NSE4_FGT-7.2 practice questions 51–60

1. Question 51 · 104 in bank

   An administrator configures outgoing interface any in a firewall policy. What is the result of the policy list view?

   • ASearch option is disabled.
   • BPolicy lookup is disabled.
   • CBy Sequence view is disabled.
   • DInterface Pair view is disabled.

   Show answer

   Answer: D

   Explanation

   From the 7.2 Security Study Guide page 75: "If you use multiple source or destination interfaces, or the any interface in a firewall policy, you cannot separate policies into sections by interface pairs—some would be triplets or more. So instead, policies are then always displayed in a single list (By Sequence)." Thus the correct answer is D -- Interface Pair view is disabled.

   Source: Adapted from community discussion — rgeneson

   Next question

2. Question 52 · 104 in bank

   Which statement describes a characteristic of automation stitches?

   • AThey can have one or more triggers.
   • BThey can be run only on devices in the Security Fabric.
   • CThey can run multiple actions simultaneously.
   • DThey can be created on any device in the fabric.

   Show answer

   Answer: C

   Explanation

   Correct: C. They can run multiple actions simultaneously. Incorrect: A. They can have one or more triggers. B. They can be run only on devices in the Security Fabric. D. They can be created on any device in the fabric. FortiGate Security 7.2 Study Guide (p.443): A - "Each automation stitch pairs a trigger and one or more actions." B - "However, the Security Fabric is not required to use stitches." C - "Can run actions sequentially or in parallel" D - "Can be created only on the root FortiGate in the Security Fabric" Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • Fortinet documentation

   Next question

3. Question 53 · 104 in bank

   Refer to the exhibits. Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24.

   

   

   If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

   • A10.0.1.254, 10.0.1.10, and 443, respectively
   • B10.0.1.254, 10.0.1.10, and 10443, respectively
   • C10.200.3.1, 10.0.1.10, and 443, respectively

   Show answer

   Answer: A

   Explanation

   A is correct. NAT on the policy means the source gets translated from 10.200.3.1 to 10.0.1.254. The VIP performs DNAT which changes the destination from 10.200.1.10 to 10.0.1.10. Then port forwarding translates the port from 10443 to 443.

   Source: Adapted from community discussion — Phil708

   Next question

4. Question 54 · 104 in bank

   Refer to the exhibit. The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode. The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to the ISP modem.

   

   What can you conclude about this configuration?

   • AInter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.
   • BA default static route is not required on the To_Internet VDOM to allow LAN users to access the internet.
   • CInter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
   • DInter-VDOM links are required to allow traffic between the Local and Root VDOMs.

   Show answer

   Answer: D

   Explanation

   A. Management VDOM ALWAYS need access to internet B. Is not true, you ALWAYS need a default route to access the internet, despite is set manually or via DHCP C. Static routes are not needed for subnets to which Fortigate has derect layer 2 connectivity (FortiGate_Infrastructure_7.2_Study_guide page 11) D. Correct

   Source: Adapted from community discussion — erawemk

   Next question

5. Question 55 · 104 in bank

   Refer to the exhibit. The exhibit shows the output of a diagnose command.

   

   What does the output reveal about the policy route?

   • AIt is an ISDB route in policy route.
   • BIt is a regular policy route.
   • CIt is an ISDB policy route with an SDWAN rule.
   • DIt is an SDWAN rule in policy route.

   Show answer

   Answer: D

   Explanation

   Answer is D, ref FortiGate 7.2 Infrastructure page 59 In diagnose firewall proute list, if: * ID = 65535 without vwl_service field then it is ISDB route * ID >=65535 with vwl_service field then it is SD-WAN rule.

   Source: Adapted from community discussion — [Removed]

   References

   • community.fortinet.com documentation

   Next question

6. Question 56 · 104 in bank

   Refer to the exhibit. An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.

   

   What is the impact of using the Include in every user group option in a RADIUS configuration?

   • AThis option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
   • BThis option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
   • CThis option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
   • DThis option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

   Show answer

   Answer: B

   Next question

7. Question 57 · 104 in bank

   Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

   

   Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

   • AOn Remote-FortiGate, set Seconds to 43200.
   • BOn HQ-FortiGate, set Encryption to AES256.
   • COn HQ-FortiGate, enable Diffie-Hellman Group 2.
   • DOn HQ-FortiGate, enable Auto-negotiate.

   Show answer

   Answer: B

   Explanation

   B is correct. When key lifetime is different, FortiGate chooses the lower one. Diffie Helman group needs only one that matches. The authentication proposals need one matching, which there isnt. That makes is B.

   Source: Adapted from community discussion — Leodoro

   Next question

8. Question 58 · 104 in bank

   An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings. What is true about the DNS connection to a FortiGuard server?

   • AIt uses UDP 8888.
   • BIt uses UDP 53.
   • CIt uses DNS over HTTPS.
   • DIt uses DNS over TLS.

   Show answer

   Answer: D

   Explanation

   Study Guide Page 15 - By default, uses DNS over TLS DoT to secure DNS traffic - FortiOS uses Fortiguard server for DNS requests

   Source: Adapted from community discussion — Senox999

   References

   • Fortinet documentation
   • Fortinet documentation

   Next question

9. Question 59 · 104 in bank

   Select 2

   Refer to the exhibit. The exhibit shows the IPS sensor configuration.

   

   If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

   • AThe sensor will gather a packet log for all matched traffic.
   • BThe sensor will reset all connections that match these signatures.
   • CThe sensor will block all attacks aimed at Windows servers.
   • DThe sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

   Show answer

   Answer: CD

   Explanation

   In FortiGate Firewall IPS, the "monitor" action is used to allow the traffic to pass through the firewall but still monitor it for potential threats or policy violations. When an IPS sensor detects an intrusion attempt or violation of a security policy, it can trigger an alert or log the event, providing information for further analysis or action. By using the monitor action instead of the block action, you can allow traffic to continue flowing while still gaining visibility into potential security risks. This can be useful in situations where blocking the traffic might cause operational disruptions or false positives. However, it's important to note that the monitor action does not actively block traffic, so it's recommended to use it in conjunction with other security measures, such as firewalls, antivirus software, and intrusion prevention systems, to ensure comprehensive protection against cyber threats.

   Source: Adapted from community discussion — itashraf

   Next question

10. Question 60 · 104 in bank

    Select 2

    Which two types of traffic are managed only by the management VDOM? (Choose two.)

    • ADNS
    • BFortiGuard web filter queries
    • CPKi
    • DTraffic shaping

    Show answer

    Answer: AB

    Explanation

    C is wrong because PKI stands for Public Key Infrastructure and is associated with VPNS D is wrong because traffic shaping is configured on a 'Traffic Shaping Policy' A is correct because Fortigate will use Fortiguard for these queries B is correct as the management VDOM can use DNS for DNS queries

    Source: Adapted from community discussion — BoostBoris

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 51. 104 questions available.