[Q42-Q64] NSE4_FGT-7.2 Practice Test Give You First Time Success with 100% Money Back Guarantee!

5/5 - (2 votes)

NSE4_FGT-7.2 Practice Test Give You First Time Success with 100% Money Back Guarantee!

All Obstacles During NSE4_FGT-7.2 Exam Preparation with NSE4_FGT-7.2 Real Test Questions

NO.42 What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

FortiGate automatically negotiates different local and remote addresses with the remote peer.

FortiGate automatically negotiates a new security association after the existing security association expires.

FortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

FortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

NO.43 Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

The signature setting uses a custom rating threshold.

The signature setting includes a group of other signatures.

Traffic matching the signature will be allowed and logged.

Traffic matching the signature will be silently dropped and logged.

NO.44 Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port3 default route has the highest distance.

The port3 default route has the lowest metric.

There will be eight routes active in the routing table.

The port1 and port2 default routes are active in the routing table.

NO.45 Which statement about video filtering on FortiGate is true?

Video filtering FortiGuard categories are based on web filter FortiGuard categories.

It does not require a separate FortiGuard license.

Full SSL inspection is not required.

Otis available only on a proxy-based firewall policy.

NO.46 A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?

Implement a web filter category override for the specified website

Implement a DNS filter for the specified website.

Implement web filter quotas for the specified website

Implement web filter authentication for the specified website.

NO.47 Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep “hook=pre”&”hook=out”

NO.48 What are two functions of ZTNA? (Choose two.)

ZTNA manages access through the client only.

ZTNA manages access for remote users only.

ZTNA provides a security posture check.

ZTNA provides role-based access.

NO.49 Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets

To finish any inspection operations

To remove the NAT operation

To generate logs

NO.50 Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network, the firewall policy and VIP configuration on the FortiGate device, and the routing table on the ISP router.
When the administrator tries to access the web server public address (203.0.113.2) from the internet, the connection times out. At the same time, the administrator runs a sniffer on FortiGate to capture incoming web traffic to the server and does not see any output.

Based on the information shown in the exhibit, what configuration change must the administrator make to fix the connectivity issue?

Configure a loopback interface with address 203.0.113.2/32.

In the VIP configuration, enable arp-reply.

Enable port forwarding on the server to map the external service port to the internal service port.

In the firewall policy configuration, enable match-vip.

NO.51 Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

It always authorizes the traffic without requiring authentication.

It drops the traffic.

It authenticates the traffic using the authentication scheme SCHEME2.

It authenticates the traffic using the authentication scheme SCHEME1.

NO.52 Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?

10.200. 1. 1

10.200.3. 1

10.200. 1. 100

10.200. 1. 10

NO.53 Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

The traffic sourced from the client and destined to the server is sent to FGT-1.

The cluster can load balance ICMP connections to the secondary.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

NO.54 Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

On HQ-FortiGate, enable Auto-negotiate.

On Remote-FortiGate, set Seconds to 43200.

On HQ-FortiGate, enable Diffie-Hellman Group 2.

On HQ-FortiGate, set Encryption to AES256.

NO.55 Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

10.200. 1. 10

Any available IP address in the WAN (port1) subnet 10.200. 1.0/24 66 of 108

10.200. 1. 1

10.0. 1.254

NO.56 Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

FortiCache

FortiSIEM

FortiAnalyzer

FortiSandbox

FortiCloud

NO.57 An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?

Add the support of NTLM authentication.

Add user accounts to Active Directory (AD).

Add user accounts to the FortiGate group fitter.

Add user accounts to the Ignore User List.

NO.58 Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output of the get system ha status command.

Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

For non-load balanced connections, packets forwarded by the cluster to the server contain the virtual MAC address of port2 as source.

The traffic sourced from the client and destined to the server is sent to FGT-1.

The cluster can load balance ICMP connections to the secondary.

For load balanced connections, the primary encapsulates TCP SYN packets before forwarding them to the secondary.

NO.59 What are two benefits of flow-based inspection compared to proxy-based inspection? (Choose two.)

FortiGate uses fewer resources.

FortiGate performs a more exhaustive inspection on traffic.

FortiGate adds less latency to traffic.

FortiGate allocates two sessions per connection.

NO.60 Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

Heartbeat interfaces have virtual IP addresses that are manually assigned.

A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

Virtual IP addresses are used to distinguish between cluster members.

The primary device in the cluster is always assigned IP address 169.254.0.1.

NO.61 Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)

hard-timeout

auth-on-demand

soft-timeout

new-session

Idle-timeout

NO.62 Refer to exhibit.
An administrator configured the web filtering profile shown in the exhibit to block access to all social networking sites except Twitter. However, when users try to access twitter.com, they are redirected to a FortiGuard web filtering block page.

Based on the exhibit, which configuration change can the administrator make to allow Twitter while blocking all other social networking sites?

On the FortiGuard Category Based Filter Action to Warning for Social Networking

On the Static URL Filter configuration, set Type to Simple

On the Static URL Filter configuration, set Action to Exempt.

On the Static URL Filter configuration, set Action to Monitor.

NO.63 FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
In this scenario, which statement about VLAN IDs is true?

The two VLAN subinterfaces can have the same VLAN ID only if they belong to different VDOMs.

The two VLAN subinterfaces must have different VLAN IDs.

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in the same subnet.

The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in different subnets.

NO.64 Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?