Download Fortinet NSE 4 -FortiOS 7-2.CertsHero.NSE4_FGT-7.2.v4-1.2023-03-19.1e.80q.vcex

Download Exam

File Info

Exam Fortinet NSE 4 -FortiOS 7-2
Number NSE4_FGT-7.2
File Name Fortinet NSE 4 -FortiOS 7-2.CertsHero.NSE4_FGT-7.2.v4-1.2023-03-19.1e.80q.vcex
Size 4.96 Mb
Posted March 19, 2023
Downloads 36

How to open VCEX & EXAM Files?

Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.

Download
ProfExam Simulator

Purchase
Coupon: EXAM_HUB

Discount: 20%

ProfExam Simulator ProfExam Simulator ProfExam Simulator ProfExam Simulator ProfExam Simulator
 
 


Demo Questions

Question 1
Which two statements explain antivirus scanning modes? (Choose two.)

  • A: In proxy-based inspection mode, files bigger than the buffer size are scanned.
  • B: In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it tothe client.
  • C: In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, beforesending it to the client.
  • D: In flow-based inspection mode, files bigger than the buffer size are scanned.
Correct Answer: BC
An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB.
That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that detect 100% of malware regardless of file size, a firewall would need infinitely large RAM--something that no device has in the real world. Most viruses are very small.
This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.



Question 2
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

  • A: FortiGuard web filter cache
  • B: FortiGate hostname
  • C: NTP
  • D: DNS
Correct Answer: CD



Question 3
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

  • A: To allow for out-of-order packets that could arrive after the FIN/ACK packets
  • B: To finish any inspection operations
  • C: To remove the NAT operation
  • D: To generate logs
Correct Answer: A
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.



Question 4
How does FortiGate act when using SSL VPN in web mode?

  • A: FortiGate acts as an FDS server.
  • B: FortiGate acts as an HTTP reverse proxy.
  • C: FortiGate acts as DNS server.
  • D: FortiGate acts as router.
Correct Answer: B
Reference:
https://pub.kb.fortinet.com/ksmcontent/Fortinet-Public/current/Fortigate_v4.0MR3/fortigate-sslvpn-40-mr3.pdf



Question 5
Which three statements explain a flow-based antivirus profile? (Choose three.)

  • A: IPS engine handles the process as a standalone.
  • B: FortiGate buffers the whole file but transmits to the client simultaneously.
  • C: If the virus is detected, the last packet is delivered to the client.
  • D: Optimized performance compared to proxy-based inspection.
  • E: Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection.
Correct Answer: BDE
Reference: https://forum.fortinet.com/tm .aspx?m=192309



Question 6
Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

    

    

Which statement is correct if a user is unable to receive a block replacement message when
downloading an infected file for the first time?

  • A: The firewall policy performs the full content inspection on the file.
  • B: The flow-based inspection is used, which resets the last packet to the user.
  • C: The volume of traffic being inspected is too high for this model of FortiGate.
  • D: The intrusion prevention security profile needs to be enabled when using flow-based inspectionmode.
Correct Answer: B
"ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.



Question 7
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up
The secondary tunnel must be used only if the primary tunnel goes down
In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover
Which two key configuration changes are needed on FortiGate to meet the design requirements?
(Choose two,)

  • A: Configure a high distance on the static route for the primary tunnel, and a lower distance on thestatic route for the secondary tunnel.
  • B: Enable Dead Peer Detection.
  • C: Configure a lower distance on the static route for the primary tunnel, and a higher distance on thestatic route for the secondary tunnel.
  • D: Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
Correct Answer: BC
Study Guide  IPsec VPN  IPsec configuration  Phase 1 Network.
When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.
There are three DPD modes. On demand is the default mode.
Study Guide  IPsec VPN  Redundant VPNs.
Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.
Add at least one phase 2 definition for each phase 1.
Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup).
Alternatively, use dynamic routing.
Configure FW policies for each IPsec interface.



Question 8
Refer to the exhibit.

    

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

  • A: Traffic between port2 and port2-vlan1 is allowed by default.
  • B: port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
  • C: port1 is a native VLAN.
  • D: port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.
Correct Answer: CD
https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interf
https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883



Question 9
Refer to the exhibit.

    

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

  • A: There are five devices that are part of the security fabric.
  • B: Device detection is disabled on all FortiGate devices.
  • C: This security fabric topology is a logical topology view.
  • D: There are 19 security recommendations for the security fabric.
Correct Answer: CD
References:
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results
https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology



Question 10
Refer to the exhibits.

    

    

Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

  • A: Administrators can access FortiGate only through the console port.
  • B: FortiGate has entered conserve mode.
  • C: FortiGate will start sending all files to FortiSandbox for inspection.
  • D: Administrators cannot change the configuration.
Correct Answer: BD
Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes/ta-p/198502
configurable thresholds
Though it is recommended to keep the default memory threshold, a new CLI command has been added to allow administrators to adjust the thresholds.
Default values are :
red : 88% of total memory is considered "used memory"
extreme : 95% of total memory is considered "used memory"
green : 82% of total memory is considered "used memory"






CONNECT US


ProfExam
PROFEXAM WITH A 20% DISCOUNT

You can buy ProfExam with a 20% discount..

Get Now!


HOW TO OPEN VCEX AND EXAM FILES

Use ProfExam Simulator to open VCEX and EXAM files
ProfExam Screen



HOW TO OPEN VCE FILES

Use VCE Exam Simulator to open VCE files
Avanaset