File Info
| Exam | Fortinet NSE 4 - FortiOS 7.0 |
| Number | NSE4_FGT-7.0 |
| File Name | Fortinet.NSE4_FGT-7.0.CertPixel.2024-01-22.115q.vcex |
| Size | 11 MB |
| Posted | Jan 22, 2024 |
| Download | Fortinet.NSE4_FGT-7.0.CertPixel.2024-01-22.115q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Refer to the exhibit.
Which contains a session diagnostic output. Which statement is true about the session diagnostic output?
- The session is in SYN_SENT state.
- The session is in FIN_ACK state.
- The session is in FTN_WAIT state.
- The session is in ESTABLISHED state.
Correct answer: A
Explanation:
Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042 Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2) https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
Question 2
Which two statements about antivirus scanning mode are true? (Choose two.)
- In proxy-based inspection mode, files bigger than the buffer size are scanned.
- In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
- In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.
- In flow-based inspection mode, files bigger than the buffer size are scanned.
Correct answer: BC
Explanation:
An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware regardless of file size, a firewall would need infinitely large RAM--something that no device has in the real world. Most viruses are very small. This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through. An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware regardless of file size, a firewall would need infinitely large RAM--something that no device has in the real world. Most viruses are very small. This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.
Question 3
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
- FortiGuard web filter cache
- FortiGate hostname
- NTP
- DNS
Correct answer: CD
Question 4
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- To allow for out-of-order packets that could arrive after the FIN/ACK packets
- To finish any inspection operations
- To remove the NAT operation
- To generate logs
Correct answer: A
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table. TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
Question 5
Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)
- SSH
- HTTPS
- FTM
- FortiTelemetry
Correct answer: AB
Explanation:
Reference:https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/995103/buildingsecurity-into-fortios Reference:
https://docs.fortinet.com/document/fortigate/6.4.0/hardening-your-fortigate/995103/buildingsecurity-into-fortios
Question 6
How does FortiGate act when using SSL VPN in web mode?
- FortiGate acts as an FDS server.
- FortiGate acts as an HTTP reverse proxy.
- FortiGate acts as DNS server.
- FortiGate acts as router.
Correct answer: B
Explanation:
Reference:https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf Reference:
https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf
Question 7
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
- All traffic must be routed through the primary tunnel when both tunnels are up
- The secondary tunnel must be used only if the primary tunnel goes down
- In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
- Enable Dead Peer Detection.
- Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
- Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
Correct answer: BC
Explanation:
B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination. B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.
C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination.
Question 8
Refer to the exhibit.
Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)
- Traffic between port2 and port2-vlan1 is allowed by default.
- port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
- port1 is a native VLAN.
- port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
Correct answer: CD
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interfhttps://kb.fortinet.com/kb/viewContent.do?externalId=FD30883 https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interf
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883
Question 9
Which statement about video filtering on FortiGate is true?
- Full SSL Inspection is not required.
- It is available only on a proxy-based firewall policy.
- It inspects video files hosted on file sharing services.
- Video filtering FortiGuard categories are based on web filter FortiGuard categories.
Correct answer: B
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/190873/video-filtering Reference: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/190873/video-filtering
Question 10
Refer to the exhibits.
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)
- Administrators can access FortiGate only through the console port.
- FortiGate has entered conserve mode.
- FortiGate will start sending all files to FortiSandbox for inspection.
- Administrators cannot change the configuration.
Correct answer: BD
Explanation:
Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/ Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/
