Pass the Fortinet NSE 4 – FortiOS 7.2 Exam with Confidence: NSE4_FGT-7.2 Dumps

1. Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)

2. Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

3. Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.

Which two statements are true? (Choose two.)

4. Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.

Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

5. Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24.

The LAN (port3) interface has the IP address 10 .0.1.254. /24.

The first firewall policy has NAT enabled using IP Pool.

The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

6. In which two ways can RPF checking be disabled? (Choose two )

7. Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.

Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

8. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

9. Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

10. What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

11. A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.

What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

12. Examine this PAC file configuration.

Which of the following statements are true? (Choose two.)

13. Refer to the exhibits.

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook.

Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.

Which part of the policy configuration must you change to resolve the issue?

14. View the exhibit.

Which of the following statements are correct? (Choose two.)

15. Which two statements are true when FortiGate is in transparent mode? (Choose two.)

16. Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

17. Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

18. An administrator is running the following sniffer command:

Which three pieces of Information will be Included in me sniffer output? {Choose three.)

19. An administrator does not want to report the logon events of service accounts to FortiGate.

What setting on the collector agent is required to achieve this?

20. Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

21. Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

22. Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

23. Refer to the exhibit.

Which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

24. Which statement about video filtering on FortiGate is true?

25. Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.

When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

26. Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

27. Refer to the exhibit.

An administrator is running a sniffer command as shown in the exhibit.

Which three pieces of information are included in the sniffer output? (Choose three.)

28. Which of statement is true about SSL VPN web mode?

29. CORRECT TEXT

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

30. What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

31. A FortiGate is operating in NAT mode and configured with two virtual LAN (VLAN) sub interfaces added to the physical interface.

Which statements about the VLAN sub interfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

32. A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

* All traffic must be routed through the primary tunnel when both tunnels are up

* The secondary tunnel must be used only if the primary tunnel goes down

* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

33. What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

34. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

35. Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

36. A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.

What is the reason for the failed virus detection by FortiGate?

37. Which statement is correct regarding the use of application control for inspecting web applications?

38. Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

39. Refer to exhibit.

An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

40. Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

41. Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

42. When configuring a firewall virtual wire pair policy, which following statement is true?

43. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

44. Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)

45. Refer to the exhibits.

The exhibits show the firewall policies and the objects used in the firewall policies.

The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?

46. In an explicit proxy setup, where is the authentication method and database configured?

47. Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.

The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address.

Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

48. Which three statements are true regarding session-based authentication? (Choose three.)

49. Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

50. An administrator must disable RPF check to investigate an issue.

Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

51. Which feature in the Security Fabric takes one or more actions based on event triggers?

52. Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings.

Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

53. Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

54. Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

55. The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.

What order must FortiGate use when the web filter profile has features enabled, such as safe search?