Fortinet NSE4_FGT-7.2 Daily Practice Exam New 2023 Updated 175 Questions
Use Valid NSE4_FGT-7.2 Exam - Actual Exam Question & Answer
NEW QUESTION # 81
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)
- A. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.
- B. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.
- C. The IP version of the sources and destinations in a policy must match.
- D. The IP version of the sources and destinations in a firewall policy must be different.
- E. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.
Answer: A,C,E
NEW QUESTION # 82
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels.
The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?
- A. On Idle
- B. On Demand
- C. Enabled
- D. Disabled
Answer: A
NEW QUESTION # 83
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile. What order must FortiGate use when the web filter profile has features enabled, such as safe search?
- A. DNS-based web filter and proxy-based web filter
- B. Static domain filter, SSL inspection filter, and external connectors filters
- C. FortiGuard category filter and rating filter
- D. Static URL filter, FortiGuard category filter, and advanced filters
Answer: D
NEW QUESTION # 84
Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?
- A. diagnose wad session list | grep hook-pre&&hook-out
- B. diagnose wad session list | grep hook=pre&&hook=out
- C. diagnose wad session list | grep "hook=pre"&"hook=out"
- D. diagnose wad session list
Answer: D
NEW QUESTION # 85
An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?
- A. The strict RPF check is run on the first sent and reply packet of any new session.
- B. Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.
- C. Strict RPF checks the best route back to the source using the incoming interface.
- D. Strict RPF allows packets back to sources with all active routes.
Answer: B
NEW QUESTION # 86
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)
- A. On HQ-FortiGate, disable Diffie-Helman group 2.
- B. On Remote-FortiGate, set port2 as Interface.
- C. On HQ-FortiGate, set IKE mode to Main (ID protection).
- D. On both FortiGate devices, set Dead Peer Detection to On Demand.
Answer: B,C
NEW QUESTION # 87
Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?
- A. Subject Alternative Name value
- B. Subject value
- C. SMMIE Capabilities value
- D. Subject Key Identifier value
Answer: D
NEW QUESTION # 88
FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.
Which two syntaxes are correct to configure web rating for the home page? (Choose two.)
- A. www.example.com/index.html
- B. example.com
- C. www.example.com:443
- D. www.example.com
Answer: B,D
Explanation:
Explanation
When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names - no URLs or wildcard characters are allowed.
OK: google.com or www.google.com
NO OK: www.google.com/index.html or google.*
FortiGate_Security_6.4 page 384
When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names-- "no URLs or wildcard characters are allowed".
NEW QUESTION # 89
Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)
- A. Source defined as Internet Services in the firewall policy.
- B. Highest to lowest priority defined in the firewall policy.
- C. Lowest to highest policy ID number.
- D. Services defined in the firewall policy.
- E. Destination defined as Internet Services in the firewall policy.
Answer: A,D,E
Explanation:
Explanation
When a packet arrives, how does FortiGate find a matching policy? Each policy has match criteria, which you can define using the following objects:
* Incoming Interface
* Outgoing Interface
* Source: IP address, user, internet services
* Destination: IP address or internet services
* Service: IP protocol and port number
* Schedule: Applies during configured times
NEW QUESTION # 90
Refer to exhibit.
An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?
- A. On the Static URL Filter configuration, set Type to Simple
- B. On the Static URL Filter configuration, set Action to Exempt.
- C. On the Static URL Filter configuration, set Action to Monitor.
- D. On the FortiGuard Category Based Filter Action to Warning for Social Networking
Answer: B
NEW QUESTION # 91
Refer to the exhibits.
The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?
- A. Make SSL inspection needs to be a deep content inspection.
- B. Force access to Facebook using the HTTP service.
- C. Add Facebook in the URL category in the security policy.
- D. Get the additional application signatures are required to add to the security policy.
Answer: A
Explanation:
They can play video (tick) content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts. This indicate that the rule are partially working as they can watch video but cant react, i.e. liking the content. So must be an issue with the SSL inspection rather then adding an app rule.
NEW QUESTION # 92
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- A. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
- B. Enable Dead Peer Detection.
- C. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
- D. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Answer: B,D
Explanation:
Explanation
Study Guide - IPsec VPN - IPsec configuration - Phase 1 Network.
When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.
There are three DPD modes. On demand is the default mode.
Study Guide - IPsec VPN - Redundant VPNs.
Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.
Add at least one phase 2 definition for each phase 1.
Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.
Configure FW policies for each IPsec interface.
NEW QUESTION # 93
An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?
- A. Aggregate interface
- B. Software Switch interface
- C. VLAN interface
- D. Redundant interface
Answer: A
NEW QUESTION # 94
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The flow-based inspection is used, which resets the last packet to the user.
- B. The firewall policy performs the full content inspection on the file.
- C. The volume of traffic being inspected is too high for this model of FortiGate.
- D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
Answer: A
Explanation:
Explanation
"ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file.
Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened.
The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.
NEW QUESTION # 95
Examine this output from a debug flow:
Why did the FortiGate drop the packet?
- A. It matched an explicitly configured firewall policy with the action DENY.
- B. The next-hop IP address is unreachable.
- C. It matched the default implicit firewall policy.
- D. It failed the RPF check .
Answer: C
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
https://www.fortinetguru.com/2016/03/what-is-policy-id-0-and-why-lot-of-denied-traffic-on-this-policy/
NEW QUESTION # 96
Refer to the exhibit.
The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?
- A. Change Administrator profile
- B. Enable restrict access to trusted hosts
- C. Enable two-factor authentication
- D. Change password
Answer: A
NEW QUESTION # 97
By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.
Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?
- A. set webfilter-cache disable
- B. set protocol tcp
- C. set fortiguard-anycast disable
- D. set webfilter-force-off disable
Answer: C
Explanation:
Explanation
y default, "fortiguard-anycast" is enabled, and this setting only works with "set protocol https". To use udp (ie.
"set protocol udp"), "fortiguard-anycast" must be disabled.
NEW QUESTION # 98
Which feature in the Security Fabric takes one or more actions based on event triggers?
- A. Fabric Connectors
- B. Automation Stitches
- C. Logical Topology
- D. Security Rating
Answer: B
NEW QUESTION # 99
Refer to the exhibits.
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)
- A. FortiGate has entered conserve mode.
- B. Administrators cannot change the configuration.
- C. Administrators can access FortiGate only through the console port.
- D. FortiGate will start sending all files to FortiSandbox for inspection.
Answer: A,B
Explanation:
Reference:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502 configurable thresholds Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.
Default values are :
- red : 88% of total memory is considered "used memory"
- extreme : 95% of total memory is considered "used memory"
- green : 82% of total memory is considered "used memory"
NEW QUESTION # 100
Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
- A. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.
- B. FortiGate generates a system event log for every port block allocation made per user.
- C. FortiGate allocates 128 port blocks per user.
- D. FortiGate allocates port blocks on a first-come, first-served basis.
Answer: A,C
NEW QUESTION # 101
Refer to the exhibit.
The exhibit shows the output of a diagnose command.
What does the output reveal about the policy route?
- A. It is an SDWAN rule in policy route.
- B. It is an ISDB policy route with an SDWAN rule.
- C. It is a regular policy route.
- D. It is an ISDB route in policy route.
Answer: A
Explanation:
FortiGate Infrastructure 7.2 Study Guide (p.59): "ISDB routes and SD-WAN rules are assigned an ID higher than 65535. However, SD-WAN rule entries include the vwl_service field, and ISDB route entries don't."
NEW QUESTION # 102
Which statement describes a characteristic of automation stitches?
- A. They can run multiple actions simultaneously.
- B. They can be created on any device in the fabric.
- C. They can be run only on devices in the Security Fabric.
- D. They can have one or more triggers.
Answer: A
Explanation:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/351998/creating-automation-stitches
NEW QUESTION # 103
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
- A. Application control
- B. Antivirus in flow-based inspection
- C. Web application firewall
- D. Web filter in flow-based inspection
- E. DNS filter
Answer: A,B,D
Explanation:
Explanation
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/739623/dns-filter-handled-by-ips-engine-in-flow
NEW QUESTION # 104
......
Fortinet NSE4_FGT-7.2 exam is an essential certification for anyone who works in the field of network security and is looking to demonstrate their knowledge and expertise in this area. By passing NSE4_FGT-7.2 exam, professionals can show that they have the skills and knowledge needed to manage and operate Fortinet security products effectively, and can help their organizations stay protected against the latest security threats.
Test Engine to Practice NSE4_FGT-7.2 Test Questions: https://www.itpassleader.com/Fortinet/NSE4_FGT-7.2-dumps-pass-exam.html
NSE4_FGT-7.2 Real Exam Questions Test Engine Dumps Training With 175 Questions: https://drive.google.com/open?id=1zSOTbeW8vvRPurftwrbyzQyvesN-OHoP