NSE4_FGT-7.2 practice questions 61–70

1. Question 61 · 104 in bank

   Refer to the exhibits. The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook. Users are given access to the Facebook web application. They can play video content hosted on Facebook, but they are unable to leave reactions on videos or other types of posts.

   

   

   Which part of the policy configuration must you change to resolve the issue?

   • AForce access to Facebook using the HTTP service.
   • BMake the SSL inspection a deep content inspection.
   • CAdd Facebook in the URL category in the security policy.
   • DGet the additional application signatures required to add to the security policy.

   Show answer

   Answer: B

   Explanation

   Necesita realizar una inspección profunda de las acciones que se están haciendo en la página de Facebook para poder denegar las reacciones.

   Source: Adapted from community discussion — santi1509

   Next question

2. Question 62 · 104 in bank

   Refer to the exhibits. The SSL VPN connection fails when a user attempts to connect to it.

   

   

   What should the user do to successfully connect to the SSL VPN?

   • AChange the SSL VPN port on the client.
   • BChange the idle-timeout.
   • CChange the SSL VPN portal to the tunnel.
   • DChange the server IP address.

   Show answer

   Answer: A

   Next question

3. Question 63 · 104 in bank

   Refer to the exhibits. Exhibit A shows a network diagram. Exhibit B shows the firewall policy configuration and a VIP object configuration. The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IP address 10.0.1.254/24.

   

   

   If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

   • A10.0.1.254, 10.0.1.10, and 443, respectively
   • B10.0.1.254, 10.200.1.10, and 443, respectively
   • C10.200.3.1, 10.0.1.10, and 443, respectively
   • D10.0.1.254, 10.0.1.10, and 10443, respectively

   Show answer

   Answer: A

   Explanation

   A. 10.0.1.254, 10.0.1.10, and 443, respectively Question repeated with Q52 Translations: 10.200.3.1 --> 10.0.1.254 because NAT enable in firewall policy 10.200.1.10 --> 10.0.1.10 because VIP as Destination 10443 --> 443 because Port Forwarding enabled on VIP Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

4. Question 64 · 104 in bank

   Select 3

   Which three methods are used by the collector agent for AD polling? (Choose three.)

   • AFortiGate polling
   • BFSSO REST API
   • CWMI
   • DNetAPI
   • EWinSecLog

   Show answer

   Answer: CDE

   Explanation

   C. WMI D. NetAPI E. WinSecLog FortiGate Infrastructure 7.2 Study Guide (p.127-128): "As previously stated, collector agent-based polling mode has three methods (or options) for collecting login information. The order on the slide from left to right shows most recommend to least recommended: (WMI, WinSecLog, and NetAPI)" Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

5. Question 65 · 104 in bank

   Select 2

   What are two functions of the ZTNA rule? (Choose two.)

   • AIt redirects the client request to the access proxy.
   • BIt applies security profiles to protect traffic.
   • CIt defines the access proxy.
   • DIt enforces access control.

   Show answer

   Answer: BD

   Explanation

   B. It applies security profiles to protect traffic. D. It enforces access control. FortiGate Infrastructure 7.2 Study Guide (p.177): "A ZTNA rule is a proxy policy used to enforce access control. You can define ZTNA tags or tag groups to enforce zero-trust role-based access. To create a rule, type a rule name, and add IP addresses and ZTNA tags or tag groups that are allowed or blocked access. You also select the ZTNA server as the destination. You can also apply security profiles to protect this traffic." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

6. Question 66 · 104 in bank

   Select 2

   Which two statements describe how the RPF check is used? (Choose two.)

   • AThe RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
   • BThe RPF check is run on the first sent and reply packet of any new session.
   • CThe RPF check is run on the first sent packet of any new session.
   • DThe RPF check is run on the first reply packet of any new session.

   Show answer

   Answer: AC

   Explanation

   A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks. C. The RPF check is run on the first sent packet of any new session. FortiGate Infrastructure 7.2 Study Guide (p.41): "The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table." "FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn’t perform any additional RPF checks on that session." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • community.fortinet.com documentation

   Next question

7. Question 67 · 104 in bank

   Select 2

   Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

   

   Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

   • AOn both FortiGate devices, set Dead Peer Detection to On Demand.
   • BOn HQ-FortiGate, set IKE mode to Main (ID protection).
   • COn HO-FortiGate, disable Diffie-Helman group 2.
   • DOn Remote-FortiGate, set port2 as Interface.

   Show answer

   Answer: BD

   Explanation

   FortiGate Security 7.2 study guide page 250 In IKEv1, there are two possible modes in which the IKE SA negotiation can take place: mail and aggressive mode. The settings on both ends must agree; otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel. Note: on the network diagram, port 2 is used on the remote Fortigate so the answer is B & D

   Source: Adapted from community discussion — e359166

   Next question

8. Question 68 · 104 in bank

   An administrator needs to increase network bandwidth and provide redundancy. Which interface type must the administrator select to bind multiple FortiGate interfaces?

   • ARedundant interface
   • BSoftware switch interface
   • CVLAN interface
   • DAggregate interface

   Show answer

   Answer: D

   Explanation

   Es la D la respuesta. FortiOS 7.2 Administration Guide pag 190. Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link has the bandwidth of all the links combined. If a link in the group fails, traffic is transferred automatically to the remaining interfaces. The only noticeable effect is reduced bandwidth. This feature is similar to redundant interfaces. The major difference is a redundant interface group only uses one link at a time, where an aggregate link group uses the total bandwidth of the functioning links in the group, up to eight (or more).

   Source: Adapted from community discussion — darkstar15

   References

   • Fortinet documentation

   Next question

9. Question 69 · 104 in bank

   FortiGate is integrated with FortiAnalyzer and FortiManager. When a firewall policy is created, which attribute is added to the policy to improve functionality and to support recording logs to FortiAnalyzer or FortiManager?

   • APolicy ID
   • BLog ID
   • CSequence ID
   • DUniversally Unique Identifier

   Show answer

   Answer: D

   Explanation

   D. Universally Unique Identifier FortiGate Security 7.2 Study Guide (p.67): "When creating firewall objects or policies, a universally unique identifier (UUID) attribute is added so that logs can record these UUIDs and improve functionality when integrating with FortiManager or FortiAnalyzer." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

10. Question 70 · 104 in bank

    Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services.

    

    Which CLI command must the administrator use to view the route?

    • Aget router info routing-table database
    • Bdiagnose firewall route list
    • Cget internet-service route list
    • Dget router info routing-table all

    Show answer

    Answer: B

    Explanation

    B. diagnose firewall proute list FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you can view by running the diagnose firewall proute list command." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

    Source: Adapted from community discussion — raydel92

    References

    • community.fortinet.com documentation
    • community.fortinet.com documentation
    • community.fortinet.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 61. 104 questions available.