NSE 4 — FortiOS 7.2 Network Security Professional practice questions

1. Question 1 of 25

   Select 2

   Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

   • AThe client FortiGate requires a manually added route to remote subnets.
   • BThe client FortiGate requires a client certificate signed by the CA on the server FortiGate.
   • CThe server FortiGate requires a CA certificate to verify the client FortiGate certificate.
   • DThe client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.

   Show answer

   Correct answer: C, D

   How others answered

   • CD91%

   Explanation

   C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate. D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN. FortiGate Infrastructure 7.2 Study Guide (p.200): "The FortiGate can be configured as an SSL VPN client, using an SSL-VPN Tunnel interface type" "The FortiGate devices must have the proper CA certificate installed to verify the certificate chain to the root CA that signed the certificate." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Adapted from community discussion by raydel92 · 2023-09-08 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. R

      raydel92

      2023-09-08

      Selected C, D6 upvotes

      C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate. D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN. FortiGate Infrastructure 7.2 Study Guide (p.200): "The FortiGate can be configured as an SSL VPN client, using an SSL-VPN Tunnel interface type" "The FortiGate devices must have the proper CA certificate installed to verify the certificate chain to the root CA that signed the certificate." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   2. S

      Spago

      2023-01-07

      Selected C, D2 upvotes

      C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate. D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN. To establish an SSL VPN connection between two FortiGate devices, the following two settings are required: The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate will use a CA (Certificate Authority) certificate to verify the client FortiGate certificate, ensuring that the client device is trusted and allowed to establish an SSL VPN connection. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: The client FortiGate must have an SSL VPN tunnel interface type configured in order to establish an SSL VPN connection. This interface type will be used to connect to the server FortiGate over the SSL VPN.

   3. P

      PaulGo

      2023-04-10

      Selected C, D2 upvotes

      Security pag 582 This configuration requires proper CA certificate installatin as the SSL VPN cliente FortiGate/user uses PSK and a PKI client certificate to authenticate. The FG devices must have the proper CA certificaate installed to verity the certificate chain to the root CA that signed the certificate. link: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/508779/fortigate-as-ssl-vpn-client The SSL VPN server has a custom server certificate defined, and the SSL VPN client user uses PSK and a PKI client certificate to authenticate. The FortiGates must have the proper CA certificate installed to verify the certificate chain to the root CA that signed the certificate.

   4. L

      leadac

      2023-01-29

      Selected C, D3 upvotes

      https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/508779/fortigate-as-ssl-vpn-client The FortiGate can be configured as an SSL VPN client, using an SSL-VPN Tunnel interface type. The FortiGates must have a proper CA certificate installed to verify the certificate chain to the root CA that signed the certificate.

2. Question 2 of 25

   Which statement correctly describes the use of reliable logging on FortiGate?

   • AReliable logging is enabled by default in all configuration scenarios.
   • BReliable logging is required to encrypt the transmission of logs.
   • CReliable logging can be configured only using the CLI.
   • DReliable logging prevents the loss of logs when the local disk is full.

   Show answer

   Correct answer: B

   How others answered

   • B56%
   • D31%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   NSE4 - Security Training 7.2 - Study Guide, page 191. "If using reliable logging, you can encrypt communications using SSL-secured OFTP. "

   Adapted from community discussion by RCouto · 2023-03-01 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation
   • community.fortinet.com documentation
   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. R

      RCouto

      2023-03-01

      Selected B20 upvotes

      NSE4 - Security Training 7.2 - Study Guide, page 191. "If using reliable logging, you can encrypt communications using SSL-secured OFTP. "

   2. L

      leadac

      2023-01-29

      Selected B13 upvotes

      Reliable logging changes the log transport delivery from UDP to TCP. Then, only if you are using Reliable logging, you can do encryption. NSE 4 training 7.2 training material: Fortigate Security: 05.Logging and Monitoring: Page 22, Reliable logging and OFTPs

   3. K

      KHALEDMAG

      2023-07-01

      3 upvotes

      The correct statement is D. Reliable logging prevents the loss of logs when the local disk is full. Reliable logging is a feature that stores log messages in a buffer on the FortiGate until they can be written to the local disk. This helps to prevent the loss of log messages if the local disk becomes full. Reliable logging is not enabled by default, and it can be configured using the CLI or the FortiGate web interface. The other statements are incorrect: Reliable logging is not enabled by default in all configuration scenarios. It must be enabled explicitly. Reliable logging is not required to encrypt the transmission of logs. Encryption can be configured separately. Reliable logging can be configured using the CLI or the FortiGate web interface.

   4. C

      ChinkSantana

      2023-02-05

      5 upvotes

      Correct. Relaible Logging changes delivery method from UDP to TCP as TCP provides relaible data transfer gauranteeing that the transfered data remains intact and arrives in the same order in which it was sent.

3. Question 3 of 25

   Refer to the exhibits. The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. The first firewall policy has NAT enabled using IP pool. The second firewall policy is configured with a VIP as the destination address.

   

   

   Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

   • A10.200.1.1
   • B10.0.1.254
   • C10.200.1.10
   • D10.200.1.100

   Show answer

   Correct answer: D

   How others answered

   • D79%
   • C21%

   Explanation

   FortiOS 7.2 Study Guide Page 110: "(Step 2): FortiGate uses as NAT IP the external IP address defined in the VIP when performing SNAT on all egress traffic sourced from the mapped address in the VIP, provided the matching firewall policy has NAT enabled" "Note that you can override the behavior described in step 2 by using an IP pool"

   Adapted from community discussion by 1239944 · 2023-09-27 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • community.fortinet.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. 1

      1239944

      2023-09-27

      Selected D6 upvotes

      FortiOS 7.2 Study Guide Page 110: "(Step 2): FortiGate uses as NAT IP the external IP address defined in the VIP when performing SNAT on all egress traffic sourced from the mapped address in the VIP, provided the matching firewall policy has NAT enabled" "Note that you can override the behavior described in step 2 by using an IP pool"

   2. S

      spydog

      2023-09-23

      5 upvotes

      VIP external IP will be used for source NAT for outbound traffic, when traffic is matching policy enabled with NAT for egress interface. If outbound traffic match rule with NAT enabled and IP pool configured. Traffic will use the IP pool external IP. Basically SNAT priority from high to low will be : 1) IP pool 2) VIP IP 3) SNAT egress interface

   3. B

      BoostBoris

      2023-02-11

      Selected D3 upvotes

      From LAN to WAN, the Source NAT will use the IPPOOL with address configured 10.200.1.100 Destination NAT, from WAN to LAN, will use the VIP

   4. D

      danieldelgado

      2023-03-15

      3 upvotes

      I correct my answer to D, because the VIP has portwarding enables plus the outgoing policy has an IPPool enabled

4. Question 4 of 25

   Refer to the exhibit. The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router. When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

   

   Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

   • AConfigure a loopback interface with address 203.0.113.2/32.
   • BIn the VIP configuration, enable arp-reply.
   • CEnable port forwarding on the server to map the external service port to the internal service port.
   • DIn the firewall policy configuration, enable match-vip.

   Show answer

   Correct answer: B

   How others answered

   • B94%

   Explanation

   correct answer is B: In the routing table of the ISP we can see that the route is C (connected) which means that if there is no ARP entry, traffic will be dropped by the ISP, and this is why there is no packets in the forti sniffer.

   Adapted from community discussion by kosta_georgiev · 2023-01-18 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • community.fortinet.com documentation
   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. K

      kosta_georgiev

      2023-01-18

      Selected B29 upvotes

      correct answer is B: In the routing table of the ISP we can see that the route is C (connected) which means that if there is no ARP entry, traffic will be dropped by the ISP, and this is why there is no packets in the forti sniffer.

   2. E

      erawemk

      2023-07-02

      8 upvotes

      A. Makes no sense B. This option is available for VIP configurations please check page 115 on security study materials, so this is the correct answer C. It is no required to solve the problem due to firewall policy is allowing all traffic for VIP object D. This option is enabled only for deny policies please check the note in https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641?externalID=FD36750

   3. R

      raydel92

      2023-09-08

      Selected B5 upvotes

      B. In the VIP configuration, enable arp-reply. FortiGate Security 7.2 Study Guide (p.115): "Enabling ARP reply is usually not required in most networks because the routing tables on the adjacent devices contain the correct next hop information, so the networks are reachable. However, sometimes the routing configuration is not fully correct, and having ARP reply enabled can solve the issue for you. For this reason, it’s a best practice to keep ARP reply enabled." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   4. B

      BoostBoris

      2023-02-11

      Selected B4 upvotes

      the external interface address is different from the external address configured in the VIP. This is not a problem as long as the upstream network has its routing properly set. You can also enable ARP reply on the VPN (enabled by default, here disabled) to facilitate routing on the upstream network

5. Question 5 of 25

   Select 3

   Which three statements explain a flow-based antivirus profile? (Choose three.)

   • AFlow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
   • BIf a virus is detected, the last packet is delivered to the client.
   • CThe IPS engine handles the process as a standalone.
   • DFortiGate buffers the whole file but transmits to the client at the same time.
   • EFlow-based inspection optimizes performance compared to proxy-based inspection.

   Show answer

   Correct answer: A, D, E

   How others answered

   • ADE93%

   Explanation

   A: Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection D: the IPS engine reads the payload of each packet, caches a local copy, and forwards the packet to the receiver at the same time. some operations can be offloaded to SPUs to improve performance (not C) E: If performance is your top priority, then flow inspection mode is more appropriate.

   Adapted from community discussion by BoostBoris · 2023-02-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. B

      BoostBoris

      2023-02-11

      Selected A, D, E2 upvotes

      A: Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection D: the IPS engine reads the payload of each packet, caches a local copy, and forwards the packet to the receiver at the same time. some operations can be offloaded to SPUs to improve performance (not C) E: If performance is your top priority, then flow inspection mode is more appropriate.

   2. L

      LAFNELL

      2023-10-24

      Selected A, D, E1 upvote

      D as formulate is definitely not a correct answer. FortiOS 7.2 Admin Guide Page 1086. You can read "When a firewall policy's inspection mode is set to flow, traffic flowing through the policy will not be buffered by the FortiGate". Below the link https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/659145 So, as C is not correct too, i think there is a mistake on the formulation of answer D which should be the correct answer.

   3. M

      MengtingLiang

      2024-04-28

      2 upvotes

      ADE Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection: the default scanning mode and the legacy scanning mode. Optimized performance compared to proxy-basedscanProxy-based. FortiGate buffers the whole file but transmits it to the client simultaneously. If a virus is detected, the last packet is dropped and the connection is reset.

   4. R

      raydel92

      2023-09-08

      Selected A, D, E1 upvote

      A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection. D. FortiGate buffers the whole file but transmits to the client at the same time. E. Flow-based inspection optimizes performance compared to proxy-based inspection. Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

6. Question 6 of 25

   Select 2

   Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

   • AThe keyUsage extension must be set to keyCertSign.
   • BThe CA extension must be set to TRUE.
   • CThe issuer must be a public CA.
   • DThe common name on the subject field must use a wildcard name.

   Show answer

   Correct answer: A, B

   How others answered

   • AB100%

   Explanation

   A & B FortiGate_Security_7.2 page 232 Although it appears as though the user browser is connected to the web server, the browser is connected to FortiGate. FortiGate is acting as a proxy web server. In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign.

   Adapted from community discussion by Eggrolls · 2023-06-21 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • community.fortinet.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. I

      itmaxuser

      2023-07-15

      6 upvotes

      The CA=True value identifies the certificate as a CA certificate. The KryUsage =KeyCertSign value indicates that the certificate corresponding private key is permitted to sign certificates. see RFC 5280 section 4.2.1.9 basic Constraints. Answer is A and B

   2. E

      Eggrolls

      2023-06-21

      Selected A, B4 upvotes

      A & B FortiGate_Security_7.2 page 232 Although it appears as though the user browser is connected to the web server, the browser is connected to FortiGate. FortiGate is acting as a proxy web server. In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign.

   3. R

      raydel92

      2023-09-10

      Selected A, B3 upvotes

      A. The keyUsage extension must be set to keyCertSign. B. The CA extension must be set to TRUE. Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   4. B

      BoostBoris

      2023-02-11

      Selected A, B2 upvotes

      Full SSL inspection - Certificate requirements: FortiGate is acting as a proxy web server. In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign

7. Question 7 of 25

   Select 2

   FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface. In this scenario, what are two requirements for the VLAN ID? (Choose two.)

   • AThe two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
   • BThe two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
   • CThe two VLAN subinterfaces must have different VLAN IDs.
   • DThe two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

   Show answer

   Correct answer: B, C

   How others answered

   • BC60%
   • CD33%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Anything but the "different VLAN" answer is impossible from a networking view, as well as configuration on the FG is concerned. At least up to 7.0 it's impossible to configure the same VLAN on the same physical link multiple times, no matter if it's in separate VDOMs or not.

   Adapted from community discussion by Garry_G · 2023-04-18 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • community.fortinet.com documentation
   • community.fortinet.com documentation
   • community.fortinet.com documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. G

      Garry_G

      2023-04-18

      12 upvotes

      Anything but the "different VLAN" answer is impossible from a networking view, as well as configuration on the FG is concerned. At least up to 7.0 it's impossible to configure the same VLAN on the same physical link multiple times, no matter if it's in separate VDOMs or not.

   2. G

      Garry_G

      2023-09-05

      5 upvotes

      P.S. - did some tests - at least up to 7.0.12, the firewall will instantly complain about duplicate VLAN ID no matter if you select different VDOMs, IPs, or IPs from the same subnet (which will ADDITIONALLY cause an IP-conflict with the first VLAN interface) So, if the official test has this question and asks for two choices, it's definitely wrong ... (as any sane technician would argue)

   3. M

      myrmidon3

      2023-08-30

      Selected B, C3 upvotes

      VLAN https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interface/ta-p/197640 * VLANs can be created on any physical or aggregate (802.3ad) interfaces - The same VLAN number cannot be configured twice on the same physical interface - The same VLAN number can be used on different physical interfaces - The usable VLAN ID range is from 1 to 4094 * VDOM interface assignment - Two VDOMs cannot share the same interface or VLAN - A VLAN sub-interface can belong to a different VDOM than the physical interface it is attached to.

   4. R

      raydel92

      2023-09-08

      Selected B, C3 upvotes

      B. The two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs. C. The two VLAN subinterfaces must have different VLAN IDs. https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-use-emac-vlan-to-share-the-same-VLAN/ta-p/192843?externalID=FD43883 Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

8. Question 8 of 25

   Select 2

   Refer to the exhibit. The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.

   

   Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)

   • AFortiGate allocates port blocks per user, based on the configured range of internal IP addresses.
   • BFortiGate allocates port blocks on a first-come, first-served basis.
   • CFortiGate generates a system event log for every port block allocation made per user.
   • DFortiGate allocates 128 port blocks per user.

   Show answer

   Correct answer: B, C

   How others answered

   • BC91%

   Explanation

   Not A: FortiGate allocates a block size and number per host for a range of external addresses B: FortiGate allocates port blocks on a first-come, first-served basis C: For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator Not D: It allows 8 blocks of 128 ports per host

   Adapted from community discussion by BoostBoris · 2023-02-11 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Fortinet documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. B

      BoostBoris

      2023-02-11

      Selected B, C19 upvotes

      Not A: FortiGate allocates a block size and number per host for a range of external addresses B: FortiGate allocates port blocks on a first-come, first-served basis C: For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator Not D: It allows 8 blocks of 128 ports per host

   2. R

      raydel92

      2023-09-10

      Selected B, C5 upvotes

      B. FortiGate allocates port blocks on a first-come, first-served basis. C. FortiGate generates a system event log for every port block allocation made per user. FortiGate Security 7.2 Study Guide (p.109): "FortiGate allocates port blocks on a first-come, first-served basis." "For logging purposes, when FortiGate allocates a port block to a host, it generates a system event log to inform the administrator." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   3. D

      darkstar15

      2023-08-06

      3 upvotes

      Tal vez la única diferencia es de user a host en la respuesta. pero esta documentado en Security 7.2 pag. 109: FortiGate allocates port blocks on a first-come, first-served basis. The port block allocation is made when FortiGate receives a packet from unserved hosts. FortiGate also generates system event logs with the port block allocation details to inform the administrator.

   4. N

      NKWEN123

      2023-05-16

      4 upvotes

      I agree. Answers B and C are correct. Security 7.2 Study Guide page 108.

9. Question 9 of 25

   An administrator wants to configure timeouts for users. Regardless of the user's behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should the administrator configure on FortiGate?

   • Anew-session
   • Bidle-timeout
   • Chard-timeout
   • Dsoft-timeout
   • Eauth-on-demand

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Hard: time is an absolute value. Regardless of the user’s behavior, the timer starts as soon as the user authenticates and expires after the configured value.

   Adapted from community discussion by BoostBoris · 2023-02-11 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • community.fortinet.com documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

   1. B

      BoostBoris

      2023-02-11

      Selected C5 upvotes

      Hard: time is an absolute value. Regardless of the user’s behavior, the timer starts as soon as the user authenticates and expires after the configured value.

   2. E

      erawemk

      2023-07-03

      Selected C3 upvotes

      Answer is C: hard-timeout https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-auth-timeout-types-for-Firewall/ta-p/189423

   3. R

      raydel92

      2023-09-10

      Selected C2 upvotes

      C. hard-timeout Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   4. H

      Halmonte0780

      2023-07-23

      3 upvotes

      Answer is C: hard-timeout Fortigate Security 7.2 Study Guide, Pag. 167

10. Question 10 of 25

    Select 2

    Refer to the exhibits. The exhibits show a network diagram and firewall configurations. An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.

    

    

    In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)

    • ADisable match-vip in the Deny policy.
    • BSet the Destination address as Webserver in the Deny policy.
    • CEnable match-vip in the Deny policy.
    • DSet the Destination address as Deny_IP in the Allow_access policy.

    Show answer

    Correct answer: B, C

    How others answered

    • BC93%

    Explanation

    Answer should be BC. It makes sense that the destination address be the webserver which needs to be denied for IP Deny_IP

    Adapted from community discussion by Poseidon458 · 2023-01-25 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. P

       Poseidon458

       2023-01-25

       Selected B, C4 upvotes

       Answer should be BC. It makes sense that the destination address be the webserver which needs to be denied for IP Deny_IP

    2. A

       AgentSmith

       2023-06-25

       3 upvotes

       BC A. Disable match-vip in the Deny policy. - No, because you want to match destination IP 203.0.113.22 B. Set the Destination address as Webserver in the Deny policy. - Yes - Source Remote_user2, dest Webserver (203.0.113.22). - Best practice is to be explicit C. Enable match-vip in the Deny policy. - allows policy to match the Webserver - VIP IPs D. Set the Destination address as Deny_IP in the Allow_access policy. - No because we want to block Remote_user2

    3. Z

       zheka

       2023-03-24

       3 upvotes

       You are wrong with D. Look and read carefully this Fortinet guide, i.e. FortiGate_Security_7.2_Study_Guide, namely page 114. It says: In case you want to block only traffic destined to one ore more VIPs you can reference the VIP as the destination address in the deny firewall policy. The key here is the Deny policy, not the Allow policy

    4. K

       Knowledge33

       2023-10-06

       2 upvotes

       You're correct on the answers, It's b and c. But the explanation is wrong. B is correct because. We use destination NAT. Then in the firewall rule, we need to match the the private IP of the server and not the public IP. That's why B is correct but not D. When FG receives a packet, it performs first the DNAT, then firewall rules checking.

11. Question 11 of 25

    An administrator has configured a strict RPF check on FortiGate. How does strict RPF check work?

    • AStrict RPF allows packets back to sources with all active routes.
    • BStrict RPF checks the best route back to the source using the incoming interface.
    • CStrict RPF checks only for the existence of at least one active route back to the source using the incoming interface.
    • DStrict RPF check is run on the first sent and reply packet of any new session.

    Show answer

    Correct answer: B

    How others answered

    • B94%

    Explanation

    According to FortiGate_Infrastructure_7.2_Study_Guide page 40 Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the the rpf check fails.

    Adapted from community discussion by Wrath4980 · 2023-12-03 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. M

       moutaz1983

       2023-01-03

       14 upvotes

       Answer should be (B), The strict RPF check ensures the best route back to the source is used as the incoming interface

    2. W

       Wrath4980

       2023-12-03

       Selected B6 upvotes

       According to FortiGate_Infrastructure_7.2_Study_Guide page 40 Strict: In this mode, Fortigate also verifies that the matching route is the best route in the routing table. That is, if the route in table contains a matching route for the source address and the incoming interface, but there is a better route for the source address through another interface the the rpf check fails.

    3. S

       Spago

       2023-01-07

       4 upvotes

       B. Strict RPF checks the best route back to the source using the incoming interface. Strict Reverse Path Forwarding (RPF) is a security feature that is used to detect and prevent IP spoofing attacks on a network. It works by checking the routing information for incoming packets to ensure that they are coming from the source address that is indicated in the packet's header. In strict RPF mode, the firewall will check the best route back to the source of the incoming packet using the incoming interface. If the packet's source address does not match the route back to the source, the packet is dropped. This helps to prevent attackers from spoofing their IP address and attempting to access the network.

    4. R

       raydel92

       2023-09-08

       Selected B2 upvotes

       B. Strict RPF checks the best route back to the source using the incoming interface. FortiGate Infrastructure 7.2 Study Guide (p.41): "Strict: In this mode, FortiGate also verifies that the matching route is the best route in the routing table. That is, if the routing table contains a matching route for the source address and incoming interface, but there is a better route for the source address through another interface, then, the RPF check fails." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

12. Question 12 of 25

    Which statement about video filtering on FortiGate is true?

    • AVideo filtering FortiGuard categories are based on web filter FortiGuard categories.
    • BIt does not require a separate FortiGuard license.
    • CFull SSL inspection is not required.
    • DOtis available only on a proxy-based firewall policy.

    Show answer

    Correct answer: D

    How others answered

    • D90%

    Explanation

    D. It is available only on a proxy-based firewall policy. FortiGate Security 7.2 Study Guide (p.279): "To apply the video filter profile, proxy-based firewall polices currently allow you to enable the video filter profile. You must enable full SSL inspection on the firewall policy." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-10 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. R

       raydel92

       2023-09-10

       Selected D7 upvotes

       D. It is available only on a proxy-based firewall policy. FortiGate Security 7.2 Study Guide (p.279): "To apply the video filter profile, proxy-based firewall polices currently allow you to enable the video filter profile. You must enable full SSL inspection on the firewall policy." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    2. S

       ssssss_12345

       2023-03-25

       Selected D4 upvotes

       Not A - Video Filtering FortiGuard categories are based on a combination of popular online video provider categories, not web filter FortiGuard categories Not B - It is part of the FortiGuard "service", but requires a SEPARATE license bundled with the other FortiGuard security services NOT C - video filtering DOES require full SSL inspection By process of elimination, the answer is D - but I can't find any documentation specifically for "Otis"....but video filtering in general should be applied to only proxy-based FW policies

    3. Z

       zheka

       2023-03-26

       5 upvotes

       To support it is D take a look at NSE4_FGT-7.2 guide page 279

    4. I

       ianomax

       2023-06-05

       Selected D3 upvotes

       Video filtering is only proxy-based https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/860867/filtering-based-on-fortiguard-categories

13. Question 13 of 25

    Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

    • AThe collector agent must search Windows application event logs.
    • BThe NetSessionEnum function is used to track user logouts.
    • CNetAPI polling can increase bandwidth usage in large networks.
    • DThe collector agent uses a Windows API to query DCs for user logins.

    Show answer

    Correct answer: B

    How others answered

    • B55%
    • C39%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I really want to advise all who is studying and taking the exam soon.This Q: Question #: 42, the ans is : C. NetAPI polling can increase bandwidth usage in large networks. Reason being, when NetAPI: polls sessions created on the DC, it only polls user logins and NOT logouts. And as such it does this every 9seconds if default timer is used. Hence, it will generate alot of bandwidth in large networks.

    Adapted from community discussion by NaturehasIT · 2023-02-13 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation
    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. N

       NaturehasIT

       2023-02-13

       22 upvotes

       I really want to advise all who is studying and taking the exam soon.This Q: Question #: 42, the ans is : C. NetAPI polling can increase bandwidth usage in large networks. Reason being, when NetAPI: polls sessions created on the DC, it only polls user logins and NOT logouts. And as such it does this every 9seconds if default timer is used. Hence, it will generate alot of bandwidth in large networks.

    2. R

       RabbitB

       2023-06-18

       Selected B3 upvotes

       NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.

    3. L

       LAFNELL

       2023-10-25

       Selected B3 upvotes

       Answer is B you can check FortiGate Infrastructure 7.2 Study Guide p.128 NetAPI: Polls temporary sessions created on the DC when users logs in or logs out and calls the NetSessionEnum function on Windows.

    4. C

       claumagagnotti

       2023-03-10

       Selected B3 upvotes

       NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows

14. Question 14 of 25

    Select 2

    Refer to the exhibit.

    

    Based on the routing database shown in the exhibit, which two conclusions can you make about the routes? (Choose two.)

    • AThe port3 default route has the lowest metric.
    • BThe port1 and port2 default routes are active in the routing table.
    • CThe ports default route has the highest distance.
    • DThere will be eight routes active in the routing table.

    Show answer

    Correct answer: B, C

    How others answered

    • BC90%

    Explanation

    I found in other questionnaires the well written options (here they are not written correctly): a.- The port3 default route has the lowest metric, making it the best route. b.- Both port1 and port 2 default routers are active in the routing table. c.- The port3 default has a higher distance than port1 and port2 default routes d.- There will be eight toutes active in the routing table So the correct answers are B&C.

    Adapted from community discussion by Timbal · 2023-06-10 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. T

       Timbal

       2023-06-10

       21 upvotes

       I found in other questionnaires the well written options (here they are not written correctly): a.- The port3 default route has the lowest metric, making it the best route. b.- Both port1 and port 2 default routers are active in the routing table. c.- The port3 default has a higher distance than port1 and port2 default routes d.- There will be eight toutes active in the routing table So the correct answers are B&C.

    2. B

       BoostBoris

       2023-02-11

       Selected B, C4 upvotes

       Bit confusing… Routes with *> are active. So port1 and port2. Answer B. For C, I guess there is a typo and meant port3 has the highest distance, which is true

    3. R

       raydel92

       2023-09-10

       Selected B, C2 upvotes

       Correct: B. The port1 and port2 default routes are active in the routing table. C. The "port3" default route has the highest distance. C option correctly written in Question 41: https://www.examtopics.com/exams/fortinet/nse4_fgt-70/view/11/ Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    4. Y

       yamahaforti

       2023-05-22

       3 upvotes

       A - Can't be right since every route has metric value of 0 B - Correct since they are active C - No they don't. A value of [10/0] is lower than port3 route that has [20/0] D - Where is the eight route? Check page 57 in FortiGate_Infrastructure_7.2_Study_Guide-Online.pdf

15. Question 15 of 25

    Select 2

    An administrator has configured the following settings: config system settings set ses-denied-traffic enable end config system global set block-session-timer 30 end What are the two results of this configuration? (Choose two.)

    • ADevice detection on all interfaces is enforced for 30 minutes.
    • BDenied users are blocked for 30 minutes.
    • CThe number of logs generated by denied traffic is reduced.
    • DA session for denied traffic is created.

    Show answer

    Correct answer: C, D

    How others answered

    • CD93%

    Explanation

    C. The number of logs generated by denied traffic is reduced. D. A session for denied traffic is created. FortiGate Security 7.2 Study Guide (p.69): "During the session, if a security profile detects a violation, FortiGate records the attack log immediately. To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied. This ensures that FortiGate does not have to do a policy lookup for each new packet matching the denied session, which reduces CPU usage and log generation. This option is in the CLI, and is called ses-denied-traffic. You can also set the duration for block sessions. This determines how long a session will be kept in the session table by setting block-sessiontimer in the CLI. By default, it is set to 30 seconds." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-08 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation
    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. M

       moutaz1983

       2023-01-03

       25 upvotes

       It is C-D, the timer config any way is by seconds not minutes

    2. R

       raydel92

       2023-09-08

       Selected C, D13 upvotes

       C. The number of logs generated by denied traffic is reduced. D. A session for denied traffic is created. FortiGate Security 7.2 Study Guide (p.69): "During the session, if a security profile detects a violation, FortiGate records the attack log immediately. To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied. This ensures that FortiGate does not have to do a policy lookup for each new packet matching the denied session, which reduces CPU usage and log generation. This option is in the CLI, and is called ses-denied-traffic. You can also set the duration for block sessions. This determines how long a session will be kept in the session table by setting block-sessiontimer in the CLI. By default, it is set to 30 seconds." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    3. S

       Spago

       2023-01-07

       3 upvotes

       B. Denied users are blocked for 30 minutes. D. A session for denied traffic is created. In this configuration, the following two results will occur: Denied users are blocked for 30 minutes: The block-session-timer setting determines how long a user will be blocked after being denied access to the network. In this case, the block-session-timer is set to 30 minutes, so denied users will be blocked for 30 minutes. A session for denied traffic is created: The ses-denied-traffic setting determines whether a session is created for denied traffic. In this case, the ses-denied-traffic setting is enabled, so a session will be created for denied traffic. This allows the administrator to track and monitor denied traffic on the network.

    4. A

       AgentSmith

       2023-06-25

       4 upvotes

       C D We enable denied session to be added into the session table to reduce the CPU processing due to denied session from same source/destination ip address, port and protocol. Solution Below are the commands to enable denied session to be added into the session table: #config system settings #set ses-denied-traffic enable #end For optimum performance, adjust the global block-session-timer. #config system global #set block-session-timer (default = ) #end

16. Question 16 of 25

    Which statement describes a characteristic of automation stitches?

    • AThey can have one or more triggers.
    • BThey can be run only on devices in the Security Fabric.
    • CThey can run multiple actions simultaneously.
    • DThey can be created on any device in the fabric.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Correct: C. They can run multiple actions simultaneously. Incorrect: A. They can have one or more triggers. B. They can be run only on devices in the Security Fabric. D. They can be created on any device in the fabric. FortiGate Security 7.2 Study Guide (p.443): A - "Each automation stitch pairs a trigger and one or more actions." B - "However, the Security Fabric is not required to use stitches." C - "Can run actions sequentially or in parallel" D - "Can be created only on the root FortiGate in the Security Fabric" Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-13 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. R

       raydel92

       2023-09-13

       Selected C3 upvotes

       Correct: C. They can run multiple actions simultaneously. Incorrect: A. They can have one or more triggers. B. They can be run only on devices in the Security Fabric. D. They can be created on any device in the fabric. FortiGate Security 7.2 Study Guide (p.443): A - "Each automation stitch pairs a trigger and one or more actions." B - "However, the Security Fabric is not required to use stitches." C - "Can run actions sequentially or in parallel" D - "Can be created only on the root FortiGate in the Security Fabric" Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    2. H

       HeartOrange

       2023-02-16

       Selected C3 upvotes

       Actions can be run sequentially or in parallel per the slides from NSE 4 FortiGate Security 7.2 - Security Fabric.

    3. P

       Phil708

       2023-05-24

       Selected C2 upvotes

       A - Incorrect - 1 trigger for 1+ action B - Incorrect - Must be created on Root device but can run on any device C - Correct D - Incorrect - Security Fabric not required

    4. R

       Robinbehreccna

       2023-01-18

       Selected C1 upvote

       C is correct, here under actions, it says one ore more https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/351998/creating-automation-stitches

17. Question 17 of 25

    Refer to the exhibit. The exhibit shows the output of a diagnose command.

    

    What does the output reveal about the policy route?

    • AIt is an ISDB route in policy route.
    • BIt is a regular policy route.
    • CIt is an ISDB policy route with an SDWAN rule.
    • DIt is an SDWAN rule in policy route.

    Show answer

    Correct answer: D

    How others answered

    • D90%

    Explanation

    Answer is D, ref FortiGate 7.2 Infrastructure page 59 In diagnose firewall proute list, if: * ID = 65535 without vwl_service field then it is ISDB route * ID >=65535 with vwl_service field then it is SD-WAN rule.

    Adapted from community discussion by [Removed] · 2023-06-18 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. [

       [Removed]

       2023-06-18

       Selected D23 upvotes

       Answer is D, ref FortiGate 7.2 Infrastructure page 59 In diagnose firewall proute list, if: * ID = 65535 without vwl_service field then it is ISDB route * ID >=65535 with vwl_service field then it is SD-WAN rule.

    2. T

       Timbal

       2023-06-10

       3 upvotes

       The correct answer is D Examples: Static route with “Internet Services”: id=2113929252 static_route=36 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-0 iif=0(any) dport=1-65535 path(1) oif=8(wan2) source wildcard(1): 0.0.0.0/0.0.0.0 destination wildcard(1): 0.0.0.0/0.0.0.0 internet service(1): Adobe-DNS(917507,0,0,0) SDWan rules with Internet Services: id=2134507527(0x7f3a0007) vwl_service=7(SDWanRulewithIS) vwl_mbr_seq=2 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0(any) dport=1-65535 path(1) oif=8(wan2) source(1): 192.168.0.0-192.168.0.255 destination wildcard(1): 0.0.0.0/0.0.0.0 internet service(1): Adobe-Adobe.Experience.Cloud(917640,0,0,0) hit_count=0 last_used=2023-06-10 17:24:19

    3. B

       bix88

       2023-04-09

       Selected D4 upvotes

       Correct is D, page 59 infrastructure study guide. The image is the same of the study guide, SD-WAN rule.

    4. R

       raydel92

       2023-09-13

       Selected D2 upvotes

       D. It is an SDWAN rule in policy route. FortiGate Infrastructure 7.2 Study Guide (p.59): "ISDB routes and SD-WAN rules are assigned an ID higher than 65535. However, SD-WAN rule entries include the vwl_service field, and ISDB route entries don’t." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

18. Question 18 of 25

    An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings. What is true about the DNS connection to a FortiGuard server?

    • AIt uses UDP 8888.
    • BIt uses UDP 53.
    • CIt uses DNS over HTTPS.
    • DIt uses DNS over TLS.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Study Guide Page 15 - By default, uses DNS over TLS DoT to secure DNS traffic - FortiOS uses Fortiguard server for DNS requests

    Adapted from community discussion by Senox999 · 2023-05-15 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. S

       Senox999

       2023-05-15

       Selected D6 upvotes

       Study Guide Page 15 - By default, uses DNS over TLS DoT to secure DNS traffic - FortiOS uses Fortiguard server for DNS requests

    2. R

       raydel92

       2023-09-13

       Selected D2 upvotes

       D. It uses DNS over TLS. FortiGate Security 7.2 Study Guide (p.15): "When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    3. R

       RabbitB

       2023-06-21

       3 upvotes

       FortiGate Security 7.2 Study Guide P.15 When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic. New FortiGuard DNS servers have been added as primary and secondary servers.

    4. D

       Dalik

       2023-04-28

       3 upvotes

       Correction: D is the right answer. 'When using FortiGuard servers for DNS, FortiOS defaults to using DNS over TLS (DoT) to secure the DNS traffic. New FortiGuard DNS servers are added as primary and secondary servers.'

19. Question 19 of 25

    Select 2

    Which two statements describe how the RPF check is used? (Choose two.)

    • AThe RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
    • BThe RPF check is run on the first sent and reply packet of any new session.
    • CThe RPF check is run on the first sent packet of any new session.
    • DThe RPF check is run on the first reply packet of any new session.

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    Explanation

    A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks. C. The RPF check is run on the first sent packet of any new session. FortiGate Infrastructure 7.2 Study Guide (p.41): "The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table." "FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn’t perform any additional RPF checks on that session." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-13 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. T

       Takumi

       2023-07-16

       Selected A, C6 upvotes

       The two statements that describe how the RPF check is used are A and C. RPF stands for Reverse Path Forwarding. It is a security mechanism that protects FortiGate and the network from IP spoofing attacks. The RPF check is run on the first sent packet of any new session. This is because the first packet is the only packet that contains the source IP address of the sender.

    2. R

       raydel92

       2023-09-13

       Selected A, C4 upvotes

       A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks. C. The RPF check is run on the first sent packet of any new session. FortiGate Infrastructure 7.2 Study Guide (p.41): "The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table." "FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn’t perform any additional RPF checks on that session." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    3. J

       Jumpy007

       2023-09-16

       Selected A, C1 upvote

       Found this also which explains C litteraly. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reverse-path-forwarding-check-not-working-for/ta-p/230015

    4. L

       Lalane

       2023-09-13

       1 upvote

       Correct answer are A & D, because as indicated by its name "reverse patch check" is done on the first reply packet of any new session.

20. Question 20 of 25

    An administrator needs to increase network bandwidth and provide redundancy. Which interface type must the administrator select to bind multiple FortiGate interfaces?

    • ARedundant interface
    • BSoftware switch interface
    • CVLAN interface
    • DAggregate interface

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Es la D la respuesta. FortiOS 7.2 Administration Guide pag 190. Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link has the bandwidth of all the links combined. If a link in the group fails, traffic is transferred automatically to the remaining interfaces. The only noticeable effect is reduced bandwidth. This feature is similar to redundant interfaces. The major difference is a redundant interface group only uses one link at a time, where an aggregate link group uses the total bandwidth of the functioning links in the group, up to eight (or more).

    Adapted from community discussion by darkstar15 · 2023-08-11 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. D

       darkstar15

       2023-08-11

       4 upvotes

       Es la D la respuesta. FortiOS 7.2 Administration Guide pag 190. Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link has the bandwidth of all the links combined. If a link in the group fails, traffic is transferred automatically to the remaining interfaces. The only noticeable effect is reduced bandwidth. This feature is similar to redundant interfaces. The major difference is a redundant interface group only uses one link at a time, where an aggregate link group uses the total bandwidth of the functioning links in the group, up to eight (or more).

    2. R

       raydel92

       2023-09-13

       Selected D2 upvotes

       D. Aggregate interface Download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    3. H

       Halmonte0780

       2023-07-25

       3 upvotes

       The answer is D https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/567758/aggregation-and-redundancy

    4. S

       sugar12

       2024-02-09

       1 upvote

       D as for redundant interfaces only one stays Up therefore they do not provide extra bandwidth. B & C are out of scop

21. Question 21 of 25

    Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services.

    

    Which CLI command must the administrator use to view the route?

    • Aget router info routing-table database
    • Bdiagnose firewall route list
    • Cget internet-service route list
    • Dget router info routing-table all

    Show answer

    Correct answer: B

    How others answered

    • B80%

    Explanation

    B. diagnose firewall proute list FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-13 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation
    • community.fortinet.com documentation
    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. A

       ansalias

       2023-07-13

       12 upvotes

       Answer B should be diagnose firewall proute list (p is missing...) Infrastructure Guide p.59

    2. R

       raydel92

       2023-09-13

       Selected B8 upvotes

       B. diagnose firewall proute list FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    3. H

       Halmonte0780

       2023-08-01

       3 upvotes

       Answer B. ISDB static route will not create entry directly in routing-table. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-for-Predefined-Internet/ta-p/198756 and here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Verify-the-matching-policy-route/ta-p/190640

    4. A

       Artbrut

       2024-01-19

       1 upvote

       https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-p/189996

22. Question 22 of 25

    Refer to the exhibits. An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

    

    

    What must the administrator do to synchronize the address object?

    • AChange the csf setting on ISFW (downstream) to set configuration-sync local.
    • BChange the csf setting on ISFW (downstream) to set authorization-request-type certificate.
    • CChange the csf setting on both devices to set downstream-access enable.
    • DChange the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

    Show answer

    Correct answer: C

    How others answered

    • C61%
    • D39%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    D - not correct Fortigate Security guide 7.2 - page 434 The CLI command "set fabric-object-unification" is only available on the root FortiGate.

    Adapted from community discussion by JakubCh · 2023-07-17 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation
    • Fortinet documentation
    • Fortinet documentation
    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. J

       JakubCh

       2023-07-17

       Selected C11 upvotes

       D - not correct Fortigate Security guide 7.2 - page 434 The CLI command "set fabric-object-unification" is only available on the root FortiGate.

    2. W

       wwwwaaaa

       2023-11-09

       Selected C5 upvotes

       A is wrong, "if set configuration-sync is set to local, the downstream device does not participate in synchronization" B wrong, as the connection has been established and no need to authenticate D is wrong, the command is already there on the root C is the only one left

    3. M

       Mallu_92

       2024-03-18

       Selected C4 upvotes

       A and B does not apply here, D answer doesn't change anything in the configuration as it is already configured in the root FG. Correct answer is C.

    4. K

       kosta_georgiev

       2023-01-29

       Selected C3 upvotes

       The root device has downstream access disabled, so it needs to be enabled to sync the object, as explained here. https://docs.fortinet.com/document/fortigate/7.2.3/cli-reference/144620/config-system-csf downstream-access - Enable/disable downstream device access to this device's configuration and data. disable - Disable downstream device access to this device's configuration and data.

23. Question 23 of 25

    You have enabled logging on a FortiGate device for event logs and all security logs, and you have set up logging to use the FortiGate local disk. What is the default behavior when the local disk is full?

    • ANo new log is recorded after the warning is issued when log disk use reaches the threshold of 95%.
    • BNo new log is recorded until you manually clear logs from the local disk.
    • CLogs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%.
    • DLogs are overwritten and the only warning is issued when log disk use reaches the threshold of 95%.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C. Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%. config log disk setting set diskfull [ overwrite | nolog ] Action to take when disk is full. The system can overwrite the oldest log messages or stop logging when the disk is full. (default --> overwrite) config log memory global-setting set full-first-warning-threshold {integer} Log full first warning threshold as a percent. (default --> 75) Reference: https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/421620/config-log-disk-setting https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/418620/config-log-memory-global-setting

    Adapted from community discussion by raydel92 · 2023-09-13 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation
    • Fortinet documentation
    • Fortinet documentation
    • Fortinet documentation

    View community discussion3

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. R

       raydel92

       2023-09-13

       6 upvotes

       C. Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%. config log disk setting set diskfull [ overwrite | nolog ] Action to take when disk is full. The system can overwrite the oldest log messages or stop logging when the disk is full. (default --> overwrite) config log memory global-setting set full-first-warning-threshold {integer} Log full first warning threshold as a percent. (default --> 75) Reference: https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/421620/config-log-disk-setting https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/418620/config-log-memory-global-setting

    2. L

       link13

       2023-08-02

       2 upvotes

       C.... https://docs.fortinet.com/document/fortigate/7.2.1/cli-reference/468620/config-log-memory-global-setting

    3. L

       link13

       2023-08-02

       1 upvote

       Logs are overwritten by default - https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/482620/config-log-disk-setting

24. Question 24 of 25

    Which statement is correct regarding the security fabric?

    • AFortiManager is one of the required member devices.
    • BFortiGate devices must be operating in NAT mode.
    • CA minimum of two Fortinet devices is required.
    • DFortiGate Cloud cannot be used for logging purposes.

    Show answer

    Correct answer: B

    How others answered

    • B82%

    Explanation

    Correct: B. FortiGate devices must be operating in NAT mode. Incorrect: A. FortiManager is one of the required member devices. (Recommended member) C. A minimum of two Fortinet devices is required. (3 Fortinet devices = 2 FG + 1 logging) D. FortiGate Cloud cannot be used for logging purposes. (It can be used) FortiGate Security 7.2 Study Guide (p.428): "You must have a minimum of two FortiGate devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Adapted from community discussion by raydel92 · 2023-09-13 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Fortinet documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. R

       raydel92

       2023-09-13

       Selected B12 upvotes

       Correct: B. FortiGate devices must be operating in NAT mode. Incorrect: A. FortiManager is one of the required member devices. (Recommended member) C. A minimum of two Fortinet devices is required. (3 Fortinet devices = 2 FG + 1 logging) D. FortiGate Cloud cannot be used for logging purposes. (It can be used) FortiGate Security 7.2 Study Guide (p.428): "You must have a minimum of two FortiGate devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    2. V

       velrisan

       2023-09-21

       Selected B4 upvotes

       B is the correct answer. This is the explanation. You must have a minimum of two FORTIGATE devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode. C is incorrect, because said you must have two fortinet devices no fortigate. PAGE 428 7.2

    3. V

       Vic2911

       2023-09-07

       Selected B3 upvotes

       Correct answer is B - FortiGate devices must operate in NAT mode https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/58646/security-fabric-settings-and-usage C is wrong since the rcore requirements for Security Fabric are: 2 FortiGate devices AND one of the following: FortiAnalyzer, FortiAnalyzer Cloud, FortiGate Cloud

    4. M

       Melazizy

       2023-08-27

       Selected B4 upvotes

       Answer is B As he says 2 Fortinet devices not 2 FortiGate devices.

25. Question 25 of 25

    What is a reason for triggering IPS fail open?

    • AThe IPS socket buffer is full and the IPS engine cannot process additional packets.
    • BThe IPS engine cannot decode a packet.
    • CThe IPS engine is upgraded.
    • DThe administrator enabled NTurbo acceleration.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Tambien hay una referencia en administration guide pag. 1313 A fail-open scenario is triggered when IPS raw socket buffer is full. Therefore IPS engine has no space in memory to create more sessions and needs to decide whether to drop the sessions or bypass the sessions without inspection

    Adapted from community discussion by darkstar15 · 2023-08-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • community.fortinet.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by NSE4_FGT-7.2 or CertExamHQ.

    1. D

       darkstar15

       2023-08-15

       4 upvotes

       Tambien hay una referencia en administration guide pag. 1313 A fail-open scenario is triggered when IPS raw socket buffer is full. Therefore IPS engine has no space in memory to create more sessions and needs to decide whether to drop the sessions or bypass the sessions without inspection

    2. H

       Halmonte0780

       2023-07-23

       3 upvotes

       A is the correct answer. FortiGate_Security_7.2_Study_Guide Page 418

    3. A

       ansalias

       2023-07-13

       Selected A2 upvotes

       A is the correct answer. The IPS socket buffer is full, see Infrastructure Guide p.368

    4. L

       lupnoob

       2023-07-15

       Selected A1 upvote

       Answer is A. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPS-socket-size-and-fail-open-mode/ta-p/191254#:~:text=A%20'fail%2Dopen'%20scenario,or%20bypass%20them%20without%20inspection.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 1 of 25