[Apr-2023 Newly Released] NSE4_FGT-7.0 Dumps for Fortinet NSE 4 Certified
Updated Verified NSE4_FGT-7.0 dumps Q&As - 100% Pass
The Fortinet NSE4_FGT-7.0 certification exam is an industry-standard certification exam designed to validate the skills of network security professionals in managing and configuring Fortinet security products. The certification exam is available to network security professionals worldwide who want to validate their expertise in Fortinet security products. The certification exam covers a wide range of topics and is an excellent way for network security professionals to demonstrate their skills and expertise in Fortinet security products.
NEW QUESTION # 78
Examine the following web filtering log.
Which statement about the log message is true?
- A. The name of the applied web filter profile is default.
- B. The web site miniclip.com matches a static URL filter whose action is set to Warning.
- C. The action for the category Games is set to block.
- D. The usage quota for the IP address 10.0.1.10 has expired
Answer: A
NEW QUESTION # 79
An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?
- A. Enable asymmetric routing, so the RPF check will be bypassed.
- B. Disable the RPF check at the FortiGate interface level for the reply check.
- C. Disable the RPF check at the FortiGate interface level for the source check.
- D. Enable asymmetric routing at the interface level.
Answer: C
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955 Infrast 7.0 SG page 38 RPF checking can be disabled in tho ways. If you enable asymmetric routing, it will disable RPF checking system wide. However this reduces the security of you network greatly. Features such us ANTIVIRUS, and IPS become non-effective. So, if you need to disable RPF checking, you can do so at the interface level using the command: config system interface edit <interface> set src-check [enable | disable] end
NEW QUESTION # 80
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port3 default route has the highest distance.
- B. There will be eight routes active in the routing table.
- C. The port3 default route has the lowest metric.
- D. The port1 and port2 default routes are active in the routing table.
Answer: A,D
NEW QUESTION # 81
Refer to the exhibit.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
- A. Capture the traffic using an external sniffer connected to port1.
- B. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"
- C. Execute a debug flow.
- D. Run a sniffer on the web server.
Answer: C
NEW QUESTION # 82
Which statement about the policy ID number of a firewall policy is true?
- A. It represents the number of objects used in the firewall policy.
- B. It is required to modify a firewall policy using the CLI.
- C. It defines the order in which rules are processed.
- D. It changes when firewall policies are reordered.
Answer: B
NEW QUESTION # 83
Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?
- A. Optimization
- B. Fabric Coverage
- C. Security Posture
- D. Automated Response
Answer: C
Explanation:
Reference:
https://www.fortinet.com/content/dam/fortinet/assets/support/fortinet-recommended-security-bestpractices.pdf Description of the three major scorecards is seen in Security fabric > Security rating>Security posture.
Security Posture Identify configuration weaknesses and best practice violations in your deployment. Fabric Coverage Identify in your overall network, where Security Fabric can enhance visibility and control.
Optimization Optimize your fabric deployment.
NEW QUESTION # 84
Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?
- A. The application signature database inspects traffic only from the original web application server.
- B. FortiGuard maintains only one signature of each web application that is unique.
- C. FortiGate can inspect sub-application traffic regardless where it was originated.
- D. The security actions applied on the web applications will also be explicitly applied on the third-party websites.
Answer: C
NEW QUESTION # 85
Refer to the exhibit.
An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)
- A. The Enable probe packets setting is not enabled.
- B. The configured participants are not SD-WAN members.
- C. Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.
- D. The Detection Mode setting is not set to Passive.
Answer: A,C
NEW QUESTION # 86
Which two statements are true about the RPF check? (Choose two.)
- A. The RPF check is run on the first reply packet of any new session.
- B. RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.
- C. The RPF check is run on the first sent packet of any new session.
- D. The RPF check is run on the first sent and reply packet of any new session.
Answer: B,C
NEW QUESTION # 87
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port3 default route has the highest distance.
- B. There will be eight routes active in the routing table.
- C. The port3 default route has the lowest metric.
- D. The port1 and port2 default routes are active in the routing table.
Answer: A,D
NEW QUESTION # 88
Refer to the exhibit.
Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?
- A. CLI diagnostics commands permission
- B. Read/Write permission for Log & Report
- C. Read/Write permission for Firewall
- D. Custom permission for Network
Answer: A
Explanation:
Explanation
https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220
NEW QUESTION # 89
Refer to the exhibit.
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
- A. Capture the traffic using an external sniffer connected to port1.
- B. Execute another sniffer in the FortiGate, this time with the filter "host 10.0.1.10"
- C. Execute a debug flow.
- D. Run a sniffer on the web server.
Answer: C
NEW QUESTION # 90
You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?
- A. Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.
- B. Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.
- C. No new log is recorded until you manually clear logs from the local disk.
- D. No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.
Answer: B
Explanation:
Reference:
"The system reserves approximately 25% of its disk space for system usage and unexpected quota overflow."
NEW QUESTION # 91
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The flow-based inspection is used, which resets the last packet to the user.
- B. The firewall policy performs the full content inspection on the file.
- C. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
- D. The volume of traffic being inspected is too high for this model of FortiGate.
Answer: A
Explanation:
* "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.
NEW QUESTION # 92
Refer to the web filter raw logs.
Based on the raw logs shown in the exhibit, which statement is correct?
- A. The name of the firewall policy is all_users_web.
- B. Access to the social networking web filter category was explicitly blocked to all users.
- C. The action on firewall policy ID 1 is set to warning.
- D. Social networking web filter category is configured with the action set to authenticate.
Answer: D
NEW QUESTION # 93
Refer to the exhibit to view the firewall policy.
Which statement is correct if well-known viruses are not being blocked?
- A. The firewall policy must be configured in proxy-based inspection mode.
- B. The firewall policy does not apply deep content inspection.
- C. Web filter should be enabled on the firewall policy to complement the antivirus profile.
- D. The action on the firewall policy must be set to deny.
Answer: B
Explanation:
Explanation
Without deep inspection, you would never find a virus in HTTPS traffic. You will only catch a virus when it is send to you via HTTP or FTP with these settings.
NEW QUESTION # 94
An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?
- A. Strict RPF checks the best route back to the source using the incoming interface.
- B. Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface.
- C. The strict RPF check is run on the first sent and reply packet of any new session.
- D. Strict RPF allows packets back to sources with all active routes.
Answer: A
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33955
NEW QUESTION # 95
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
- A. Operating mode
- B. FortiGuaid update servers
- C. System time
- D. NGFW mode
Answer: A,D
Explanation:
C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.
D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide
NEW QUESTION # 96
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)
- A. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
- B. Server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- C. The client FortiGate requires a manually added route to remote subnets.
- D. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
Answer: C,D
Explanation:
Explanation
https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/266506/ssl-vpn-with-certificateauthentication
NEW QUESTION # 97
If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy?
- A. FQDN address
- B. No other object can be added
- C. User or User Group
- D. IP address
Answer: B
Explanation:
If Internet Service is selected as Destination
- You cannot use Address in the Destination
- You cannot select Service in the Firewall Policy
Fortigate Security Study Guide v7.0, page 113
NEW QUESTION # 98
Refer to the exhibit.
Which contains a session diagnostic output. Which statement is true about the session diagnostic output?
- A. The session is in ESTABLISHED state.
- B. The session is in SYN_SENT state.
- C. The session is in FIN_ACK state.
- D. The session is in FTN_WAIT state.
Answer: B
Explanation:
Explanation
Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2)
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
NEW QUESTION # 99
Refer to the exhibit.
According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?
- A. A bridge CA
- B. A user
- C. A root CA
- D. A subordinate
Answer: B
NEW QUESTION # 100
......
Latest NSE4_FGT-7.0 Exam Dumps Fortinet Exam from Training: https://evedumps.testkingpass.com/NSE4_FGT-7.0-testking-dumps.html