Fortinet NSE4_FGT-7.0 Fortinet NSE 4 – FortiOS 7.0 Online Training
Fortinet NSE4_FGT-7.0 Online Training
The questions for NSE4_FGT-7.0 were last updated at Nov 26,2024.
- Exam Code: NSE4_FGT-7.0
- Exam Name: Fortinet NSE 4 - FortiOS 7.0
- Certification Provider: Fortinet
- Latest update: Nov 26,2024
How does FortiGate act when using SSL VPN in web mode?
- A . FortiGate acts as an FDS server.
- B . FortiGate acts as an HTTP reverse proxy.
- C . FortiGate acts as DNS server.
- D . FortiGate acts as router.
B
Explanation:
Reference: https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf
Refer to the exhibits.
Exhibit A.
Exhibit B.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
- A . Change the csf setting on Local-FortiGate (root) to sec configuration-sync local.
- B . Change the csf setting on ISFW (downstream) to sec configuracion-sync local.
- C . Change the csf setting on Local-FortiGate (root) to sec fabric-objecc-unificacion defaulc.
- D . Change the csf setting on ISFW (downstream) to sec fabric-objecc-unificacion defaulc.
A
Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43820
Which two statements are correct about NGFW Policy-based mode? (Choose two.)
- A . NGFW policy-based mode does not require the use of central source NAT policy
- B . NGFW policy-based mode can only be applied globally and not on individual VDOMs
- C . NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
- D . NGFW policy-based mode policies support only flow inspection
Refer to the exhibits.
Exhibit A shows system performance output.
Exhibit B shows s FortiGate configured with the default configuration of high memory usage thresholds.
Based on the system performance output, which two statements are correct? (Choose two.)
- A . Administrators can access FortiGate only through the console port.
- B . FortiGate has entered conserve mode.
- C . FortiGate will start sending all files to FortiSandbox for inspection.
- D . Administrators cannot change the configuration.
B,D
Explanation:
Reference: https://www.skillfulist.com/fortigate/fortigate-conserve-mode-how-to-stop-it-and-what-it-means/
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
- A . To allow for out-of-order packets that could arrive after the FIN/ACK packets
- B . To finish any inspection operations
- C . To remove the NAT operation
- D . To generate logs
A
Explanation:
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.
Which two statements are true about the FGCP protocol? (Choose two.)
- A . Not used when FortiGate is in Transparent mode
- B . Elects the primary FortiGate device
- C . Runs only over the heartbeat links
- D . Is used to discover FortiGate devices in different HA groups
B,C
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/564712/fgcp-fortigate-clustering-protocol
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices.
The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
- A . On HQ-FortiGate, enable Auto-negotiate.
- B . On Remote-FortiGate, set Seconds to 43200.
- C . On HQ-FortiGate, enable Diffie-Hellman Group 2.
- D . On HQ-FortiGate, set Encryption to AES256.
D
Explanation:
Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/168495
Explanation:
Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.
Refer to the exhibit.
Given the interfaces shown in the exhibit, which two statements are true? (Choose two.)
- A . Traffic between port2 and port2-vlan1 is allowed by default.
- B . port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
- C . port1 is a native VLAN.
- D . port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
C,D
Explanation:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interface/ta-p/197640?externalID=FD31639
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883
Refer to the exhibit.
Which contains a session diagnostic output.
Which statement is true about the session diagnostic output?
- A . The session is in SYN_SENT state.
- B . The session is in FIN_ACK state.
- C . The session is in FTN_WAIT state.
- D . The session is in ESTABLISHED state.
A
Explanation:
Indicates TCP (proto=6) session in SYN_SENT state (proto=state=2)
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30042
Refer to the exhibit.
Which contains a session list output. Based on the information shown in the exhibit, which statement is true?
- A . Destination NAT is disabled in the firewall policy.
- B . One-to-one NAT IP pool is used in the firewall policy.
- C . Overload NAT IP pool is used in the firewall policy.
- D . Port block allocation IP pool is used in the firewall policy.
B
Explanation:
FortiGate_Security_6.4 page 155. In one-to-one, PAT is not required.
Latest NSE4_FGT-7.0 Dumps Valid Version with 172 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
