NSE4_FGT-7.2 practice questions 21–30

1. Question 21 · 104 in bank

   A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service. Which type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

   • APre-shared key
   • BDialup user
   • CDynamic DNS
   • DStatic IP address

   Show answer

   Answer: B

   Explanation

   D cannot be correct as the remote peer has a dynamic address so this will not be known to the local side as it may change. The same goes for dynamic. PSK is not an option, the answer is B

   Source: Adapted from community discussion — DriftandLuna

   Next question

2. Question 22 · 104 in bank

   Which timeout setting can be responsible for deleting SSL VPN associated sessions?

   • ASSL VPN idle-timeout
   • BSSL VPN http-request-body-timeout
   • CSSL VPN login-timeout
   • DSSL VPN dtls-hello-timeout

   Show answer

   Answer: A

   Explanation

   A. SSL VPN idle-timeout The SSL VPN idle-timeout setting determines how long an SSL VPN session can be inactive before it is terminated. When an SSL VPN session becomes inactive (for example, if the user closes the VPN client or disconnects from the network), the session timer begins to count down. If the timer reaches the idle-timeout value before the user reconnects or sends any new traffic, the session will be terminated and the associated resources (such as VPN tunnels and virtual interfaces) will be deleted.

   Source: Adapted from community discussion — Spago

   Next question

3. Question 23 · 104 in bank

   Which statement is correct regarding the use of application control for inspecting web applications?

   • AApplication control can identify child and parent applications, and perform different actions on them.
   • BApplication control signatures are organized in a nonhierarchical structure.
   • CApplication control does not require SSL inspection to identify web applications.
   • DApplication control does not display a replacement message for a blocked web application.

   Show answer

   Answer: A

   Explanation

   The FortiGuard application control signature database is organized in a hierarchical structure. This gives you the ability to inspect the traffic with more granularity. You can block Facebook applications while allowing users to collaborate using Facebook chat.

   Source: Adapted from community discussion — BoostBoris

   Next question

4. Question 24 · 104 in bank

   Select 2

   A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded. The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

   • AThe website is exempted from SSL inspection.
   • BThe EICAR test file exceeds the protocol options oversize limit.
   • CThe selected SSL inspection profile has certificate inspection enabled.
   • DThe browser does not trust the FortiGate self-signed CA certificate.

   Show answer

   Answer: AC

   Explanation

   We're not talking about certificate trust warnings. The file was not decrypted, thus the antivur engine could not recognize the payload as a virus.

   Source: Adapted from community discussion — Spyder_Byte

   Next question

5. Question 25 · 104 in bank

   Select 2

   Refer to the exhibits. Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

   

   

   Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

   • AFor non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.
   • BThe traffic sourced from the client and destined to the server is sent to FGT-1.
   • CThe cluster can load balance ICMP connections to the secondary.
   • DFor load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

   Show answer

   Answer: AD

   Explanation

   A: Non load balance: traffic enters port1 and go out port2 from FGT1. FGT2 is in standby mode D: In proxy inspection mode, SYN packet goes to FGT1 port1. It is then forwarded to FGT2. the source MAC address of the packet is changed to the physical MAC address of port1 on the primary and the destination MAC address to the physical MAC address of port1 on the secondary. This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame type 0x8891. The encapsulation is done only for the first packet of a load balanced session

   Source: Adapted from community discussion — BoostBoris

   Next question

6. Question 26 · 104 in bank

   Select 2

   Which two attributes are required on a certificate so it can be used as a CA certificate on SSL inspection? (Choose two.)

   • AThe keyUsage extension must be set to keyCertSign.
   • BThe CA extension must be set to TRUE.
   • CThe issuer must be a public CA.
   • DThe common name on the subject field must use a wildcard name.

   Show answer

   Answer: AB

   Explanation

   A & B FortiGate_Security_7.2 page 232 Although it appears as though the user browser is connected to the web server, the browser is connected to FortiGate. FortiGate is acting as a proxy web server. In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign.

   Source: Adapted from community discussion — Eggrolls

   References

   • community.fortinet.com documentation

   Next question

7. Question 27 · 104 in bank

   Select 3

   Refer to the exhibit. An administrator is running a sniffer command as shown in the exhibit.

   

   Which three pieces of information are included in the sniffer output? (Choose three.)

   • APacket payload
   • BApplication header
   • CIP header
   • DEthernet header
   • EInterface name

   Show answer

   Answer: ACE

   Explanation

   FortiGate_Infrastructure_7.2_Study_Guide-Online p. 61 Packet Capture Verbosity Level which is set to 5 in the exhibit, if it was level 6 it should also include ethernet headers. Application headers are never included. This is Correct: A. Packet payload C. IP header E. Interface name

   Source: Adapted from community discussion — Jumpy007

   Next question

8. Question 28 · 104 in bank

   Select 2

   FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface. In this scenario, what are two requirements for the VLAN ID? (Choose two.)

   • AThe two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in the same subnet.
   • BThe two VLAN subinterfaces can have the same VLAN ID, only if they belong to different VDOMs.
   • CThe two VLAN subinterfaces must have different VLAN IDs.
   • DThe two VLAN subinterfaces can have the same VLAN ID, only if they have IP addresses in different subnets.

   Show answer

   Answer: BC

   Explanation

   Anything but the "different VLAN" answer is impossible from a networking view, as well as configuration on the FG is concerned. At least up to 7.0 it's impossible to configure the same VLAN on the same physical link multiple times, no matter if it's in separate VDOMs or not.

   Source: Adapted from community discussion — Garry_G

   References

   • community.fortinet.com documentation
   • community.fortinet.com documentation
   • community.fortinet.com documentation

   Next question

9. Question 29 · 104 in bank

   By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers. Which CLI command causes FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

   • Aset webfilter-force-off disable
   • Bset webfilter-cache disable
   • Cset protocol tcp
   • Dset fortiguard-anycast disable

   Show answer

   Answer: D

   References

   • community.fortinet.com documentation

   Next question

10. Question 30 · 104 in bank

    An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel. Which DPD mode on FortiGate will meet this requirement?

    • AOn Demand
    • BOn Idle
    • CDisabled
    • DEnabled

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 21. 104 questions available.