Fortinet NSE4_FGT-7.2 Exam Practice Test Instant Access

Question 1

How can you disable RPF checking?

ADisable strict-src-check under system settings.

BDisable src-check on the interface level settings

CUnset fail-alert-interfaces on the interface level settings.

DDisable fail-detect on the interface level settings.

Answer : B

Question 2

Refer to the exhibit.

The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.

Two PCS, PCI and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the Intarnet_

Based on the information shown in the exhibit, which three configuration changes should the administrator make to fix the connectivity issue for PC3? (Choose three.)

AIn the IP pool configuration, set type to overload.

BConfigure 192.2. O. 12/24 as the secondary IP address on port1

CConfigure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.

DIn the IP pool configuration, set endip to 192.2. O .12

EIn the firewall policy configuration, disable ippool.

Answer : A, D, E

Question 3

Refer to the exhibit showing a debug flow output.

What two conclusions can you make from the debug flow output? (Choose two.)

AThe debug flow is for ICMP traffic.

BThe default route is required to receive a reply.

CAnew traffic session was created.

DA firewall policy allowed the connection.

Answer : A, C

The debug flow output shows the result of a diagnose command that captures the traffic flow between the source and destination IP addresses1.The debug flow output reveals the following information about the traffic flow1:

The protocol is 1, which means that the traffic uses ICMP protocol2.ICMP is a protocol that is used to send error messages and test connectivity between devices2.

The session state is 0, which means that a new traffic session was created3.A session is a data structure that stores information about a connection between two devices3.

The policy ID is 1, which means that the traffic matched the firewall policy with ID 14.A firewall policy is a rule that defines how FortiGate processes traffic based on the source, destination, service, and action parameters4.

The action is 0, which means that the traffic was allowed by the firewall policy. An action is a parameter that specifies what FortiGate does with the traffic that matches a firewall policy.

Therefore, two conclusions that can be made from the debug flow output are:

The debug flow is for ICMP traffic.

A new traffic session was created.

Question 4

An organization requires remote users to send external application data running on their PCs and access FTP resources through an SSL/TLS connection.

Which FortiGate configuration can achieve this goal?

ASSL VPN bookmark

BSSL VPN tunnel

CZero trust network access

DSSL VPN quick connection

Answer : B

FortiGate Infrastructure 7.2 Study Guide (p.198): 'Tunnel mode requires FortiClient to connect to FortiGate. FortiClient adds a virtual network adapter identified as fortissl to the user's PC. This virtual adapter dynamically receives an IP address from FortiGate each time FortiGate establishes a new VPN connection. Inside the tunnel, all traffic is SSL/TLS encapsulated. The main advantage of tunnel mode over web mode is that after the VPN is established, any IP network application running on the client can send traffic through the tunnel.'

An SSL VPN tunnel allows remote users to establish a secure and encrypted Virtual Private Network (VPN) connection to the private network using the SSL/TLS protocol1.An SSL VPN tunnel can provide access to network resources such as FTP servers, as well as external applications running on the user's PC1.

An SSL VPN bookmark is a web link that provides access to network resources through the SSL VPN web portal1. It does not support external applications running on the user's PC.

Zero trust network access (ZTNA) is a security model that provides role-based application access to remote users without exposing the private network to the internet2. It does not use SSL/TLS protocol, but rather a proprietary ZTNA protocol.

SSL VPN quick connection is a feature that allows users to connect to an SSL VPN tunnel without installing FortiClient or any other software on their PC3. It requires a web browser that supports Java or ActiveX. It does not support external applications running on the user's PC.

Question 5

Refer to the exhibits.

Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details.

Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

AApple FaceTime will be allowed, based on the Categories configuration.

BApple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

CApple FaceTime will be allowed, based on the Apple filter configuration.

DApple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Answer : B

FortiGate Security 7.2 Study Guide (p.310): 'Then, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you've configured for applications in your selected categories.'

Question 6

What are two features of collector agent advanced mode? (Choose two.)

AIn advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

BIn advanced mode, security profiles can be applied only to user groups, not individual users.

CAdvanced mode uses the Windows convention---NetBios: Domain\Username.

DAdvanced mode supports nested or inherited groups.

Answer : A, D

A) In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

This is true because advanced mode allows FortiGate to query the LDAP server directly for user information and group membership, without relying on the collector agent.This enables FortiGate to apply security policies based on LDAP group filters, which can be configured on FortiGate1

D) Advanced mode supports nested or inherited groups.

This is true because advanced mode can handle complex group structures, such as nested groups or inherited groups, where a user belongs to a group that is a member of another group.This allows FortiGate to apply security policies based on the effective group membership of a user, not just the direct group membership1

FortiGate Infrastructure 7.2 Study Guide (p.146): 'Also, advanced mode supports nested or inherited groups; that is, users can be members of subgroups that belong to monitored parent groups.' 'In advanced mode, you can configure FortiGate as an LDAP client and configure the group filters on FortiGate. You can also configure group filters on the collector agent.'

Question 7

Which two statements describe how the RPF check is used? (Choose two.)

AThe RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

BThe RPF check is run on the first sent and reply packet of any new session.

CThe RPF check is run on the first sent packet of any new session.

DThe RPF check is run on the first reply packet of any new session.

Answer : A, C

FortiGate Infrastructure 7.2 Study Guide (p.41): 'The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table.' 'FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn't perform any additional RPF checks on that session.'

A) The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.

This is true because the RPF check verifies that the source IP address of an incoming packet matches the reverse route for that address, meaning that the packet came from a legitimate source and not from an attacker who is trying to impersonate another host.This prevents IP spoofing attacks, where an attacker sends packets with a forged source IP address to bypass security policies or launch denial-of-service attacks1

C) The RPF check is run on the first sent packet of any new session.

This is true because the RPF check is performed only once per session, on the first packet sent by either the client or the server, depending on the direction of the session initiation.This reduces the processing overhead and improves performance2

Fortinet NSE4_FGT-7.2 Fortinet NSE 4 - FortiOS 7.2 Exam Practice Test