NSE4_FGT-7.0 Exam Questions Dumps, Selling Fortinet Products [Q45-Q69]

admin • December 10, 2023

NSE4_FGT-7.0 Exam Questions Dumps, Selling Fortinet Products [Q45-Q69]

4.5/5 - (2 votes)

NSE4_FGT-7.0 Exam Questions Dumps, Selling Fortinet Products

NSE4_FGT-7.0 Cert Guide PDF 100% Cover Real Exam Questions

NO.45 If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

A CRL

A person

A subordinate CA

A root CA

NO.46 Refer to the exhibits.

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?

The SSL inspection needs to be a deep content inspection.

Force access to Facebook using the HTTP service.

Additional application signatures are required to add to the security policy.

Add Facebook in the URL category in the security policy.

The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.

NO.47 How do you format the FortiGate flash disk?

Load a debug FortiOS image.

Load the hardware test (HQIP) image.

Execute the CLI command execute formatlogdisk.

Select the format boot device option from the BIOS menu.

NO.48 Refer to the FortiGuard connection debug output.

Based on the output shown in the exhibit, which two statements are correct? (Choose two.)

A local FortiManager is one of the servers FortiGate communicates with.

One server was contacted to retrieve the contract information.

There is at least one server that lost packets consecutively.

FortiGate is using default FortiGuard communication settings.

NO.49 What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

Full Content inspection

Proxy-based inspection

Certificate inspection

Flow-based inspection

NO.50 If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy?

User or User Group

IP address

No other object can be added

FQDN address

NO.51 Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

FortiGate Infrastructure 7.0 Study Guide p. 222 FortiGate Infrastructure 7.0 Study Guide p. 208

NO.52 Refer to the exhibit.

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

If there is a full-through policy in place, users will not be prompted for authentication.

Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.

Authentication is enforced at a policy level; all users will be prompted for authentication.

Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.

NO.53 Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLAN.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Explanation
https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interfa
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883

NO.54 Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep “hook=pre”&”hook=out”

NO.55 Refer to the exhibit to view the application control profile.

Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?

Apple FaceTime belongs to the custom monitored filter.

The category of Apple FaceTime is being monitored.

Apple FaceTime belongs to the custom blocked filter.

The category of Apple FaceTime is being blocked.

NO.56 Refer to the exhibit.

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

A user

A root CA

A bridge CA

A subordinate

NO.57 Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

The firewall policy performs the full content inspection on the file.

The flow-based inspection is used, which resets the last packet to the user.

The volume of traffic being inspected is too high for this model of FortiGate.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

Explanation
* “ONLY” If the virus is detected at the “START” of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where “SOME PACKETS” have been already forwarded to the receiver, FortiGate “resets the connection” and does not send the last piece of the file.
Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened.
The IPS engine also caches the URL of the infected file, so that if a “SECOND ATTEMPT” to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

NO.58 Refer to the exhibit.

Which contains a Performance SLA configuration.
An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

Participants configured are not SD-WAN members.

There may not be a static route to route the performance SLA traffic.

The Ping protocol is not supported for the public servers that are configured.

You need to turn on the Enable probe packets switch.

Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performance-sla-linkmonitoring

NO.59 Refer to the exhibit.

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?

If there is a full-through policy in place, users will not be prompted for authentication.

Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.

Authentication is enforced at a policy level; all users will be prompted for authentication.

Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.

NO.60 Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

1. Override is disable by default – OK
2. “If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary” The question here is : HA Uptime of FGVM01000006492 > 5 minutes? NO – 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study Guide.
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/666653/primary-unit-selection-with-override-disabled-default

NO.61 To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

FortiManager

Root FortiGate

FortiAnalyzer

Downstream FortiGate

NO.62 Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Antivirus engine

Intrusion prevention system engine

Flow engine

Detection engine

NO.63 If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

The Services field prevents SNAT and DNAT from being combined in the same policy.

The Services field is used when you need to bundle several VIPs into VIP groups.

The Services field prevents multiple sources of traffic from using multiple services to connect to a single

The Services field removes the requirement to create multiple VIPs for different services.

NO.64 Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It always authorizes the traffic without requiring authentication.

It drops the traffic.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

“What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting”

NO.65 In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration?
(Choose three.)

The IP version of the sources and destinations in a firewall policy must be different.

The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.

The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

The IP version of the sources and destinations in a policy must match.

The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.

NO.66 When configuring a firewall virtual wire pair policy, which following statement is true?

Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

Only a single virtual wire pair can be included in each policy.

Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

Exactly two virtual wire pairs need to be included in each policy.

NO.67 In an explicit proxy setup, where is the authentication method and database configured?

Proxy Policy

Authentication Rule

Firewall Policy

Authentication scheme

NO.68 Refer to the exhibit.

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?