NSE4_FGT_AD-7.6 practice questions 71–78

1. Question 71 · 78 in bank

   You are onboarding an agentless, secure web gateway (SWG) endpoint for secure internet access (SIA). What will happen to the user’s nonweb traffic?

   • AAll the nonweb traffic will bypass FortiSASE.
   • BFortiSASE will use SWG to redirect nonweb traffic to FortiExtender.
   • CFortiSASE will use Firewall-as-a-Service (FWaaS) to redirect nonweb traffic.
   • DThe endpoint will use split tunneling to redirect nonweb traffic to FortiSASE.

   Show answer

   Answer: A

   Next question

2. Question 72 · 78 in bank

   Refer to the exhibits.

   

   

   

   The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration. An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver. Which additional configuration can the administrator add to a deny firewall policy, beyond the default behavior, to block Remote-User2 from accessing the Webserver?

   • ASet the Destination address as Webserver in the Deny policy.
   • BDisable match-vip in the Allow_access policy.
   • CSet the Destination address as Deny_IP in the Allow_access policy.
   • DConfigure a One-to-One IP Pool object in a new policy.

   Show answer

   Answer: A

   Next question

3. Question 73 · 78 in bank

   You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied. What should the administrator check first?

   • AThe FortiGate firewall policy settings for SSL decryption.
   • BThe FortiGate FSSO active users list for user’s IP address.
   • CThe windows event viewer for failed login attempts.
   • DWhether the user is assigned to the correct AD group.

   Show answer

   Answer: B

   Next question

4. Question 74 · 78 in bank

   Select 3

   Which three statements explain a flow-based antivirus profile? (Choose three.)

   • AFlow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
   • BFortiGate buffers the whole file but transmits to the client at the same time.
   • CFlow-based inspection optimizes performance compared to proxy-based inspection.
   • DThe IPS engine handles the process as a standalone.
   • EIf a virus is detected, the last packet is delivered to the client.

   Show answer

   Answer: BCD

   Next question

5. Question 75 · 78 in bank

   Refer to the exhibits.

   

   An administrator configured both members of an HA cluster at the same time. After one week of monitoring, the administrator wants to verify the HA failover performance. How can the administrator force a failover?

   • AThe administrator must reset the HA uptime on HQ-NGFW-1.
   • BThe administrator must set the parameter override to enable on HQ-NGFW-2.
   • CThe administrator must set the monitored port1 to down on HQ-NGFW-1.
   • DThe administrator must increase the HA priority on HQ-NGFW-2.

   Show answer

   Answer: A

   Next question

6. Question 76 · 78 in bank

   An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings. What is true about the DNS connection to a FortiGuard server?

   • AIt uses UDP 53.
   • BIt uses DNS over HTTPS.
   • CIt uses DNS over TLS.
   • DIt uses UDP 8888.

   Show answer

   Answer: C

   Next question

7. Question 77 · 78 in bank

   Select 2

   An administrator has configured the following settings.

   

   What are the two results of this configuration? (Choose two.)

   • AThe number of logs generated by denied traffic is reduced.
   • BA session for denied traffic is created.
   • CDenied users are blocked for 30 minutes.
   • DSession helpers are disabled for denied traffic.

   Show answer

   Answer: AB

   Next question

8. Question 78 · 78 in bank

   Select 2

   Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

   • APre-shared key and certificate signature as authentication methods
   • BNo certificate is required on the remote peer when you set the certificate signature as the authentication method
   • CExtended authentication (XAuth) to request the remote peer to provide a username and password
   • DExtended authentication (XAuth) for faster authentication because fewer packets are exchanged

   Show answer

   Answer: AC

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT_AD-7.6 practice, question 71. 78 questions available.