Fortinet NSE 4 - FortiOS 7.2 - NSE4_FGT-7.2 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Which scanning technique on FortiGate can be enabled only on the CLI?

A. Heuristics scan B. Trojan scan C. Antivirus scan D. Ransomware scan

Discussion 0

Correct Answer: A Vote an answer

Question 2

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

A. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations. B. The IP version of the sources and destinations in a firewall policy must be different. C. The IP version of the sources and destinations in a policy must match. D. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6. E. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.

Discussion 0

Correct Answer: A,C,D Vote an answer

Question 3

Which statement about video filtering on FortiGate is true?

A. Video filtering FortiGuard categories are based on web filter FortiGuard categories. B. It inspects video files hosted on file sharing services. C. It is available only on a proxy-based firewall policy. D. Full SSL Inspection is not required.

Discussion 0

Correct Answer: C Vote an answer

Question 4

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes. B. ADVPN is only supported with IKEv2. C. Tunnels are negotiated dynamically between spokes. D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Discussion 0

Correct Answer: A,C Vote an answer

Question 5

Which statement about the policy ID number of a firewall policy is true?

A. It defines the order in which rules are processed. B. It changes when firewall policies are reordered. C. It represents the number of objects used in the firewall policy. D. It is required to modify a firewall policy using the CLI.

Discussion 0

Correct Answer: D Vote an answer

Question 6

Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?

A. 10.200. 1. 10 B. 10.200. 1. 100 C. 10.200.3. 1 D. 10.200. 1. 1

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

A. The issuer must be a public CA. B. The common name on the subject field must use a wildcard name. C. The CA extension must be set to TRUE. D. The keyUsage extension must be set to keyCertSign.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

Which statement about the IP authentication header (AH) used by IPsec is true?

A. AH provides strong data integrity but weak encryption. B. AH provides data integrity bur no encryption. C. AH does not support perfect forward secrecy. D. AH does not provide any data integrity or encryption.

Discussion 0

Correct Answer: B Vote an answer

Question 9

When configuring a firewall virtual wire pair policy, which following statement is true?

A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same. B. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings. C. Only a single virtual wire pair can be included in each policy. D. Exactly two virtual wire pairs need to be included in each policy.

Discussion 0

Correct Answer: A Vote an answer

Question 10

Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.
Two PCS, PCI and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the Intarnet_ Based on the information shown in the exhibit, which three configuration changes should the administrator make to fix the connectivity issue for PC3? (Choose three.)

A. In the firewall policy configuration, disable ippool. B. Configure 192.2. O. 12/24 as the secondary IP address on port1 C. Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list. D. In the IP pool configuration, set type to overload. E. In the IP pool configuration, set endip to 192.2. O .12

Discussion 0

Correct Answer: A,D,E Vote an answer

Question 11

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

A. To encapsulation ESP packets in UDP packets using port 4500. B. To dynamically change phase 1 negotiation mode aggressive mode. C. To force a new DH exchange with each phase 2 rekey. D. To detect intermediary NAT devices in the tunnel path.

Discussion 0

Correct Answer: A,D Vote an answer

Question 12

Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

A. FortiGate does not support workstation check . B. FortiGate directs the collector agent to use a remote LDAP server. C. FortiGate uses the AD server as the collector agent. D. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

Discussion 0

Correct Answer: A,D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).