Top Tips Of Refresh NSE4_FGT-7.0 Brain Dumps

NEW QUESTION 1

When configuring a firewall virtual wire pair policy, which following statement is true?

• A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.
• B. Only a single virtual wire pair can be included in each policy.
• C. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.
• D. Exactly two virtual wire pairs need to be included in each policy.

Answer: A

Explanation:
Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD48690

NEW QUESTION 2

When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?

• A. Log ID
• B. Universally Unique Identifier
• C. Policy ID
• D. Sequence ID

Answer: B

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/554066/firewall-policies

NEW QUESTION 3

What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

• A. Full Content inspection
• B. Proxy-based inspection
• C. Certificate inspection
• D. Flow-based inspection

Answer: D

NEW QUESTION 4

You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk.
What is the default behavior when the local disk is full?

• A. Logs are overwritten and the only warning is issued when log disk usage reaches the threshold of 95%.
• B. No new log is recorded until you manually clear logs from the local disk.
• C. Logs are overwritten and the first warning is issued when log disk usage reaches the threshold of 75%.
• D. No new log is recorded after the warning is issued when log disk usage reaches the threshold of 95%.

Answer: C

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cli-reference/462620/log-disk-setting

NEW QUESTION 5

Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)

• A. FG-traffic
• B. Mgmt
• C. FG-Mgmt
• D. Root

Answer: AD

Explanation:
Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/758820/split-task-vdom-mode

NEW QUESTION 6

Refer to the exhibit.

Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

• A. Destination NAT is disabled in the firewall policy.
• B. One-to-one NAT IP pool is used in the firewall policy.
• C. Overload NAT IP pool is used in the firewall policy.
• D. Port block allocation IP pool is used in the firewall policy.

Answer: B

Explanation:
FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.

NEW QUESTION 7

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

• A. A CRL
• B. A person
• C. A subordinate CA
• D. A root CA

Answer: D

NEW QUESTION 8

Which two statements are correct about NGFW Policy-based mode? (Choose two.)

• A. NGFW policy-based mode does not require the use of central source NAT policy
• B. NGFW policy-based mode can only be applied globally and not on individual VDOMs
• C. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
• D. NGFW policy-based mode policies support only flow inspection

Answer: CD

NEW QUESTION 9

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

• A. To detect intermediary NAT devices in the tunnel path.
• B. To dynamically change phase 1 negotiation mode aggressive mode.
• C. To encapsulation ESP packets in UDP packets using port 4500.
• D. To force a new DH exchange with each phase 2 rekey.

Answer: AC

NEW QUESTION 10

Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)

• A. Log downloads from the GUI are limited to the current filter view
• B. Log backups from the CLI cannot be restored to another FortiGate.
• C. Log backups from the CLI can be configured to upload to FTP as a scheduled time
• D. Log downloads from the GUI are stored as LZ4 compressed files.

Answer: AB

NEW QUESTION 11

Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)

• A. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
• B. The client FortiGate requires a manually added route to remote subnets.
• C. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
• D. Server FortiGate requires a CA certificate to verify the client FortiGate certificate.

Answer: CD

Explanation:
Reference:
https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/266506/ssl-vpn-with-certificate-authentication

NEW QUESTION 12

Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster. Which two statements are true? (Choose two.)

• A. FortiGate SN FGVM010000065036 HA uptime has been reset.
• B. FortiGate devices are not in sync because one device is down.
• C. FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
• D. FortiGate SN FGVM010000064692 has the higher HA priority.

Answer: AD

Explanation:
* 1. Override is disable by default - OK
* 2. "If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary" The question here is : HA Uptime of FGVM01000006492 > 5 minutes? NO - 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study Guide.
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/666653/primary-unit-selection-with-override-disab

NEW QUESTION 13

An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?

• A. VLAN interface
• B. Software Switch interface
• C. Aggregate interface
• D. Redundant interface

Answer: C

Explanation:
Reference: https://forum.fortinet.com/tm.aspx?m=120324

NEW QUESTION 14

Which three statements are true regarding session-based authentication? (Choose three.)

• A. HTTP sessions are treated as a single user.
• B. IP sessions from the same source IP address are treated as a single user.
• C. It can differentiate among multiple clients behind the same source IP address.
• D. It requires more resources.
• E. It is not recommended if multiple users are behind the source NAT

Answer: ACD

NEW QUESTION 15

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

• A. diagnose wad session list
• B. diagnose wad session list | grep hook-pre&&hook-out
• C. diagnose wad session list | grep hook=pre&&hook=out
• D. diagnose wad session list | grep "hook=pre"&"hook=out"

Answer: A

NEW QUESTION 16

A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.
What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?

• A. Static IP Address
• B. Dialup User
• C. Dynamic DNS
• D. Pre-shared Key

Answer: B

Explanation:
Dialup user is used when the remote peer's IP address is unknown. The remote peer whose IP address is unknown acts as the dialup clien and this is often the case for branch offices and mobile VPN clients that use dynamic IP address and no dynamic DNS

NEW QUESTION 17

FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.
Which two syntaxes are correct to configure web rating for the home page? (Choose two.)

• A. www.example.com:443
• B. www.example.com
• C. example.com
• D. www.example.com/index.html

Answer: BC

Explanation:
FortiGate_Security_6.4 page 384
When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for host names— "no URLs or wildcard characters are allowed".

NEW QUESTION 18

Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)

• A. Shut down/reboot a downstream FortiGate device.
• B. Disable FortiAnalyzer logging for a downstream FortiGate device.
• C. Log in to a downstream FortiSwitch device.
• D. Ban or unban compromised hosts.

Answer: AB

NEW QUESTION 19

Examine this FortiGate configuration:

How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

• A. It always authorizes the traffic without requiring authentication.
• B. It drops the traffic.
• C. It authenticates the traffic using the authentication scheme SCHEME2.
• D. It authenticates the traffic using the authentication scheme SCHEME1.

Answer: D

Explanation:
“What happens to traffic that requires authorization, but does not match any authentication rule? The active and passive SSO schemes to use for those cases is defined under config authentication setting”

NEW QUESTION 20
......