Fortinet NSE4_FGT-7.0 Dumps Questions Updated – To Pass Fortinet NSE 4 – FortiOS 7.0 Exam

1. Which two statements about antivirus scanning mode are true? (Choose two.)

2. FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

3. An administrator is configuring an IPsec VPN between site A and site

B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24.

Which subnet must the administrator configure for the local quick mode selector for site B?

4. Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

5. Refer to the exhibit.

The exhibit shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

6. Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

7. Which two statements are correct about SLA targets? (Choose two.)

8. Refer to the exhibits.

Exhibit A.

Exhibit B.

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.

Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

Which part of the policy configuration must you change to resolve the issue?

9. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

10. An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

Which DPD mode on FortiGate will meet the above requirement?

11. How does FortiGate act when using SSL VPN in web mode?

12. Refer to the exhibits.

Exhibit A.

Exhibit B.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

13. Which two statements are correct about NGFW Policy-based mode? (Choose two.)

14. Refer to the exhibits.

Exhibit A shows system performance output.

Exhibit B shows s FortiGate configured with the default configuration of high memory usage thresholds.

Based on the system performance output, which two statements are correct? (Choose two.)

15. Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

16. Which two statements are true about the FGCP protocol? (Choose two.)

17. Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices.

The administrator has determined that phase 1 status is up. but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

18. Refer to the exhibit.

Given the interfaces shown in the exhibit, which two statements are true? (Choose two.)

19. Refer to the exhibit.

Which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

20. Refer to the exhibit.

Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

21. When configuring a firewall virtual wire pair policy, which following statement is true?

22. Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.

The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem.

With this configuration, which statement is true?

23. Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

24. Refer to the exhibit.

Exhibit A.

Exhibit B.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.

The WAN (port1) interface has the IP address 10.200.1.1/24.

The LAN (port3) interface has the IP address 10 .0.1.254. /24.

The first firewall policy has NAT enabled using IP Pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

25. Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings.

Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

26. Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

27. Refer to the exhibit.

An administrator is running a sniffer command as shown in the exhibit.

Which three pieces of information are included in the sniffer output? (Choose three.)

28. Refer to the exhibit.

Exhibit A.

Exhibit B.

The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.

Which interface will be selected as an outgoing interface?

29. A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.

What is the reason for the failed virus detection by FortiGate?

30. An administrator does not want to report the logon events of service accounts to FortiGate.

What setting on the collector agent is required to achieve this?

31. An administrator has configured a strict RPF check on FortiGate.

Which statement is true about the strict RPF check?

32. Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

33. An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

34. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

35. Which statement about video filtering on FortiGate is true?

36. Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

37. Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

38. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

39. Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Exhibit A.

Exhibit B.

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

40. Refer to the exhibits.

Exhibit A.

Exhibit B.

The SSL VPN connection fails when a user attempts to connect to it.

What should the user do to successfully connect to SSL VPN?

41. Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

42. Which statement about the policy ID number of a firewall policy is true?

43. Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)

44. A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.

What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

45. An administrator wants to configure timeouts for users. Regardless of the user™s behavior, the timer should start as soon as the user authenticates and expire after the configured value.

Which timeout option should be configured on FortiGate?

46. Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

47. Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.

Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

48. Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

49. Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.

Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

50. Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)