A fully updated 2024 NSE4_FGT-7.0 Exam Dumps exam guide from training expert BraindumpsIT [Q73-Q97]

4.7/5 - (3 votes)

A fully updated 2024 NSE4_FGT-7.0 Exam Dumps exam guide from training expert BraindumpsIT

Provides complete coverage of every objective on exam and exam preparation NSE4_FGT-7.0

Q73. An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Enable asymmetric routing, so the RPF check will be bypassed.

Disable the RPF check at the FortiGate interface level for the source check.

Disable the RPF check at the FortiGate interface level for the reply check.

Enable asymmetric routing at the interface level.

Q74. Refer to the exhibit.

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

The Detection Mode setting is not set to Passive.

Administrator didn’t configure a gateway for the SD-WAN members, or configured gateway is not valid.

The configured participants are not SD-WAN members.

The Enable probe packets setting is not enabled.

Q75. View the exhibit:

Which the FortiGate handle web proxy traffic rue? (Choose two.)

Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

port-VLAN1 is the native VLAN for the port1 physical interface.

port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Q76. Refer to the exhibits.

The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?

Change the SSL VPN port on the client.

Change the Server IP address.

Change the idle-timeout.

Change the SSL VPN portal to the tunnel.

Q77. What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)

Traffic to botnetservers

Traffic to inappropriate web sites

Server information disclosure attacks

Credit card data leaks

SQL injection attacks

Q78. Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

10.200.1.1

10.200.3.1

10.200.1.100

10.200.1.10

Q79. Refer to the exhibit to view the firewall policy.

Which statement is correct if well-known viruses are not being blocked?

The firewall policy does not apply deep content inspection.

The firewall policy must be configured in proxy-based inspection mode.

The action on the firewall policy must be set to deny.

Web filter should be enabled on the firewall policy to complement the antivirus profile.

Q80. Which two statements about antivirus scanning mode are true? (Choose two.)

In proxy-based inspection mode, files bigger than the buffer size are scanned.

In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.

In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.

In flow-based inspection mode, files bigger than the buffer size are scanned.

Q81. Refer to the exhibit, which contains a session diagnostic output.

Which statement is true about the session diagnostic output?

The session is a UDP unidirectional state.

The session is in TCP ESTABLISHED state.

The session is a bidirectional UDP connection.

The session is a bidirectional TCP connection.

Q82. Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?

Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.

Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.

Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.

Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.

Q83. Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

There are five devices that are part of the security fabric.

Device detection is disabled on all FortiGate devices.

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

Q84. Examine the two static routes shown in the exhibit, then answer the following question.

Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?

FortiGate will load balance all traffic across both routes.

FortiGate will use the port1 route as the primary candidate.

FortiGate will route twice as much traffic to the port2 route

FortiGate will only actuate the port1 route in the routing table

Q85. Refer to the exhibits.

Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

Administrators can access FortiGate only through the console port.

FortiGate has entered conserve mode.

FortiGate will start sending all files to FortiSandbox for inspection.

Administrators cannot change the configuration.

Q86. Refer to the exhibit.

The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.
Which interface will be selected as an outgoing interface?

port2

port4

port3

port1

Q87. Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?

SMTP.Login.Brute.Force

IMAP.Login.brute.Force

ip_src_session

Location: server Protocol: SMTP

Q88. Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

diagnose sys top

execute ping

execute traceroute

diagnose sniffer packet any

get system arp

Q89. If Internet Service is already selected as Destination in a firewall policy, which other configuration objects can be selected to the Destination field of a firewall policy?

User or User Group

IP address

No other object can be added

FQDN address

Q90. Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

Q91. Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

The keyUsage extension must be set to keyCertSign.

The common name on the subject field must use a wildcard name.

The issuer must be a public CA.

The CA extension must be set to TRUE.

Q92. Exhibit:

Refer to the exhibit to view the authentication rule configuration In this scenario, which statement is true?

IP-based authentication is enabled

Route-based authentication is enabled

Session-based authentication is enabled.

Policy-based authentication is enabled

Q93. Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain.

port1 is a native VLAN.

port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Q94. Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

To detect intermediary NAT devices in the tunnel path.

To dynamically change phase 1 negotiation mode aggressive mode.

To encapsulation ESP packets in UDP packets using port 4500.

To force a new DH exchange with each phase 2 rekey.

Q95. Which two statements are true about the RPF check? (Choose two.)

The RPF check is run on the first sent packet of any new session.

The RPF check is run on the first reply packet of any new session.

The RPF check is run on the first sent and reply packet of any new session.

RPF is a mechanism that protects FortiGate and your network from IP spoofing attacks.

Q96. An administrator is running the following sniffer command:

Which three pieces of Information will be Included in me sniffer output? {Choose three.)