Fortinet NSE 4 - FortiOS 7.2 Exam Practice Questions

What order must FortiGate use when the web filter profile has features enabled, such as safe search?

Based on the information shown in the exhibit, which statement is true?

Reliable logging on FortiGate is required to encrypt the transmission of logs.

Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure due to a high-latency internet connection?

Which attribute is added to a firewall policy to support recording logs to FortiAnalyzer or FortiManager and improves functionality when integrated with these devices?

FortiGate operates in NAT mode and when configured with two VLAN subinterfaces on the same physical interface, the VLAN subinterfaces must have ______________ VLAN IDs.

FortiGate can overwrite logs when the local disk is full and generates a warning when log disk usage reaches 95%.

What inspection mode does FortiGate use if configured as a policy-based next-generation firewall (NGFW)?

Which purposes are served by NAT traversal in IPsec?

Which statement is correct regarding the use of application control for inspecting web applications?

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

Which inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)?

What change can the administrator make to allow Twitter while blocking all other social networking sites?

Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA?

Which of the following conditions must be met for a web browser to trust a web server certificate signed by a third-party CA?

An administrator must disable RPF check to investigate an issue. Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Which feature in the Security Fabric takes one or more actions based on event triggers?

What interface will be selected as an outgoing interface based on the given information?

Which three security features require the intrusion prevention system (IPS) engine to function?

Which two statements are true about the FGCP protocol?

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

Policy lookup will be disabled in a firewall policy if outgoing Interface any is configured.

Which two actions can you perform only from the root FortiGate in a Security Fabric?

What changes can the administrator make to resolve the issue without affecting services running through FortiGate?

What is the correct statement about B.ADVPN?

Which DPD mode on FortiGate meets the requirement of sending DPD probes only when no traffic is observed in the tunnel?

What permission is required to run the diagnose firewall auth list CLI command on FortiGate?

What is the correct statement about the Services field in a Virtual IP (VIP)?

What two changes can the administrator make to deny Webserver access for Remote-User2?

What two statements are true about the traffic passing through the FortiGate HA cluster?

What will happen to Apple FaceTime based on the application control profile?

Which two types of traffic are managed only by the management VDOM?

Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

Which two SD-WAN load balancing methods use interface weight value to distribute traffic?

Which two statements are correct about a software switch on FortiGate?

Which two types of traffic are managed only by the management VDOM?

If the Issuer and Subject values are the same in a digital certificate, which type of entity was the certificate issued to?

Which two statements are correct about NGFW Policy-based mode?

Which timeout option should be configured on FortiGate for users?

What two statements are correct about system performance and conserve mode?

Which two statements are correct about SLA targets?

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

What are the reasons why the port1 interface cannot be configured with an IP address?

What is the correct statement about video filtering on FortiGate?

Why did the FortiGate drop the packet?

What configuration change will bring phase 2 up?

What subnet must the administrator configure for the local quick mode selector for site B?

Which three options are the remote log storage options you can configure on FortiGate? (Choose three)

Which two statements about the debug flow output are correct? (Choose two)

Which statement about the session diagnostic output is true?

Which statement about video filtering on FortiGate is true?

Based on the given exhibit, what configuration change must the administrator make to fix the connectivity issue when accessing the web server public address (203.0.113.2) from the internet?

Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

Which three pieces of information are included in the sniffer output? (Choose three)

SSL VPN web mode assigns a virtual IP address to the client.

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate?

What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

Which statements about VLAN sub interfaces with the same VLAN ID are correct?

Which two key configuration changes are needed on FortiGate to set up redundant IPsec VPN tunnels effectively? (Choose two)

What is the limitation of using a URL list and application control on the same firewall policy in NGFW policy-based mode?

Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two)

Regarding the inspection of services by web applications embedded in third-party websites, which statement is correct?

Based on the raw log, which two statements are correct?

Which statements best describe auto discovery VPN (ADVPN)?

Which two statements are true based on the output of the CLI command: diagnose sys ha dump-by vcluster?

If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage, what does this indicate?

Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?

In which two ways can RPF checking be disabled?

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic. Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers?

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection?

Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic and does not support dynamic DNS update service. What type of remote gateway should the administrator configure?

Examine this PAC file configuration. Which of the following statements are true?

Which of the following statements are correct?

Which two statements are true when FortiGate is in transparent mode?

Given the interfaces shown in the exhibit, which two statements are true?

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

An administrator is running the following sniffer command. Which three pieces of information will be included in the sniffer output?

An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?

Examine this FortiGate configuration. How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?

An administrator has configured the following settings. What are the two results of this configuration? (Choose two)

Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

Which two statements explain antivirus scanning modes? (Choose two)

The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?

Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two)

Which statement regarding the firewall policy authentication timeout is true?

Which contains a network diagram and routing table output. The Student is unable to access Webserver. What is the cause of the problem and what is the solution for the problem?

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode. The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem. With this configuration, which statement is true?

Which statement describes a characteristic of automation stitches?

Which three statements explain a flow-based antivirus profile? (Choose three)

Which timeout setting can be responsible for deleting SSL VPN associated sessions?

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match. Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two)

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two)

Which three authentication timeout types are availability for selection on FortiGate? (Choose three)

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three)

If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source field of a firewall policy?

Which of the following statements about central NAT are true? (Choose two.)

To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)

Based on the raw logs shown in the exhibit, which statement is correct?

Which scanning technique on FortiGate can be enabled only on the CLI?

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

If the host 10.200.3.1 sends a TCP SYN packet on port 10443 to 10.200.1.10, what will the source address, destination address, and destination port of the packet be, after FortiGate forwards the packet to the destination?

FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)

Which three methods are used by the collector agent for AD polling? (Choose three.)

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

An administrator needs to increase network bandwidth and provide redundancy. What interface type must the administrator select to bind multiple FortiGate interfaces?

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option. What is the impact of using the Include in every user group option in a RADIUS configuration?

Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?

Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

Which two types of traffic are managed only by the management VDOM? (Choose two.)

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning errors. When visiting HTTP websites, the browser does not report errors. What is the reason for the certificate warning errors?