NSE4_FGT-7.2 practice questions 11–20

1. Question 11 · 104 in bank

   Refer to the exhibit. The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router. When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

   

   Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

   • AConfigure a loopback interface with address 203.0.113.2/32.
   • BIn the VIP configuration, enable arp-reply.
   • CEnable port forwarding on the server to map the external service port to the internal service port.
   • DIn the firewall policy configuration, enable match-vip.

   Show answer

   Answer: B

   Explanation

   correct answer is B: In the routing table of the ISP we can see that the route is C (connected) which means that if there is no ARP entry, traffic will be dropped by the ISP, and this is why there is no packets in the forti sniffer.

   Source: Adapted from community discussion — kosta_georgiev

   References

   • community.fortinet.com documentation
   • Fortinet documentation

   Next question

2. Question 12 · 104 in bank

   Select 2

   Which two statements are true about the FGCP protocol? (Choose two.)

   • AFGCP elects the primary FortiGate device.
   • BFGCP is not used when FortiGate is in transparent mode.
   • CFGCP runs only over the heartbeat links.
   • DFGCP is used to discover FortiGate devices in different HA groups.

   Show answer

   Answer: AC

   Explanation

   A. FGCP elects the primary FortiGate device. C. FGCP runs only over the heartbeat links. The FGCP (FortiGate Clustering Protocol) is a protocol that is used to manage high availability (HA) clusters of FortiGate devices. It performs several functions, including the following: FGCP elects the primary FortiGate device: In an HA cluster, FGCP is used to determine which FortiGate device will be the primary device, responsible for handling traffic and making decisions about what to allow or block. FGCP uses a variety of factors, such as the device's priority, to determine which device should be the primary. FGCP runs only over the heartbeat links: FGCP communicates between FortiGate devices in the HA cluster using the heartbeat links. These are dedicated links that are used to exchange status and control information between the devices. FGCP does not run over other types of links, such as data links.

   Source: Adapted from community discussion — Spago

   Next question

3. Question 13 · 104 in bank

   Select 2

   A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes. All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover. Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)

   • AConfigure a higher distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
   • BConfigure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
   • CEnable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
   • DEnable Dead Peer Detection.

   Show answer

   Answer: BD

   Explanation

   B. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel. D. Enable Dead Peer Detection. Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

4. Question 14 · 104 in bank

   Select 2

   What are two benefits of flow-based inspection compared to proxy-based inspection? (Choose two.)

   • AFortiGate uses fewer resources.
   • BFortiGate performs a more exhaustive inspection on traffic.
   • CFortiGate adds less latency to traffic.
   • DFortiGate allocates two sessions per connection.

   Show answer

   Answer: AC

   Explanation

   A. FortiGate uses fewer resources. C. FortiGate adds less latency to traffic. Flow-based inspection is a type of traffic inspection that is used by some firewall devices, including FortiGate, to analyze network traffic. It is designed to be more efficient and less resource-intensive than proxy-based inspection, and it offers several benefits over this approach. Two benefits of flow-based inspection compared to proxy-based inspection are: FortiGate uses fewer resources: Flow-based inspection uses fewer resources than proxy-based inspection, which can help to improve the performance of the firewall device and reduce the impact on overall system performance. FortiGate adds less latency to traffic: Flow-based inspection adds less latency to traffic than proxy-based inspection, which can be important for real-time applications or other types of traffic that require low latency.

   Source: Adapted from community discussion — Spago

   Next question

5. Question 15 · 104 in bank

   Select 2

   FortiGuard categories can be overridden and defined in different categories. To create a web rating override for the example.com home page, the override must be configured using a specific syntax. Which two syntaxes are correct to configure a web rating override for the home page? (Choose two.)

   • Awww.example.com
   • Bwww.example.com/index.html
   • Cwww.example.com:443
   • Dexample.com

   Show answer

   Answer: AD

   Explanation

   A. www.example.com D. example.com To create a web rating override for the home page of the example.com domain, the administrator must use one of the following syntaxes: www.example.com: This syntax specifies the fully qualified domain name (FQDN) of the website, including the www subdomain. This syntax will apply the web rating override to all pages on the website, including the home page. example.com: This syntax specifies the root domain of the website, without the www subdomain. This syntax will also apply the web rating override to all pages on the website, including the home page.

   Source: Adapted from community discussion — Spago

   Next question

6. Question 16 · 104 in bank

   Refer to exhibit. An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.

   

   Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

   • AOn the FortiGuard Category Based Filter configuration, set Action to Warning for Social Networking.
   • BOn the Static URL Filter configuration, set Type to Simple.
   • COn the Static URL Filter configuration, set Action to Exempt.
   • DOn the Static URL Filter configuration, set Action to Monitor.

   Show answer

   Answer: C

   Explanation

   C. On the Static URL Filter configuration, set Action to Exempt. Based on the exhibit, the administrator has configured the FortiGuard Category Based Filter to block access to all social networking sites, and has also configured a Static URL Filter to block access to twitter.com. As a result, users are being redirected to a block page when they try to access twitter.com. To allow users to access twitter.com while blocking all other social networking sites, the administrator can make the following configuration change: On the Static URL Filter configuration, set Action to Exempt: By setting the Action to Exempt, the administrator can override the block on twitter.com that was specified in the FortiGuard Category Based Filter. This will allow users to access twitter.com, while all other social networking sites will still be blocked.

   Source: Adapted from community discussion — Spago

   Next question

7. Question 17 · 104 in bank

   Refer to the exhibits. The exhibits show the firewall policies and the objects used in the firewall policies. The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

   

   

   Which policy will be highlighted, based on the input criteria?

   • APolicy with ID 4.
   • BPolicy with ID 5.
   • CPolicies with ID 2 and 3.
   • DPolicy with ID 4.

   Show answer

   Answer: B

   Explanation

   We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted.

   Source: Adapted from community discussion — Slash_JM

   Next question

8. Question 18 · 104 in bank

   Select 3

   Which three statements explain a flow-based antivirus profile? (Choose three.)

   • AFlow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
   • BIf a virus is detected, the last packet is delivered to the client.
   • CThe IPS engine handles the process as a standalone.
   • DFortiGate buffers the whole file but transmits to the client at the same time.
   • EFlow-based inspection optimizes performance compared to proxy-based inspection.

   Show answer

   Answer: ADE

   Explanation

   A: Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection D: the IPS engine reads the payload of each packet, caches a local copy, and forwards the packet to the receiver at the same time. some operations can be offloaded to SPUs to improve performance (not C) E: If performance is your top priority, then flow inspection mode is more appropriate.

   Source: Adapted from community discussion — BoostBoris

   References

   • Fortinet documentation

   Next question

9. Question 19 · 104 in bank

   Select 3

   Which three criteria can FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

   • AServices defined in the firewall policy
   • BHighest to lowest priority defined in the firewall policy
   • CDestination defined as Internet Services in the firewall policy
   • DLowest to highest policy ID number
   • ESource defined as Internet Services in the firewall policy

   Show answer

   Answer: ACE

   Explanation

   Correct: A. Services defined in the firewall policy C. Destination defined as Internet Services in the firewall policy E. Source defined as Internet Services in the firewall policy FortiGate Security 7.2 Study Guide (p.52): "When a packet arrives, how does FortiGate find a matching policy? Each policy has match criteria, which you can define using the following objects: • Incoming Interface • Outgoing Interface • Source: IP address, user, internet services • Destination: IP address or internet services • Service: IP protocol and port number • Schedule: Specific times to apply policy" Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

10. Question 20 · 104 in bank

    Select 2

    What are two functions of ZTNA? (Choose two.)

    • AZTNA manages access through the client only.
    • BZTNA manages access for remote users only.
    • CZTNA provides a security posture check.
    • DZTNA provides role-based access.

    Show answer

    Answer: CD

    Explanation

    C. ZTNA provides a security posture check. D. ZTNA provides role-based access. ZTNA (Zero Trust Network Access) is a security architecture that is designed to provide secure access to network resources for users, devices, and applications. It is based on the principle of "never trust, always verify," which means that all access to network resources is subject to strict verification and authentication. Two functions of ZTNA are: ZTNA provides a security posture check: ZTNA checks the security posture of devices and users that are attempting to access network resources. This can include checks on the device's software and hardware configurations, security settings, and the presence of malware. ZTNA provides role-based access: ZTNA controls access to network resources based on the role of the user or device. Users and devices are granted access to only those resources that are necessary for their role, and all other access is denied. This helps to prevent unauthorized access and minimize the risk of data breaches.

    Source: Adapted from community discussion — Spago

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 11. 104 questions available.