[Oct-2023 Newly Released] NSE4_FGT-7.0 Exam Questions For You To Pass [Q94-Q115]

Rate this post

[Oct-2023 Newly Released] NSE4_FGT-7.0 Exam Questions For You To Pass

Fortinet NSE4_FGT-7.0 Exam: Basic Questions With Answers

Fortinet NSE4_FGT-7.0 certification exam is an essential certification for network security professionals who want to validate their skills in managing and configuring Fortinet security products. Fortinet NSE 4 – FortiOS 7.0 certification exam covers a wide range of topics such as Fortinet security products, network security, firewall policies, VPNs, and authentication. Fortinet NSE 4 – FortiOS 7.0 certification exam is designed to test the knowledge of network security professionals in configuring and managing Fortinet security products in a production environment. The Fortinet NSE4_FGT-7.0 certification exam is an excellent way for network security professionals to demonstrate their skills and expertise in Fortinet security products.

Fortinet NSE4_FGT-7.0 (Fortinet NSE 4 – FortiOS 7.0) Certification Exam is a comprehensive certification program designed for IT professionals seeking to validate their skills and knowledge in Fortinet’s FortiOS 7.0 operating system. Fortinet NSE 4 – FortiOS 7.0 certification is offered by Fortinet, a renowned provider of cybersecurity solutions for businesses and organizations around the world. The NSE4_FGT-7.0 certification exam is intended for network administrators, security professionals, and IT managers who want to demonstrate their expertise in implementing and managing Fortinet’s security solutions.

Q94. Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

10.200.1.1

10.200.3.1

10.200.1.100

10.200.1.10

Q95. Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

System event logs

Forward traffic logs

Local traffic logs

Security logs

Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/476970

Q96. Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?

Fabric Coverage

Automated Response

Security Posture

Optimization

Reference:
https://www.fortinet.com/content/dam/fortinet/assets/support/fortinet-recommended-security-bestpractices.pdf Description of the three major scorecards is seen in Security fabric > Security rating>Security posture.
Security Posture Identify configuration weaknesses and best practice violations in your deployment. Fabric Coverage Identify in your overall network, where Security Fabric can enhance visibility and control.
Optimization Optimize your fabric deployment.

Q97. View the exhibit:

Which the FortiGate handle web proxy traffic rue? (Choose two.)

Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

port-VLAN1 is the native VLAN for the port1 physical interface.

port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Q98. Which three statements are true regarding session-based authentication? (Choose three.)

HTTP sessions are treated as a single user.

IP sessions from the same source IP address are treated as a single user.

It can differentiate among multiple clients behind the same source IP address.

It requires more resources.

It is not recommended if multiple users are behind the source NAT

Explanation
FortiGate_Infrastructure_6.4 page 387

Q99. Which two statements about antivirus scanning mode are true? (Choose two.)

In proxy-based inspection mode, files bigger than the buffer size are scanned.

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

In flow-based inspection mode, files bigger than the buffer size are scanned.

An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware regardless of file size, a firewall would need infinitely large RAM-something that no device has in the real world. Most viruses are very small. This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.

Q100. Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

Denial of Service

Web application firewall

Antivirus

Application control

Reference: https://docs.fortinet.com/document/fortiweb/6.3.3/administration-guide/60895/introduction WAF is situated or facing internal servers such as Web Servers with purpose of protecting them from attacks such as XSS,SQL Inj, DOS,…

Q101. Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port3 default route has the highest distance.

The port3 default route has the lowest metric.

There will be eight routes active in the routing table.

The port1 and port2 default routes are active in the routing table.

Q102. Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

There are five devices that are part of the security fabric.

Device detection is disabled on all FortiGate devices.

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

Explanation
References:
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results
https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology

Q103. An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

The strict RPF check is run on the first sent and reply packet of any new session.

Strict RPF checks the best route back to the source using the incoming interface.

Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface.

Strict RPF allows packets back to sources with all active routes.

Q104. Which feature in the Security Fabric takes one or more actions based on event triggers?

Fabric Connectors

Automation Stitches

Security Rating

Logical Topology

Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/286973/fortinet-security-fabric

Q105. Which two statements are true when FortiGate is in transparent mode? (Choose two.)

By default, all interfaces are part of the same broadcast domain.

The existing network IP schema must be changed when installing a transparent mode.

Static routes are required to allow traffic to the next hop.

FortiGate forwards frames without changing the MAC address.

Reference: https://kb.fortinet.com/kb/viewAttachment.do?
attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdf&documentID=FD33113

Q106. If Internet Service is already selected as in a firewall policy, which other configuration objects can be selected to the Destination

User or User Group

IP address

No other object can be added

FQDN address

Reference:
https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-in-policy

Q107. Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Source defined as Internet Services in the firewall policy.

Destination defined as Internet Services in the firewall policy.

Highest to lowest priority defined in the firewall policy.

Services defined in the firewall policy.

Lowest to highest policy ID number.

Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD47435

Q108. Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

Log downloads from the GUI are limited to the current filter view

Log backups from the CLI cannot be restored to another FortiGate.

Log backups from the CLI can be configured to upload to FTP as a scheduled time

Log downloads from the GUI are stored as LZ4 compressed files.

Q109. Refer to the exhibit.

An administrator is running a sniffer command as shown in the exhibit.
Which three pieces of information are included in the sniffer output? (Choose three.)

Interface name

Ethernet header

IP header

Application header

Packet payload

Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=11186

Q110. Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list

diagnose wad session list | grep hook-pre&&hook-out

diagnose wad session list | grep hook=pre&&hook=out

diagnose wad session list | grep “hook=pre”&”hook=out”

Q111. You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?

Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.

No new log is recorded until you manually clear logs from the local disk.

Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.

No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.

Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cli-reference/462620/log-disk-setting
“The system reserves approximately 25% of its disk space for system usage and unexpected quota overflow.”

Q112. Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time

FortiGuaid update servers

Operating mode

NGFW mode

Explanation
C: “Operating mode is per-VDOM setting. You can combine transparent mode VDOM’s with NAT mode VDOMs on the same physical Fortigate.
D: “Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM” Page 125 of FortiGate_Infrastructure_6.4_Study_Guide

Q113. An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.

Create a new service object for HTTP service and set the session TTL to never

Set the TTL value to never under config system-ttl

Set the session TTL on the HTTP policy to maximum

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-timeout-settings/ta-p/191228

Q114. View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?

Addicting.Games is allowed based on the Application Overrides configuration.

Addicting.Games is blocked on the Filter Overrides configuration.

Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.

Addcting.Games is allowed based on the Categories configuration.

Q115. Refer to the exhibits.

The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?