2022 Easily pass NSE4_FGT-7.0 Exam with our Dumps & PDF Test Engine [Q24-Q43] : Exam for engine : http://blog.test4engine.com

NEW QUESTION 24
Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port3 default route has the highest distance.

The port3 default route has the lowest metric.

There will be eight routes active in the routing table.

The port1 and port2 default routes are active in the routing table.

NEW QUESTION 25
Refer to the exhibit.

Which contains a Performance SLA configuration.
An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

Participants configured are not SD-WAN members.

There may not be a static route to route the performance SLA traffic.

The Ping protocol is not supported for the public servers that are configured.

You need to turn on the Enable probe packets switch.

NEW QUESTION 26
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

FortiGuard web filter cache

FortiGate hostname

NTP

DNS

NEW QUESTION 27
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

NEW QUESTION 28
Refer to the exhibit.

The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)

If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.

If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.

If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.

If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.

NEW QUESTION 29
Which statement about the policy ID number of a firewall policy is true?

It changes when firewall policies are reordered.

It represents the number of objects used in the firewall policy.

It is required to modify a firewall policy using the CLI.

It defines the order in which rules are processed.

NEW QUESTION 30
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

The subject field in the server certificate

The serial number in the server certificate

The server name indication (SNI) extension in the client hello message

The subject alternative name (SAN) field in the server certificate

The host field in the HTTP header

NEW QUESTION 31
An administrator has configured the following settings:

Device detection on all interfaces is enforced for 30 minutes.

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

The number of logs generated by denied traffic is reduced.

NEW QUESTION 32
An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

The strict RPF check is run on the first sent and reply packet of any new session.

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

NEW QUESTION 33
Refer to the exhibit.

Based on the raw log, which two statements are correct? (Choose two.)

Traffic is blocked because Action is set to DENY in the firewall policy.

Traffic belongs to the root VDOM.

This is a security log.

Log severity is set to error on FortiGate.

NEW QUESTION 34
Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

SMTP.Login.Brute.Force

IMAP.Login.brute.Force

ip_src_session

Location: server Protocol: SMTP

NEW QUESTION 35
What devices form the core of the security fabric?

Two FortiGate devices and one FortiManager device

One FortiGate device and one FortiManager device

Two FortiGate devices and one FortiAnalyzer device

One FortiGate device and one FortiAnalyzer device

NEW QUESTION 36
Refer to the exhibit to view the application control profile.

Based on the configuration, what will happen to Apple FaceTime?

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration

Apple FaceTime will be allowed, based on the Apple filter configuration.

Apple FaceTime will be allowed only if the filter in Application and Filter Overrides is set to Learn

Apple FaceTime will be allowed, based on the Categories configuration.

NEW QUESTION 37
What is the primary FortiGate election process when the HA override setting is disabled?

Connected monitored ports > System uptime > Priority > FortiGate Serial number

Connected monitored ports > HA uptime > Priority > FortiGate Serial number

Connected monitored ports > Priority > HA uptime > FortiGate Serial number

Connected monitored ports > Priority > System uptime > FortiGate Serial number

NEW QUESTION 38
Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.
What will be the impact of using Include in every user group option in a RADIUS configuration?

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

NEW QUESTION 39
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

NEW QUESTION 40
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

Shut down/reboot a downstream FortiGate device.

Disable FortiAnalyzer logging for a downstream FortiGate device.

Ban or unban compromised hosts.

NEW QUESTION 41
Which three statements about a flow-based antivirus profile are correct? (Choose three.)

IPS engine handles the process as a standalone.

FortiGate buffers the whole file but transmits to the client simultaneously.

If the virus is detected, the last packet is delivered to the client.

Optimized performance compared to proxy-based inspection.

Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.

NEW QUESTION 42
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Firewall policy

Policy rule

Security policy

SSL inspection and authentication policy

NEW QUESTION 43
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

Disabled

On Demand

Enabled

On Idle