File Info
| Exam | Fortinet NSE 4 - FortiOS 7.0 |
| Number | NSE4_FGT-7.0 |
| File Name | Fortinet.NSE4_FGT-7.0.CertPixel.2024-01-14.104q.tqb |
| Size | 10 MB |
| Posted | Jan 14, 2024 |
| Download | Fortinet.NSE4_FGT-7.0.CertPixel.2024-01-14.104q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Refer to the exhibit.
Which contains a session diagnostic output. Which statement is true about the session diagnostic output?
- The session is in SYN_SENT state.
- The session is in FIN_ACK state.
- The session is in FTN_WAIT state.
- The session is in ESTABLISHED state.
Correct answer: A
Explanation:
Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042 Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
Question 2
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
- FortiGuard web filter cache
- FortiGate hostname
- NTP
- DNS
Correct answer: CD
Question 3
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- To allow for out-of-order packets that could arrive after the FIN/ACK packets
- To finish any inspection operations
- To remove the NAT operation
- To generate logs
Correct answer: A
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table. TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
Question 4
Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)
- SSH
- HTTPS
- FTM
- FortiTelemetry
Correct answer: AB
Explanation:
Reference:https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/995103/buildingsecurity-into-fortios Reference:
https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/995103/buildingsecurity-into-fortios
Question 5
How does FortiGate act when using SSL VPN in web mode?
- FortiGate acts as an FDS server.
- FortiGate acts as an HTTP reverse proxy.
- FortiGate acts as DNS server.
- FortiGate acts as router.
Correct answer: B
Explanation:
Reference:https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf Reference:
https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf
Question 6
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
- All traffic must be routed through the primary tunnel when both tunnels are up
- The secondary tunnel must be used only if the primary tunnel goes down
- In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
- Enable Dead Peer Detection.
- Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
- Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
Correct answer: BC
Explanation:
B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination. B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.
C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination.
Question 7
Which statement about video filtering on FortiGate is true?
- Full SSL Inspection is not required.
- It is available only on a proxy-based firewall policy.
- It inspects video files hosted on file sharing services.
- Video filtering FortiGuard categories are based on web filter FortiGuard categories.
Correct answer: B
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/190873/video-filtering Reference: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/190873/video-filtering
Question 8
Refer to the exhibits.
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)
- Administrators can access FortiGate only through the console port.
- FortiGate has entered conserve mode.
- FortiGate will start sending all files to FortiSandbox for inspection.
- Administrators cannot change the configuration.
Correct answer: BD
Explanation:
Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/ Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/
Question 9
Refer to the exhibits.
Exhibit A.
Exhibit B.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
- Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.
- Change the csf setting on ISFW (downstream) to sec configuracion-sync local.
- Change the csf setting on Local-FortiGate (root) to sec fabric-objecc-unificacion defaulc.
- Change the csf setting on ISFW (downstream) to sec fabric-objecc-unificacion defaulc.
Correct answer: A
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43820 Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43820
Question 10
Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?
- The security actions applied on the web applications will also be explicitly applied on the third-party websites.
- The application signature database inspects traffic only from the original web application server.
- FortiGuard maintains only one signature of each web application that is unique.
- FortiGate can inspect sub-application traffic regardless where it was originated.
Correct answer: D
Explanation:
Reference:https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/303d_FortiG Reference:
https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/303d_FortiG
