Use Real NSE4_FGT-7.0 Dumps - Fortinet Correct Answers updated on 2024
Fortinet NSE 4 NSE4_FGT-7.0 Exam Practice Dumps
NEW QUESTION # 60
Refer to the exhibit.
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)
- A. If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.
- B. If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.
- C. If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
- D. If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.
Answer: C,D
NEW QUESTION # 61
Which of the following SD-WAN load -balancing method use interface weight value to distribute traffic?
(Choose two.)
- A. Spillover
- B. Volume
- C. Session
- D. Source IP
Answer: B,C
Explanation:
Explanation
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/49719/configuring-sd-wan-load-balancing
NEW QUESTION # 62
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
- A. FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.
- B. FortiGate automatically negotiates different local and remote addresses with the remote peer.
- C. FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.
- D. FortiGate automatically negotiates a new security association after the existing security association expires.
Answer: A
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=12069
NEW QUESTION # 63
Refer to the exhibit.
The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
- A. Authentication is enforced at a policy level; all users will be prompted for authentication.
- B. If there is a full-through policy in place, users will not be prompted for authentication.
- C. Users from the HR group will be prompted for authentication and can authenticate successfully with the correct credentials.
- D. Users from the Sales group will be prompted for authentication and can authenticate successfully with the correct credentials.
Answer: A
NEW QUESTION # 64
Which three statements about security associations (SA) in IPsec are correct? (Choose three.)
- A. A phase 1 SA is bidirectional, while a phase 2 SA is directional.
- B. Both the phase 1 SA and phase 2 SA are bidirectional.
- C. An SA never expires.
- D. Phase 2 SA expiration can be time-based, volume-based, or both.
- E. Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.
Answer: A,D,E
NEW QUESTION # 65
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
- A. FortiSIEM
- B. FortiCloud
- C. FortiAnalyzer
- D. FortiCache
- E. FortiSandbox
Answer: A,B,C
Explanation:
Reference:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/265052/logging-and-reporting-overview
NEW QUESTION # 66
Examine the network diagram shown in the exhibit, then answer the following question:
Which one of the following routes is the best candidate route for FGT1 to route traffic from the Workstation to the Web server?
- A. 172.16.0.0/16 [50/0] via 10.4.200.2, port2 [5/0]
- B. 10.4.200.0/30 is directly connected, port2
- C. 172.16.32.0/24 is directly connected, port1
- D. 0.0.0.0/0 [20/0] via 10.4.200.2, port2
Answer: C
NEW QUESTION # 67
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A. To finish any inspection operations
- B. To allow for out-of-order packets that could arrive after the FIN/ACK packets
- C. To generate logs
- D. To remove the NAT operation
Answer: B
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
NEW QUESTION # 68
Exhibit:
Refer to the exhibit to view the authentication rule configuration In this scenario, which statement is true?
- A. IP-based authentication is enabled
- B. Session-based authentication is enabled.
- C. Route-based authentication is enabled
- D. Policy-based authentication is enabled
Answer: B
NEW QUESTION # 69
If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?
- A. A root CA
- B. A person
- C. A CRL
- D. A subordinate CA
Answer: A
NEW QUESTION # 70
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port3 default route has the highest distance.
- B. The port1 and port2 default routes are active in the routing table.
- C. The port3 default route has the lowest metric.
- D. There will be eight routes active in the routing table.
Answer: A,B
NEW QUESTION # 71
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
- A. The firewall policy performs the full content inspection on the file.
- B. The flow-based inspection is used, which resets the last packet to the user.
- C. The volume of traffic being inspected is too high for this model of FortiGate.
- D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
Answer: B
Explanation:
Explanation
* "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
* When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file.
Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened.
The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.
NEW QUESTION # 72
If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?
- A. The Services field prevents multiple sources of traffic from using multiple services to connect to a single
- B. The Services field removes the requirement to create multiple VIPs for different services.
- C. The Services field is used when you need to bundle several VIPs into VIP groups.
- D. The Services field prevents SNAT and DNAT from being combined in the same policy.
Answer: B
NEW QUESTION # 73
Refer to the exhibit to view the application control profile.
Based on the configuration, what will happen to Apple FaceTime?
- A. Apple FaceTime will be allowed, based on the Apple filter configuration.
- B. Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn
- C. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration
- D. Apple FaceTime will be allowed, based on the Categories configuration.
Answer: C
NEW QUESTION # 74
Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)
- A. FortiGate queries AD by using the LDAP to retrieve user group information.
- B. FortiGate uses the AD server as the collector agent.
- C. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.
- D. FortiGate points the collector agent to use a remote LDAP server.
Answer: A,C
Explanation:
Explanation
Fortigate Infrastructure 7.0 Study Guide P.272-273
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47732
NEW QUESTION # 75
......
Get ready to pass the NSE4_FGT-7.0 Exam right now using our Fortinet NSE 4 Exam Package: https://www.lead2passexam.com/Fortinet/valid-NSE4_FGT-7.0-exam-dumps.html
NSE4_FGT-7.0 Premium Files Test pdf - Free Dumps Collection: https://drive.google.com/open?id=1gyJzHT8DxNjB6b0gLZ7g2EPf-fqS0rgd