The Secret Of Fortinet NSE4_FGT-7.0 Study Guide

NEW QUESTION 1

When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

• A. remote user’s public IP address
• B. The public IP address of the FortiGate device.
• C. The remote user’s virtual IP address.
• D. The internal IP address of the FortiGate device.

Answer: D

Explanation:
Source IP seen by the remote resources is FortiGate’s internal IP address and not the user’s IP address

NEW QUESTION 2

Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator
selected the Include in every user group option.
What will be the impact of using Include in every user group option in a RADIUS configuration?

• A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
• B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
• C. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
• D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

Answer: A

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/634373/authentication-servers

NEW QUESTION 3

Which two types of traffic are managed only by the management VDOM? (Choose two.)

• A. FortiGuard web filter queries
• B. PKI
• C. Traffic shaping
• D. DNS

Answer: AD

NEW QUESTION 4

Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

• A. hard-timeout
• B. auth-on-demand
• C. soft-timeout
• D. new-session
• E. Idle-timeout

Answer: ADE

Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221

NEW QUESTION 5

Which two statements are correct about a software switch on FortiGate? (Choose two.)

• A. It can be configured only when FortiGate is operating in NAT mode
• B. Can act as a Layer 2 switch as well as a Layer 3 router
• C. All interfaces in the software switch share the same IP address
• D. It can group only physical interfaces

Answer: AC

NEW QUESTION 6

Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

• A. diagnose sys top
• B. execute ping
• C. execute traceroute
• D. diagnose sniffer packet any
• E. get system arp

Answer: BCD

NEW QUESTION 7

Refer to the exhibit.

Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?

• A. The IPS engine was inspecting high volume of traffic.
• B. The IPS engine was unable to prevent an intrusion attack.
• C. The IPS engine was blocking all traffic.
• D. The IPS engine will continue to run in a normal state.

Answer: A

Explanation:
Reference:
https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage

NEW QUESTION 8

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

• A. Heartbeat interfaces have virtual IP addresses that are manually assigned.
• B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
• C. Virtual IP addresses are used to distinguish between cluster members.
• D. The primary device in the cluster is always assigned IP address 169.254.0.1.

Answer: BD

NEW QUESTION 9

If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?

• A. IP address
• B. Once Internet Service is selected, no other object can be added
• C. User or User Group
• D. FQDN address

Answer: B

Explanation:
Reference:
https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-in-policy

NEW QUESTION 10

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

• A. Subject Key Identifier value
• B. SMMIE Capabilities value
• C. Subject value
• D. Subject Alternative Name value

Answer: A

NEW QUESTION 11

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

• A. The strict RPF check is run on the first sent and reply packet of any new session.
• B. Strict RPF checks the best route back to the source using the incoming interface.
• C. Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface.
• D. Strict RPF allows packets back to sources with all active routes.

Answer: B

Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955

NEW QUESTION 12

Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

• A. Fabric Coverage
• B. Automated Response
• C. Security Posture
• D. Optimization

Answer: C

Explanation:
Reference:
https://www.fortinet.com/content/dam/fortinet/assets/support/fortinet-recommended-security-bestpractices.pdf

NEW QUESTION 13

Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

• A. The security actions applied on the web applications will also be explicitly applied on the third-party websites.
• B. The application signature database inspects traffic only from the original web application server.
• C. FortiGuard maintains only one signature of each web application that is unique.
• D. FortiGate can inspect sub-application traffic regardless where it was originated.

Answer: D

Explanation:
Reference:
https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/303d_FortiG

NEW QUESTION 14

An administrator is running the following sniffer command:

Which three pieces of Information will be Included in me sniffer output? {Choose three.)

• A. Interface name
• B. Packet payload
• C. Ethernet header
• D. IP header
• E. Application header

Answer: ABD

NEW QUESTION 15

Refer to the exhibit to view the application control profile.

Based on the configuration, what will happen to Apple FaceTime?

• A. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration
• B. Apple FaceTime will be allowed, based on the Apple filter configuration.
• C. Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn
• D. Apple FaceTime will be allowed, based on the Categories configuration.

Answer: A

NEW QUESTION 16
......