NSE4_FGT-7.2 practice questions 41–50

1. Question 41 · 104 in bank

   Which statement about video filtering on FortiGate is true?

   • AVideo filtering FortiGuard categories are based on web filter FortiGuard categories.
   • BIt does not require a separate FortiGuard license.
   • CFull SSL inspection is not required.
   • DOtis available only on a proxy-based firewall policy.

   Show answer

   Answer: D

   Explanation

   D. It is available only on a proxy-based firewall policy. FortiGate Security 7.2 Study Guide (p.279): "To apply the video filter profile, proxy-based firewall polices currently allow you to enable the video filter profile. You must enable full SSL inspection on the firewall policy." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • Fortinet documentation
   • Fortinet documentation

   Next question

2. Question 42 · 104 in bank

   Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

   • AThe collector agent must search Windows application event logs.
   • BThe NetSessionEnum function is used to track user logouts.
   • CNetAPI polling can increase bandwidth usage in large networks.
   • DThe collector agent uses a Windows API to query DCs for user logins.

   Show answer

   Answer: B

   Explanation

   I really want to advise all who is studying and taking the exam soon.This Q: Question #: 42, the ans is : C. NetAPI polling can increase bandwidth usage in large networks. Reason being, when NetAPI: polls sessions created on the DC, it only polls user logins and NOT logouts. And as such it does this every 9seconds if default timer is used. Hence, it will generate alot of bandwidth in large networks.

   Source: Adapted from community discussion — NaturehasIT

   References

   • community.fortinet.com documentation
   • community.fortinet.com documentation

   Next question

3. Question 43 · 104 in bank

   Select 2

   What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

   • AFortiGate uses the SMB protocol to read the event viewer logs from the DCs.
   • BFortiGate uses the AD server as the collector agent.
   • CFortiGate directs the collector agent to use a remote LDAP server.
   • DFortiGate does not support workstation check.

   Show answer

   Answer: AD

   Explanation

   Limitations of agentless polling mode. - If there are many user logins at the same time, the FSSO daemon may miss some. - Winsec polling only. - No NTLM. - No workstation checks and dead entry. - FSSO-polling Agentless may not work correctly with nested users group. - More CPU consuming: with local polling.

   Source: Adapted from community discussion — efot

   Next question

4. Question 44 · 104 in bank

   Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

   • AIntrusion prevention system engine
   • BApplication control engine
   • CAntivirus engine
   • DTurbo engine

   Show answer

   Answer: A

   Next question

5. Question 45 · 104 in bank

   Select 2

   Refer to the exhibit.

   

   Based on the routing database shown in the exhibit, which two conclusions can you make about the routes? (Choose two.)

   • AThe port3 default route has the lowest metric.
   • BThe port1 and port2 default routes are active in the routing table.
   • CThe ports default route has the highest distance.
   • DThere will be eight routes active in the routing table.

   Show answer

   Answer: BC

   Explanation

   I found in other questionnaires the well written options (here they are not written correctly): a.- The port3 default route has the lowest metric, making it the best route. b.- Both port1 and port 2 default routers are active in the routing table. c.- The port3 default has a higher distance than port1 and port2 default routes d.- There will be eight toutes active in the routing table So the correct answers are B&C.

   Source: Adapted from community discussion — Timbal

   References

   • Fortinet documentation
   • community.fortinet.com documentation

   Next question

6. Question 46 · 104 in bank

   Refer to the exhibits. The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).

   

   

   Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

   • AThe firewall policy performs a full content inspection on the file.
   • BThe intrusion prevention security profile must be enabled when using flow-based inspection mode.
   • CFlow-based inspection is used, which resets the last packet to the user.
   • DThe volume of traffic being inspected is too high for this model of FortiGate.

   Show answer

   Answer: C

   Explanation

   In flow based inspection, when a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a second attempt to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.

   Source: Adapted from community discussion — BoostBoris

   Next question

7. Question 47 · 104 in bank

   Select 2

   Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

   • AFortiGuard web filter cache
   • BFortiGate hostname
   • CDNS
   • DNTP

   Show answer

   Answer: CD

   Explanation

   In the 7.2 Infrastructure Guide (page 306) the list of configuration settings that are NOT synchronized includes both 'FortiGate host name' and 'Cache'

   Source: Adapted from community discussion — rgeneson

   Next question

8. Question 48 · 104 in bank

   On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?

   • AForward traffic logs
   • BLocal traffic logs
   • CSecurity logs
   • DSystem event logs

   Show answer

   Answer: B

   Explanation

   Local traffic logs contain information about traffic directly to and from the FortiGate management IP addresses. They also include connections to the GUI and FortiGuard queries.

   Source: Adapted from community discussion — BoostBoris

   Next question

9. Question 49 · 104 in bank

   Refer to the exhibit. Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.

   

   What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?

   • ATraffic matching the signature will be allowed and logged.
   • BThe signature setting includes a group of other signatures.
   • CTraffic matching the signature will be silently dropped and logged.
   • DThe signature setting uses a custom rating threshold.

   Show answer

   Answer: C

   Explanation

   The correct answer is C, take a look at the 7.2 Security study guide page 394: Select Block to silently drop traffic matching any of the signatures included in the entry. So, while the default action would be 'Pass' for this signature the administrator is specifically overriding that to set the Block action. To use the default action the setting would have to be 'Default'.

   Source: Adapted from community discussion — rgeneson

   Next question

10. Question 50 · 104 in bank

    Select 2

    An administrator has configured the following settings: config system settings set ses-denied-traffic enable end config system global set block-session-timer 30 end What are the two results of this configuration? (Choose two.)

    • ADevice detection on all interfaces is enforced for 30 minutes.
    • BDenied users are blocked for 30 minutes.
    • CThe number of logs generated by denied traffic is reduced.
    • DA session for denied traffic is created.

    Show answer

    Answer: CD

    Explanation

    C. The number of logs generated by denied traffic is reduced. D. A session for denied traffic is created. FortiGate Security 7.2 Study Guide (p.69): "During the session, if a security profile detects a violation, FortiGate records the attack log immediately. To reduce the number of log messages generated and improve performance, you can enable a session table entry of dropped traffic. This creates the denied session in the session table and, if the session is denied, all packets of that session are also denied. This ensures that FortiGate does not have to do a policy lookup for each new packet matching the denied session, which reduces CPU usage and log generation. This option is in the CLI, and is called ses-denied-traffic. You can also set the duration for block sessions. This determines how long a session will be kept in the session table by setting block-sessiontimer in the CLI. By default, it is set to 30 seconds." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Source: Adapted from community discussion — raydel92

    References

    • Fortinet documentation
    • Fortinet documentation
    • community.fortinet.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 41. 104 questions available.