NSE4_FGT-7.2 practice questions 1–10

1. Question 1 · 104 in bank

   What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

   • AIt limits the scanning of application traffic to the browser-based technology category only.
   • BIt limits the scanning of application traffic to the DNS protocol only.
   • CIt limits the scanning of application traffic to use parent signatures only.
   • DIt limits the scanning of application traffic to the application category only.

   Show answer

   Answer: A

   Explanation

   NSE4 7.2 Security page 317: You can configure the URL Category within the same security policy; however, adding a URL filter causes application control to scan applications in only the browser-based technology category, for example, Facebook Messenger on the Facebook website.

   Source: Adapted from community discussion — BoostBoris

   Next question

2. Question 2 · 104 in bank

   An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?

   • A192.168.2.0/24
   • B192.168.0.0/8
   • C192.168.1.0/24
   • D192.168.3.0/24

   Show answer

   Answer: A

   Explanation

   A. 192.168.2.0/24 For an IPsec VPN between site A and site B, the administrator has configured the local quick mode selector for site A as 192.168.1.0/24 and the remote quick mode selector as 192.168.2.0/24. This means that the VPN will allow traffic to and from the 192.168.1.0/24 subnet at site A to reach the 192.168.2.0/24 subnet at site B. To complete the configuration, the administrator must configure the local quick mode selector for site B. To do this, the administrator must use the same subnet as the remote quick mode selector for site A, which is 192.168.2.0/24. This will allow traffic to and from the 192.168.2.0/24 subnet at site B to reach the 192.168.1.0/24 subnet at site A. Therefore, the administrator must configure the local quick mode selector for site B as 192.168.2.0/24.

   Source: Adapted from community discussion — Spago

   Next question

3. Question 3 · 104 in bank

   How can you disable RPF checking?

   • ADisable fail-detect on the interface level settings.
   • BDisable strict-src-check under system settings.
   • CUnset fail-alert-interfaces on the interface level settings.
   • DDisable src-check on the interface level settings.

   Show answer

   Answer: D

   Explanation

   D. Disable src-check on the interface level settings. FortiGate Infrastructure 7.2 Study Guide (p.41): "config system interface edit set src-check disable next end" Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • community.fortinet.com documentation

   Next question

4. Question 4 · 104 in bank

   An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must the administrator do to achieve this objective?

   • AThe administrator must register the same FortiToken on more than one FortiGate device.
   • BThe administrator must use the user self-registration server.
   • CThe administrator must use a FortiAuthenticator device.
   • DThe administrator must use a third-party RADIUS OTP server.

   Show answer

   Answer: C

   Explanation

   C. The administrator must use a FortiAuthenticator device. FortiGate Security 7.2 Study Guide (p.150): "You cannot register the same FortiToken on more than one FortiGate. If you want to use the same FortiToken for authentication on multiple FortiGate devices, you must use a central validation server, such as FortiAuthenticator. In that case, FortiTokens are registered and assigned to users on FortiAuthenticator, and FortiGate uses FortiAuthenticator as its validation server." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

5. Question 5 · 104 in bank

   Refer to the exhibits. Exhibit A shows a network diagram. Exhibit B shows the central SNAT policy and IP pool configuration. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. A firewall policy is configured to allow all destinations from LAN (port3) to WAN (port1). Central NAT is enabled, so NAT settings from matching central SNAT policies will be applied.

   

   

   Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?

   • A10.200.1.99
   • B10.200.1.1
   • C10.200.1.49
   • D10.200.1.149

   Show answer

   Answer: A

   Explanation

   A is correct , pings is ICMP so protocol 1. Protocol 1 is enabled on access list id 2 which has destination address SNAT-remote 1

   Source: Adapted from community discussion — besi05

   Next question

6. Question 6 · 104 in bank

   Refer to the exhibits. The exhibits contain a network interface configuration, firewall policies, and a CLI console configuration.

   

   

   How will the FortiGate device handle user authentication for traffic that arrives on the LAN interface?

   • AAll users will be prompted for authentication; users from the HR group can authenticate successfully with the correct credentials.
   • BIf there is a fall-through policy in place, users will not be prompted for authentication.
   • CAll users will be prompted for authentication; users from the sales group can authenticate successfully with the correct credentials.
   • DAuthentication is enforced only at a policy level; all users will be prompted for authentication.

   Show answer

   Answer: A

   Explanation

   Answer is A FortiGate_Security_7.2 page 166 Captive portal will not allow traffic without valid authentication. It happen at interface level, before firewall policy configure on Fortigate: - captive portal authentication required - Authentication failed message for Sales users - Authentication success for HR users - second policy used by HR users Interface LAN (port3) is configured to authenticate and only allow HR to access. " All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials

   Source: Adapted from community discussion — Halmonte0780

   Next question

7. Question 7 · 104 in bank

   Refer to the exhibit. In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output shown in the exhibit.

   

   What should the administrator do next, to troubleshoot the problem?

   • AExecute a debug flow.
   • BCapture the traffic using an external sniffer connected to port1.
   • CExecute another sniffer on FortiGate, this time with the filter "host 10.0.1.10".
   • DRun a sniffer on the web server.

   Show answer

   Answer: A

   Explanation

   A. Execute a debug flow. FortiGate Infrastructure 7.2 Study Guide (p.357): "If FortiGate is dropping packets, can a packet capture (sniffer) be used to identify the reason? To find the cause, you should use the debug (packet) flow." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

8. Question 8 · 104 in bank

   Select 2

   Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

   • AThe client FortiGate requires a manually added route to remote subnets.
   • BThe client FortiGate requires a client certificate signed by the CA on the server FortiGate.
   • CThe server FortiGate requires a CA certificate to verify the client FortiGate certificate.
   • DThe client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN.

   Show answer

   Answer: CD

   Explanation

   C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate. D. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN. FortiGate Infrastructure 7.2 Study Guide (p.200): "The FortiGate can be configured as an SSL VPN client, using an SSL-VPN Tunnel interface type" "The FortiGate devices must have the proper CA certificate installed to verify the certificate chain to the root CA that signed the certificate." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • Fortinet documentation

   Next question

9. Question 9 · 104 in bank

   Which statement correctly describes the use of reliable logging on FortiGate?

   • AReliable logging is enabled by default in all configuration scenarios.
   • BReliable logging is required to encrypt the transmission of logs.
   • CReliable logging can be configured only using the CLI.
   • DReliable logging prevents the loss of logs when the local disk is full.

   Show answer

   Answer: B

   Explanation

   NSE4 - Security Training 7.2 - Study Guide, page 191. "If using reliable logging, you can encrypt communications using SSL-secured OFTP. "

   Source: Adapted from community discussion — RCouto

   References

   • Fortinet documentation
   • community.fortinet.com documentation
   • Fortinet documentation

   Next question

10. Question 10 · 104 in bank

    Refer to the exhibits. The exhibits contain a network diagram, and virtual IP, IP pool, and firewall policies configuration information. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24. The first firewall policy has NAT enabled using IP pool. The second firewall policy is configured with a VIP as the destination address.

    

    

    Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.1.10?

    • A10.200.1.1
    • B10.0.1.254
    • C10.200.1.10
    • D10.200.1.100

    Show answer

    Answer: D

    Explanation

    FortiOS 7.2 Study Guide Page 110: "(Step 2): FortiGate uses as NAT IP the external IP address defined in the VIP when performing SNAT on all egress traffic sourced from the mapped address in the VIP, provided the matching firewall policy has NAT enabled" "Note that you can override the behavior described in step 2 by using an IP pool"

    Source: Adapted from community discussion — 1239944

    References

    • community.fortinet.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 1. 104 questions available.