[Q72-Q94] Real Exam Questions NSE4_FGT-7.0 Dumps Exam Questions in here [Nov-2023]

4.7/5 - (3 votes)

Real Exam Questions NSE4_FGT-7.0 Dumps Exam Questions in here [Nov-2023]

Get Latest Nov-2023 Conduct effective penetration tests using NSE4_FGT-7.0

Fortinet NSE4_FGT-7.0 (Fortinet NSE 4 – FortiOS 7.0) certification exam is a comprehensive exam that tests an individual’s knowledge and skills related to Fortinet’s security products and solutions. NSE4_FGT-7.0 exam is designed for professionals who are involved in the design, implementation, and administration of Fortinet security solutions.

Fortinet NSE4_FGT-7.0 certification exam is part of the Fortinet Network Security Expert (NSE) program, which consists of several levels of certification designed to validate the skills and knowledge of network security professionals. The NSE program is recognized worldwide as a leading certification program for network security professionals, and the NSE4_FGT-7.0 exam is a critical step in advancing your career in network security. Fortinet NSE 4 – FortiOS 7.0 certification exam is available online and can be taken at any time, making it a convenient option for busy professionals. With the increasing demand for skilled network security professionals, obtaining the Fortinet NSE4_FGT-7.0 certification can help you stand out in the job market and enhance your career prospects.

NEW QUESTION 72
An administrator wants to configure timeouts for users. Regardless of the user’s behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?

auth-on-demand

soft-timeout

idle-timeout

new-session

hard-timeout

NEW QUESTION 73
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

It limits the scanning of application traffic to the DNS protocol only.

It limits the scanning of application traffic to use parent signatures only.

It limits the scanning of application traffic to the browser-based technology category only.

It limits the scanning of application traffic to the application category only.

NEW QUESTION 74
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)

FortiGuard web filter cache

FortiGate hostname

NTP

DNS

NEW QUESTION 75
An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

Configure Source IP Pools.

Configure split tunneling in tunnel mode.

Configure different SSL VPN realms.

Configure host check.

NEW QUESTION 76
An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Enable asymmetric routing, so the RPF check will be bypassed.

Disable the RPF check at the FortiGate interface level for the source check.

Disable the RPF check at the FortiGate interface level for the reply check.

Enable asymmetric routing at the interface level.

NEW QUESTION 77
View the exhibit:

Which the FortiGate handle web proxy traffic rue? (Choose two.)

Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

port-VLAN1 is the native VLAN for the port1 physical interface.

port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.

Traffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

NEW QUESTION 78
To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

FortiManager

Root FortiGate

FortiAnalyzer

Downstream FortiGate

NEW QUESTION 79
When configuring a firewall virtual wire pair policy, which following statement is true?

Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

Only a single virtual wire pair can be included in each policy.

Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

Exactly two virtual wire pairs need to be included in each policy.

Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/166804/virtual-wire-pair

NEW QUESTION 80
Consider the topology:
Application on a Windows machine <–{SSL VPN} –>FGT–> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

Set the maximum session TTL value for the TELNET service object.

Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

Create a new service object for TELNET and set the maximum session TTL.

Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

NEW QUESTION 81
Which two statements are correct regarding FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate points the collector agent to use a remote LDAP server.

FortiGate uses the AD server as the collector agent.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate queries AD by using the LDAP to retrieve user group information.

Fortigate Infrastructure 7.0 Study Guide P.272-273
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47732

NEW QUESTION 82
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

Firewall policy

Policy rule

Security policy

SSL inspection and authentication policy

Reference: https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/38324/ngfw-policy-based-mode

NEW QUESTION 83
Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

FortiGate uses the AD server as the collector agent.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate directs the collector agent to use a remote LDAP server.

Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD47732

NEW QUESTION 84
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to

On both FortiGate devices, set

On HQ-FortiGate, disable Diffie-Helman group 2

On Remote-FortiGate, set port2

Explanation
FortiGate Infrastructure 7.0 Study Guide p. 222 FortiGate Infrastructure 7.0 Study Guide p. 208

NEW QUESTION 85
Which two statements are correct about SLA targets? (Choose two.)

You can configure only two SLA targets per one Performance SLA.

SLA targets are optional.

SLA targets are required for SD-WAN rules with a Best Quality strategy.

SLA targets are used only when referenced by an SD-WAN rule.

Reference: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/382233/performance-sla-sla-targets Fortigate Infrastructure 7.0 Study Guide P.81

NEW QUESTION 86
Refer to the exhibit.

According to the certificate values shown in the exhibit, which type of entity was the certificate issued to?

A user

A root CA

A bridge CA

A subordinate

NEW QUESTION 87
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

Disabled

On Demand

Enabled

On Idle

NEW QUESTION 88
Which two statements are true about collector agent advanced mode? (Choose two.)

Advanced mode uses Windows convention-NetBios: DomainUsername.

FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate

Advanced mode supports nested or inherited groups

Security profiles can be applied only to user groups, not individual users.

NEW QUESTION 89
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

The keyUsage extension must be set to keyCertSign.

The common name on the subject field must use a wildcard name.

The issuer must be a public CA.

The CA extension must be set to TRUE.

Reference:
“r. In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set to keyCertSign. ” Fortigate Security Study Guide v7.0, Page 323

NEW QUESTION 90
Refer to the exhibit.

Which contains a session list output. Based on the information shown in the exhibit, which statement is true?

Destination NAT is disabled in the firewall policy.

One-to-one NAT IP pool is used in the firewall policy.

Overload NAT IP pool is used in the firewall policy.

Port block allocation IP pool is used in the firewall policy.

FortiGate_Security_6.4 page 155 . In one-to-one, PAT is not required.

NEW QUESTION 91
Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.

The sensor will block all attacks aimed at Windows servers.

The sensor will reset all connections that match these signatures.

The sensor will gather a packet log for all matched traffic.

NEW QUESTION 92
Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)

FortiGate SN FGVM010000065036 HA uptime has been reset.

FortiGate devices are not in sync because one device is down.

FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.

FortiGate SN FGVM010000064692 has the higher HA priority.

1. Override is disable by default – OK
2. “If the HA uptime of a device is AT LEAST FIVE MINUTES (300 seconds) MORE than the HA Uptime of the other FortiGate devices, it becomes the primary” The question here is : HA Uptime of FGVM01000006492 > 5 minutes? NO – 198 seconds < 300 seconds (5 minutes) Page 314 Infra Study Guide.
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/666653/primary-unit-selection-with-override-disabled-default

NEW QUESTION 93
View the exhibit.

A
user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?