Fortinet NSE4_FGT-7.2 Exam Questions Instant Access

Question 1

Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

AWarning

BExempt

CAllow

DLearn

Answer : A, C

Question 2

Which of statement is true about SSL VPN web mode?

AThe tunnel is up while the client is connected.

BIt supports a limited number of protocols.

CThe external network application sends data through the VPN.

DIt assigns a virtual IP address to the client.

Answer : B

FortiGate_Security_6.4 page 575 - Web mode requires only a web browser, but supports a limited number of protocols.

Question 3

Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.

Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

AThe Detection Mode setting is not set to Passive.

BAdministrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.

CThe configured participants are not SD-WAN members.

DThe Enable probe packets setting is not enabled.

Answer : B, D

Question 4

Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

Aget system status

Bget system performance status

Cdiagnose sys top

Dget system arp

Answer : D

'If you suspect that there is an IP address conflict, or that an IP has been assigned to the wrong device, you may need to look at the ARP table.'

Question 5

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

AThe matching firewall policy is set to proxy inspection mode.

BThe certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

CThe full SSL inspection feature does not have a valid license.

DThe browser does not trust the certificate used by FortiGate for SSL inspection.

Answer : D

FortiGate Security 7.2 Study Guide (p.235): 'If FortiGate receives a trusted SSL certificate, then it generates a temporary certificate signed by the built-in Fortinet_CA_SSL certificate and sends it to the browser. If the browser trusts the Fortinet_CA_SSL certificate, the browser completes the SSL handshake. Otherwise, the browser also presents a warning message informing the user that the site is untrusted. In other words, for this function to work as intended, you must import the Fortinet_CA_SSL certificate into the trusted root CA certificate store of your browser.'

Question 6

Which three statements are true regarding session-based authentication? (Choose three.)

AHTTP sessions are treated as a single user.

BIP sessions from the same source IP address are treated as a single user.

CIt can differentiate among multiple clients behind the same source IP address.

DIt requires more resources.

EIt is not recommended if multiple users are behind the source NAT

Answer : A, C, D

Question 7

Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

AThe debug flow is of ICMP traffic.

BA firewall policy allowed the connection.

CA new traffic session is created.

DThe default route is required to receive a reply.

Answer : A, C

Fortinet NSE 4 - FortiOS 7.2 NSE4_FGT-7.2 Exam Questions