NSE4_FGT-7.2 practice questions 71–80

1. Question 71 · 104 in bank

   An organization requires remote users to send external application data running on their PCs and access FTP resources through an SSL/TLS connection. Which FortiGate configuration can achieve this goal?

   • ASSL VPN bookmark
   • BSSL VPN tunnel
   • CZero trust network access
   • DSSL VPN quick connection

   Show answer

   Answer: B

   Explanation

   The answer is B. SSL VPN tunnel. SSL VPN tunnel is a FortiGate configuration that allows remote users to connect to the FortiGate firewall through an SSL/TLS connection. This connection provides a secure tunnel between the remote user's PC and the FortiGate firewall, which allows the remote user to send external application data running on their PCs and access FTP resources through the firewall.

   Source: Adapted from community discussion — Takumi

   Next question

2. Question 72 · 104 in bank

   Refer to the exhibits. An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

   

   

   What must the administrator do to synchronize the address object?

   • AChange the csf setting on ISFW (downstream) to set configuration-sync local.
   • BChange the csf setting on ISFW (downstream) to set authorization-request-type certificate.
   • CChange the csf setting on both devices to set downstream-access enable.
   • DChange the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

   Show answer

   Answer: C

   Explanation

   D - not correct Fortigate Security guide 7.2 - page 434 The CLI command "set fabric-object-unification" is only available on the root FortiGate.

   Source: Adapted from community discussion — JakubCh

   References

   • Fortinet documentation
   • Fortinet documentation
   • Fortinet documentation
   • Fortinet documentation
   • Fortinet documentation

   Next question

3. Question 73 · 104 in bank

   Select 3

   The IPS engine is used by which three security features? (Choose three.)

   • AAntivirus in flow-based inspection
   • BWeb filter in flow-based inspection
   • CApplication control
   • DDNS filter
   • EWeb application firewall

   Show answer

   Answer: ABC

   Explanation

   A. Antivirus in flow-based inspection B. Web filter in flow-based inspection C. Application control FortiGate Security 7.2 Study Guide (p.385): "The IPS engine is responsible for most of the features shown in this lesson: IPS and protocol decoders. It’s also responsible for application control, flow-based antivirus protection, web filtering, and email filtering." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

4. Question 74 · 104 in bank

   You have enabled logging on a FortiGate device for event logs and all security logs, and you have set up logging to use the FortiGate local disk. What is the default behavior when the local disk is full?

   • ANo new log is recorded after the warning is issued when log disk use reaches the threshold of 95%.
   • BNo new log is recorded until you manually clear logs from the local disk.
   • CLogs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%.
   • DLogs are overwritten and the only warning is issued when log disk use reaches the threshold of 95%.

   Show answer

   Answer: C

   Explanation

   C. Logs are overwritten and the first warning is issued when log disk use reaches the threshold of 75%. config log disk setting set diskfull [ overwrite | nolog ] Action to take when disk is full. The system can overwrite the oldest log messages or stop logging when the disk is full. (default --> overwrite) config log memory global-setting set full-first-warning-threshold {integer} Log full first warning threshold as a percent. (default --> 75) Reference: https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/421620/config-log-disk-setting https://docs.fortinet.com/document/fortigate/7.2.5/cli-reference/418620/config-log-memory-global-setting

   Source: Adapted from community discussion — raydel92

   References

   • Fortinet documentation
   • Fortinet documentation
   • Fortinet documentation
   • Fortinet documentation

   Next question

5. Question 75 · 104 in bank

   Select 2

   Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)

   • AExtended authentication (XAuth) for faster authentication because fewer packets are exchanged
   • BExtended authentication (XAuth) to request the remote peer to provide a username and password
   • CNo certificate is required on the remote peer when you set the certificate signature as the authentication method
   • DPre-shared key and certificate signature as authentication methods

   Show answer

   Answer: BD

   Explanation

   B. Extended authentication (XAuth) to request the remote peer to provide a username and password D. Pre-shared key and certificate signature as authentication methods FortiGate Infrastructure 7.2 Study Guide (p.237): "Authentication-wise, both versions support PSK and certificate signature. Although only IKEv1 supports XAuth, IKEv2 supports EAP, which is equivalent to XAuth." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

6. Question 76 · 104 in bank

   If Internet Service is already selected as Destination in a firewall policy, which other configuration object can be selected for the Destination field of a firewall policy?

   • AIP address
   • BNo other object can be added
   • CFQDN address
   • DUser or User Group

   Show answer

   Answer: B

   Explanation

   B. No other object can be added FortiGate Security 7.2 Study Guide (p.59): "When configuring your firewall policy, you can use Internet Service as the destination in a firewall policy, which contains all the IP addresses, ports, and protocols used by that service. For the same reason, you cannot mix regular address objects with ISDB objects, and you cannot select services on a firewall policy. The ISDB objects already have services information, which is hardcoded." D. User or User Group (incorrect because you can not use Users or Groups as Destination, just as Source and they actually can be mixed with ISDB objects) Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   Next question

7. Question 77 · 104 in bank

   Which statement is correct regarding the security fabric?

   • AFortiManager is one of the required member devices.
   • BFortiGate devices must be operating in NAT mode.
   • CA minimum of two Fortinet devices is required.
   • DFortiGate Cloud cannot be used for logging purposes.

   Show answer

   Answer: B

   Explanation

   Correct: B. FortiGate devices must be operating in NAT mode. Incorrect: A. FortiManager is one of the required member devices. (Recommended member) C. A minimum of two Fortinet devices is required. (3 Fortinet devices = 2 FG + 1 logging) D. FortiGate Cloud cannot be used for logging purposes. (It can be used) FortiGate Security 7.2 Study Guide (p.428): "You must have a minimum of two FortiGate devices at the core of the Security Fabric, plus one FortiAnalyzer or cloud logging solution. FortiAnalyzer Cloud or FortiGate Cloud can act as the cloud logging solution. The FortiGate devices must be running in NAT mode." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

   Source: Adapted from community discussion — raydel92

   References

   • Fortinet documentation

   Next question

8. Question 78 · 104 in bank

   Select 2

   Refer to the exhibit showing a FortiGuard connection debug output.

   

   Based on the output, which two facts does the administrator know about the FortiGuard connection? (Choose two.)

   • AOne server was contacted to retrieve the contract information.
   • BThere is at least one server that lost packets consecutively.
   • CA local FortiManager is one of the servers FortiGate communicates with.
   • DFortiGate is using default FortiGuard communication settings.

   Show answer

   Answer: AD

   Explanation

   A and D A is because the "I" in the flag "DI" means it contacted a server. (pg 287, FortiGate Security Study Guide 7.2). D because https on port 443 is used. page 288, FortiGate Security 7.2 Study Guide: "by default, FortiGate is configured to enforce the use of HTTPS port 443 to perform live filtering with FortiGuard or FortiManager"

   Source: Adapted from community discussion — Halmonte0780

   Next question

9. Question 79 · 104 in bank

   Refer to the exhibit.

   

   Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

   • ACLI diagnostics commands permission
   • BRead/Write permission for Log & Report
   • CRead/Write permission for Firewall
   • DCustom permission for Network

   Show answer

   Answer: A

   Explanation

   config system accprofile Description: Configure access profiles for system administrators. edit set system-diagnostics [ enable | disable ] system-diagnostics: Enable/disable permission to run system diagnostic commands.

   Source: Adapted from community discussion — raydel92

   Next question

10. Question 80 · 104 in bank

    Refer to the exhibits. Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details.

    

    

    Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

    • AApple FaceTime will be allowed, based on the Categories configuration.
    • BApple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.
    • CApple FaceTime will be allowed, based on the Apple filter configuration.
    • DApple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

    Show answer

    Answer: B

    Explanation

    B. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration. FortiGate Security 7.2 Study Guide (p.310): "Then, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you’ve configured for applications in your selected categories." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

    Source: Adapted from community discussion — raydel92

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE4_FGT-7.2 practice, question 71. 104 questions available.