortinet / NSE4_FGT-7.2 / List of questions
Ask Question

Fortinet NSE4_FGT-7.2 Practice Test - Questions Answers, Page 3

List of questions

Question 21

Report Export Collapse

Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
If a virus is detected, the last packet is delivered to the client.
If a virus is detected, the last packet is delivered to the client.
The IPS engine handles the process as a standalone.
The IPS engine handles the process as a standalone.
FortiGate buffers the whole file but transmits to the client at the same time.
FortiGate buffers the whole file but transmits to the client at the same time.
Flow-based inspection optimizes performance compared to proxy-based inspection.
Flow-based inspection optimizes performance compared to proxy-based inspection.
Suggested answer: A, D, E
asked 18/09/2024
Rakesh Sonawane
35 questions

Question 22

Report Export Collapse

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Fortinet NSE4_FGT-7.2 image Question 22 26095 09182024185939000000

Fortinet NSE4_FGT-7.2 image Question 22 26095 09182024185939000000

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

The firewall policy performs the full content inspection on the file.
The firewall policy performs the full content inspection on the file.
The flow-based inspection is used, which resets the last packet to the user.
The flow-based inspection is used, which resets the last packet to the user.
The volume of traffic being inspected is too high for this model of FortiGate.
The volume of traffic being inspected is too high for this model of FortiGate.
The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
Suggested answer: B
Explanation:

* 'ONLY' If the virus is detected at the 'START' of the connection, the IPS engine sends the block replacement message immediately

* When a virus is detected on a TCP session (FIRST TIME), but where 'SOME PACKETS' have been already forwarded to the receiver, FortiGate 'resets the connection' and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a 'SECOND ATTEMPT' to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.

In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

asked 18/09/2024
Ray Savage
28 questions

Question 23

Report Export Collapse

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
Enable Dead Peer Detection.
Enable Dead Peer Detection.
Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
Suggested answer: B, C
Explanation:

Study Guide -- IPsec VPN -- IPsec configuration -- Phase 1 Network.

When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.

There are three DPD modes. On demand is the default mode.

Study Guide -- IPsec VPN -- Redundant VPNs.

Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.

Add at least one phase 2 definition for each phase 1.

Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.

Configure FW policies for each IPsec interface.

asked 18/09/2024
Abdulilah Alhousainy
45 questions

Question 24

Report Export Collapse

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Antivirus engine
Antivirus engine
Intrusion prevention system engine
Intrusion prevention system engine
Flow engine
Flow engine
Detection engine
Detection engine
Suggested answer: B
Explanation:

http://docs.fortinet.com/document/fortigate/6.0.0/handbook/240599/application-control

asked 18/09/2024
Anupam Roy
54 questions

Question 25

Report Export Collapse

Refer to the exhibit.

Fortinet NSE4_FGT-7.2 image Question 25 26098 09182024185939000000

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.
Traffic between port2 and port2-vlan1 is allowed by default.
port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
port1 is a native VLAN.
port1 is a native VLAN.
port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
Suggested answer: C, D
Explanation:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interf

https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883

asked 18/09/2024
Tim Klein
41 questions

Question 26

Report Export Collapse

Which statement about video filtering on FortiGate is true?

Full SSL Inspection is not required.
Full SSL Inspection is not required.
It is available only on a proxy-based firewall policy.
It is available only on a proxy-based firewall policy.
It inspects video files hosted on file sharing services.
It inspects video files hosted on file sharing services.
Video filtering FortiGuard categories are based on web filter FortiGuard categories.
Video filtering FortiGuard categories are based on web filter FortiGuard categories.
Suggested answer: B
asked 18/09/2024
SIDDIQI TARMIM
44 questions

Question 27

Report Export Collapse

Refer to the exhibit.

Fortinet NSE4_FGT-7.2 image Question 27 26100 09182024185939000000

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

There are five devices that are part of the security fabric.
There are five devices that are part of the security fabric.
Device detection is disabled on all FortiGate devices.
Device detection is disabled on all FortiGate devices.
This security fabric topology is a logical topology view.
This security fabric topology is a logical topology view.
There are 19 security recommendations for the security fabric.
There are 19 security recommendations for the security fabric.
Suggested answer: C, D
Explanation:

https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results

https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology

asked 18/09/2024
Jorge Andres Gutierrez
36 questions

Question 28

Report Export Collapse

A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.

What is the reason for the failed virus detection by FortiGate?

The website is exempted from SSL inspection.
The website is exempted from SSL inspection.
The EICAR test file exceeds the protocol options oversize limit.
The EICAR test file exceeds the protocol options oversize limit.
The selected SSL inspection profile has certificate inspection enabled.
The selected SSL inspection profile has certificate inspection enabled.
The browser does not trust the FortiGate self-signed CA certificate.
The browser does not trust the FortiGate self-signed CA certificate.
Suggested answer: A, C
Explanation:

SSL Inspection Profile, on the Inspection method there are 2 options to choose from, SSL Certificate Inspection or Full SSL Inspection. FG SEC 7.2 Studi Guide: Full SSL Inspection level is the only choice that allows antivirus to be effective.

asked 18/09/2024
Kevin Lizano
38 questions

Question 29

Report Export Collapse

Refer to the exhibits.

Fortinet NSE4_FGT-7.2 image Question 29 26102 09182024185939000000

Fortinet NSE4_FGT-7.2 image Question 29 26102 09182024185939000000

Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

Administrators can access FortiGate only through the console port.
Administrators can access FortiGate only through the console port.
FortiGate has entered conserve mode.
FortiGate has entered conserve mode.
FortiGate will start sending all files to FortiSandbox for inspection.
FortiGate will start sending all files to FortiSandbox for inspection.
Administrators cannot change the configuration.
Administrators cannot change the configuration.
Suggested answer: B, D
Explanation:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502

configurable thresholds

Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.

Default values are :

- red : 88% of total memory is considered 'used memory'

- extreme : 95% of total memory is considered 'used memory'

- green : 82% of total memory is considered 'used memory'

asked 18/09/2024
Leandro Zaneratto
51 questions

Question 30

Report Export Collapse

Refer to the exhibits.

Fortinet NSE4_FGT-7.2 image Question 30 26103 09182024185939000000

Fortinet NSE4_FGT-7.2 image Question 30 26103 09182024185939000000

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

Change the csf setting on ISFW (downstream) to set configuration-sync local.
Change the csf setting on ISFW (downstream) to set configuration-sync local.
Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.
Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.
Change the csf setting on both devices to set downstream-access enable.
Change the csf setting on both devices to set downstream-access enable.
Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.
Suggested answer: C
asked 18/09/2024
Venish Arumugam
41 questions
Total 184 questions
Go to page: of 19
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

What are two features of the NGFW policy-based mode? (Choose two.)
Refer to the exhibits. Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details. Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?
Which timeout setting can be responsible for deleting SSL VPN associated sessions?
What are two features of collector agent advanced mode? (Choose two.)
If Internet Service is already selected as Destination in a firewall policy, which other configuration object can be selected for the Destination field of a firewall policy?
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
What are two functions of the ZTNA rule? (Choose two.)
What are two characteristics of FortiGate HA cluster virtual IP addresses? (Choose two.)
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
Which two statements are correct about SLA targets? (Choose two.)