Exit demo NSE4_FGT-7.2 Fortinet NSE 4 - FortiOS 7.2 PDF format · free preview

Fortinet NSE4_FGT-7.2 - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/nse4-fgt-72.html

Question 1
Multiple choice

An administrator has a requirement to keep an application session from timing out on port 80.

What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

A.

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

B.

Create a new service object for HTTP service and set the session TTL to never

C.

Set the TTL value to never under config system-ttl

D.

Set the session TTL on the HTTP policy to maximum

Question 2
Multiple choice

Which two statements are true about the FGCP protocol? (Choose two.)

A.

FGCP elects the primary FortiGate device.

B.

FGCP is not used when FortiGate is in transparent mode.

C.

FGCP runs only over the heartbeat links.

D.

FGCP is used to discover FortiGate devices in different HA groups.

Question 3
Single choice

Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

A.

get system status

B.

get system performance status

C.

diagnose sys top

D.

get system arp

Question 4
Single choice

Refer to the exhibit.

Based on the ZTNA tag, the security posture of the remote endpoint has changed.

What will happen to endpoint active ZTNA sessions?

A.

They will be re-evaluated to match the endpoint policy.

B.

They will be re-evaluated to match the firewall policy.

C.

They will be re-evaluated to match the ZTNA policy.

D.

They will be re-evaluated to match the security policy.

Question 5
Multiple choice

Which three statements are true regarding session-based authentication? (Choose three.)

A.

HTTP sessions are treated as a single user.

B.

IP sessions from the same source IP address are treated as a single user.

C.

It can differentiate among multiple clients behind the same source IP address.

D.

It requires more resources.

E.

It is not recommended if multiple users are behind the source NAT

Question 6
Single choice

Which statement about the IP authentication header (AH) used by IPsec is true?

A.

AH does not provide any data integrity or encryption.

B.

AH does not support perfect forward secrecy.

C.

AH provides data integrity bur no encryption.

D.

AH provides strong data integrity but weak encryption.

Question 7
Single choice

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

A.

diagnose wad session list

B.

diagnose wad session list | grep hook-pre&&hook-out

C.

diagnose wad session list | grep hook=pre&&hook=out

D.

diagnose wad session list | grep "hook=pre"&"hook=out"

Question 8
Multiple choice

Refer to the exhibit.

The exhibit shows the IPS sensor configuration.

If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

A.

The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

B.

The sensor will block all attacks aimed at Windows servers.

C.

The sensor will reset all connections that match these signatures.

D.

The sensor will gather a packet log for all matched traffic.

Question 9
Multiple choice

An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

A.

Device detection on all interfaces is enforced for 30 minutes.

B.

Denied users are blocked for 30 minutes.

C.

A session for denied traffic is created.

D.

The number of logs generated by denied traffic is reduced.

Question 10
Multiple choice

Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

A.

Shut down/reboot a downstream FortiGate device.

B.

Disable FortiAnalyzer logging for a downstream FortiGate device.

C.

Log in to a downstream FortiSwitch device.

D.

Ban or unban compromised hosts.

Showing 10 of 185 questions · Unlock the full set