Pass Fortinet NSE4_FGT-7.0 With ActualTorrent Exam Dumps - Updated on Oct-2022
Fully Updated NSE4_FGT-7.0 Dumps - 100% Same Q&A In Your Real Exam
NEW QUESTION 99
Refer to the exhibit.
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)
- A. If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
- B. If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.
- C. If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.
- D. If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.
Answer: A,C
NEW QUESTION 100
A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.
What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?
- A. Pre-shared Key
- B. Dialup User
- C. Static IP Address
- D. Dynamic DNS
Answer: B
Explanation:
Explanation
Dialup user is used when the remote peer's IP address is unknown. The remote peer whose IP address is unknown acts as the dialup clien and this is often the case for branch offices and mobile VPN clients that use dynamic IP address and no dynamic DNS
NEW QUESTION 101
Which two statements are true about collector agent advanced mode? (Choose two.)
- A. Security profiles can be applied only to user groups, not individual users.
- B. Advanced mode uses Windows convention-NetBios: Domain\Username.
- C. FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate
- D. Advanced mode supports nested or inherited groups
Answer: C,D
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/482937/agent-based-fsso
NEW QUESTION 102
Refer to the web filter raw logs.
Based on the raw logs shown in the exhibit, which statement is correct?
- A. Access to the social networking web filter category was explicitly blocked to all users.
- B. Social networking web filter category is configured with the action set to authenticate.
- C. The action on firewall policy ID 1 is set to warning.
- D. The name of the firewall policy is all_users_web.
Answer: B
NEW QUESTION 103
An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
- A. Add user accounts to the FortiGate group fitter.
- B. Add user accounts to the Ignore User List.
- C. Add user accounts to Active Directory (AD).
- D. Add the support of NTLM authentication.
Answer: B
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD38828
NEW QUESTION 104
Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)
- A. execute ping
- B. diagnose sys top
- C. execute traceroute
- D. diagnose sniffer packet any
- E. get system arp
Answer: A,C,D
NEW QUESTION 105
Examine the IPS sensor configuration shown in the exhibit, and then answer the question below.
An administrator has configured the WINDOWS_SERVERS IPS sensor in an attempt to determine whether the influx of HTTPS traffic is an attack attempt or not. After applying the IPS sensor, FortiGate is still not generating any IPS logs for the HTTPS traffic.
What is a possible reason for this?
- A. The firewall policy is not using a full SSL inspection profile.
- B. A DoS policy should be used, instead of an IPS sensor.
- C. The HTTPS signatures have not been added to the sensor.
- D. The IPS filter is missing the Protocol: HTTPS option.
- E. A DoS policy should be used, instead of an IPS sensor.
Answer: A
NEW QUESTION 106
Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?
- A. get system performance status
- B. diagnose sys top
- C. get system status
- D. get system arp
Answer: D
Explanation:
Explanation
"If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look at the ARP table."
NEW QUESTION 107
Refer to the exhibit to view the application control profile.
Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?
- A. The category of Apple FaceTime is being monitored.
- B. The category of Apple FaceTime is being blocked.
- C. Apple FaceTime belongs to the custom blocked filter.
- D. Apple FaceTime belongs to the custom monitored filter.
Answer: C
NEW QUESTION 108
Refer to the exhibit.
According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?
- A. A user
- B. A root CA
- C. A bridge CA
- D. A subordinate
Answer: A
NEW QUESTION 109
Which two statements are correct about NGFW Policy-based mode? (Choose two.)
- A. NGFW policy-based mode does not require the use of central source NAT policy
- B. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
- C. NGFW policy-based mode policies support only flow inspection
- D. NGFW policy-based mode can only be applied globally and not on individual VDOMs
Answer: B,C
NEW QUESTION 110
Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)
- A. Connections are tracked using source port and source MAC address.
- B. This is known as many-to-one NAT.
- C. Port address translation is not used.
- D. Source IP is translated to the outgoing interface IP.
Answer: C,D
NEW QUESTION 111
View the exhibit.
Which of the following statements are correct? (Choose two.)
- A. This is a redundant IPsec setup.
- B. Dead peer detection must be disabled to support this type of IPsec setup.
- C. This setup requires at least two firewall policies with the action set to IPsec.
- D. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.
Answer: A,D
NEW QUESTION 112
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To remove the NAT operation
- B. To generate logs
- C. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- D. To finish any inspection operations
Answer: C
Explanation:
Explanation
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
NEW QUESTION 113
An administrator has configured a route-based IPsec VPN between two FortiGate devices. Which statement about this IPsec VPN configuration is true?
- A. A virtual IPsec interface is automatically created after the phase 1 configuration is completed.
- B. A phase 2 configuration is not required.
- C. This VPN cannot be used as part of a hub-and-spoke topology.
- D. The IPsec firewall policies must be placed at the top of the list.
Answer: A
Explanation:
In a route-based configuration, FortiGate automatically adds a virtual interface eith the VPN name (Infrastructure Study Guide, 206)
NEW QUESTION 114
Refer to the exhibit.
The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- A. The sensor will gather a packet log for all matched traffic.
- B. The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.
- C. The sensor will block all attacks aimed at Windows servers.
- D. The sensor will reset all connections that match these signatures.
Answer: B,C
NEW QUESTION 115
Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)
- A. new-session
- B. auth-on-demand
- C. Idle-timeout
- D. soft-timeout
- E. hard-timeout
Answer: A,C,E
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221
NEW QUESTION 116
Examine this output from a debug flow:
Why did the FortiGate drop the packet?
- A. It matched the default implicit firewall policy.
- B. The next-hop IP address is unreachable.
- C. It matched an explicitly configured firewall policy with the action DENY.
- D. It failed the RPF check.
Answer: A
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=13900
NEW QUESTION 117
Refer to the exhibit.
Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?
- A. Read/Write permission for Log & Report
- B. Custom permission for Network
- C. CLI diagnostics commands permission
- D. Read/Write permission for Firewall
Answer: C
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220
NEW QUESTION 118
Examine this PAC file configuration.
Which of the following statements are true? (Choose two.)
- A. Any web request fortinet.com is allowed to bypass the proxy.
- B. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
- C. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
- D. Browsers can be configured to retrieve this PAC file from the FortiGate.
Answer: A,D
NEW QUESTION 119
Examine the two static routes shown in the exhibit, then answer the following question.
Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
- A. FortiGate will use the port1 route as the primary candidate.
- B. FortiGate will only actuate the port1 route in the routing table
- C. FortiGate will route twice as much traffic to the port2 route
- D. FortiGate will load balance all traffic across both routes.
Answer: A
Explanation:
"If multiple static routes have the same distance, they are all active; however, only the one with the lowest priority is considered the best path."
NEW QUESTION 120
......
Latest NSE4_FGT-7.0 Exam Dumps - Valid and Updated Dumps: https://www.actualtorrent.com/NSE4_FGT-7.0-questions-answers.html