[2022] Use Valid New NSE4_FGT-7.0 Test Notes & NSE4_FGT-7.0 Valid Exam Guide
NSE4_FGT-7.0 Actual Questions Answers PDF 100% Cover Real Exam Questions
Fortinet NSE4_FGT-7.0 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION 85
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
- A. FortiGuard web filter cache
- B. NTP
- C. FortiGate hostname
- D. DNS
Answer: B,D
NEW QUESTION 86
Refer to the exhibits.
The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?
- A. The SSL inspection needs to be a deep content inspection.
- B. Additional application signatures are required to add to the security policy.
- C. Force access to Facebook using the HTTP service.
- D. Add Facebook in the URL category in the security policy.
Answer: A
Explanation:
The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.
NEW QUESTION 87
Which two types of traffic are managed only by the management VDOM? (Choose two.)
- A. FortiGuard web filter queries
- B. PKI
- C. Traffic shaping
- D. DNS
Answer: A,D
NEW QUESTION 88
An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24. How must the administrator configure the local quick mode selector for site B?
- A. 192.168.0.0/8
- B. 192.168.2.0/24
- C. 192.168.3.0/24
- D. 192.168.1.0/24
Answer: B
NEW QUESTION 89
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The host field in the HTTP header
- B. The subject field in the server certificate
- C. The subject alternative name (SAN) field in the server certificate
- D. The server name indication (SNI) extension in the client hello message
- E. The serial number in the server certificate
Answer: B,C,D
NEW QUESTION 90
An administrator wants to configure timeouts for users. Regardless of the user behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?
- A. soft-timeout
- B. hard-timeout
- C. new-session
- D. idle-timeout
- E. auth-on-demand
Answer: B
NEW QUESTION 91
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)
- A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
- B. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
- C. ADVPN is only supported with IKEv2.
- D. Tunnels are negotiated dynamically between spokes.
Answer: A,D
NEW QUESTION 92
An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)
- A. The interface is a member of a zone.
- B. The interface is a member of a virtual wire pair.
- C. Captive portal is enabled in the interface.
- D. The interface has been configured for one-arm sniffer.
- E. The operation mode is transparent.
Answer: B,D,E
Explanation:
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top_VirtualWirePair.htm
NEW QUESTION 93
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?
- A. FortiManager
- B. Downstream FortiGate
- C. FortiAnalyzer
- D. Root FortiGate
Answer: D
NEW QUESTION 94
If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?
- A. A CRL
- B. A subordinate CA
- C. A person
- D. A root CA
Answer: D
NEW QUESTION 95
An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?
- A. Disable the RPF check at the FortiGate interface level for the source check.
- B. Enable asymmetric routing at the interface level.
- C. Disable the RPF check at the FortiGate interface level for the reply check.
- D. Enable asymmetric routing, so the RPF check will be bypassed.
Answer: A
NEW QUESTION 96
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To generate logs
- B. To finish any inspection operations
- C. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- D. To remove the NAT operation
Answer: C
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
NEW QUESTION 97
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy.
Which two other security profiles can you apply to the security policy? (Choose two.)
- A. Antivirus scanning
- B. File filter
- C. Intrusion prevention
- D. DNS filter
Answer: A,C
NEW QUESTION 98
View the exhibit.
A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?
- A. Addicting.Games is allowed based on the Application Overrides configuration.
- B. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
- C. Addcting.Games is allowed based on the Categories configuration.
- D. Addicting.Games is blocked on the Filter Overrides configuration.
Answer: A
NEW QUESTION 99
View the exhibit:
Which the FortiGate handle web proxy traffic rue? (Choose two.)
- A. port-VLAN1 is the native VLAN for the port1 physical interface.
- B. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.
- C. Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
- D. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
Answer: B,D
NEW QUESTION 100
Refer to the exhibit to view the application control profile.
Users who use Apple FaceTime video conferences are unable to set up meetings.
In this scenario, which statement is true?
- A. The category of Apple FaceTime is being blocked.
- B. Apple FaceTime belongs to the custom monitored filter.
- C. The category of Apple FaceTime is being monitored.
- D. Apple FaceTime belongs to the custom blocked filter.
Answer: D
NEW QUESTION 101
Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
- A. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.
- B. Create a new service object for TELNET and set the maximum session TTL.
- C. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.
- D. Set the maximum session TTL value for the TELNET service object.
Answer: B,C
NEW QUESTION 102
Refer to the exhibit, which contains a session diagnostic output.
Which statement is true about the session diagnostic output?
- A. The session is a bidirectional TCP connection.
- B. The session is in TCP ESTABLISHED state.
- C. The session is a bidirectional UDP connection.
- D. The session is a UDP unidirectional state.
Answer: C
NEW QUESTION 103
When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?
- A. Universally Unique Identifier
- B. Sequence ID
- C. Log ID
- D. Policy ID
Answer: A
NEW QUESTION 104
......
NSE4_FGT-7.0 Exam questions and answers: https://www.itcertmagic.com/Fortinet/real-NSE4_FGT-7.0-exam-prep-dumps.html
Pass NSE4_FGT-7.0 Exam Info and Free Practice Test: https://drive.google.com/open?id=1GeresjEpnFE2prcBKd1QZQZRmtcc57UZ