DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

Latest Fortinet NSE4_FGT-7.2 Practice Materials & Exam Questions 2024, Fortinet NSE 4 FortiOS 7.2 | SPOTO

Prepare for success in the Fortinet NSE 4 - FortiOS 7.2 certification with SPOTO's latest practice materials and exam questions for 2024. This certification is essential for network and security professionals managing firewall solutions in enterprise network security infrastructures. SPOTO offers high-quality practice tests, exam dumps, sample questions, and exam materials to enhance your exam readiness. Our exam simulator provides a realistic platform for online exam questions and mock exams, ensuring a thorough exam preparation experience. Trust SPOTO's expertise in providing top-notch exam preparation resources to help you excel in the Fortinet NSE 4 - FortiOS 7.2 exam and advance your career in network and security administration.
Take other online exams
Question #1
A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded. What is the reason for the failed virus detection by FortiGate?
A. The website is exempted from SSL inspection
B. The EICAR test file exceeds the protocol options oversize limit
C. The selected SSL inspection profile has certificate inspection enabled
D. The browser does not trust the FortiGate self-signed CA certificate
View answer
Correct Answer: A
Question #2
Refer to the exhibits. The exhibits show a network diagram and firewall configurations. An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver. In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
A. Disable match-vip in the Deny policy
B. Set the Destination address as Deny_IP in the Allow-access policy
C. Enable match vip in the Deny policy
D. Set the Destination address as Web_server in the Deny policy
View answer
Correct Answer: D
Question #3
An employee needs to connect to the office through a high-latency internet connection. Which SSL VPN setting should the administrator adjust to prevent SSL VPN negotiation failure?
A. idle-timeout
B. login-timeout
C. udp-idle-timer
D. session-ttl
View answer
Correct Answer: BD
Question #4
Which two protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)
A. DNS
B. ping
C. udp-echo
D. TWAMP
View answer
Correct Answer: D
Question #5
FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax. Which two syntaxes are correct to configure web rating for the home page? (Choose two.)
A. www
B. www
C. example
D. www
View answer
Correct Answer: CD
Question #6
An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
A. Add the support of NTLM authentication
B. Add user accounts to Active Directory (AD)
C. Add user accounts to the FortiGate group fitter
D. Add user accounts to the Ignore User List
View answer
Correct Answer: AD
Question #7
Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services. Which CLI command must the administrator use to view the route?
A. get router info routing-table database
B. diagnose firewall route list
C. get internet-service route list
D. get router info routing-table all
View answer
Correct Answer: CD
Question #8
Which contains a session list output. Based on the information shown in the exhibit, which statement is true?
A. Destination NAT is disabled in the firewall policy
B. One-to-one NAT IP pool is used in the firewall policy
C. Overload NAT IP pool is used in the firewall policy
D. Port block allocation IP pool is used in the firewall policy
View answer
Correct Answer: D
Question #9
Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?
A. diagnose wad session list
B. diagnose wad session list | grep hook-pre&&hook-out
C. diagnose wad session list | grep hook=pre&&hook=out
D. diagnose wad session list | grep "hook=pre"&"hook=out"
View answer
Correct Answer: CD
Question #10
Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
A. The IPS engine was inspecting high volume of traffic
B. The IPS engine was unable to prevent an intrusion attack
C. The IPS engine was blocking all traffic
D. The IPS engine will continue to run in a normal state
View answer
Correct Answer: D
Question #11
By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers. Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?
A. set fortiguard-anycast disable
B. set webfilter-force-off disable
C. set webfilter-cache disable
D. set protocol tcp
View answer
Correct Answer: A
Question #12
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device. Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
A. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses
B. FortiGate allocates port blocks on a first-come, first-served basis
C. FortiGate generates a system event log for every port block allocation made per user
D. FortiGate allocates 128 port blocks per user
View answer
Correct Answer: BC
Question #13
Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)
A. The client FortiGate requires a client certificate signed by the CA on the server FortiGate
B. The client FortiGate requires a manually added route to remote subnets
C. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN
D. The server FortiGate requires a CA certificate to verify the client FortiGate certificate
View answer
Correct Answer: B
Question #14
Refer to the exhibits. Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)
A. Administrators can access FortiGate only through the console port
B. FortiGate has entered conserve mode
C. FortiGate will start sending all files to FortiSandbox for inspection
D. Administrators cannot change the configuration
View answer
Correct Answer: D
Question #15
- (Exam Topic 2) Which statement about the IP authentication header (AH) used by IPsec is true?
A. AH does not provide any data integrity or encryption
B. AH does not support perfect forward secrecy
C. AH provides data integrity bur no encryption
D. AH provides strong data integrity but weak encryption
View answer
Correct Answer: CD
Question #16
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
A. The port3 default route has the lowest metric
B. The port1 and port2 default routes are active in the routing table
C. The ports default route has the highest distance
D. There will be eight routes active in the routing table
View answer
Correct Answer: A
Question #17
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?
A. On Remote-FortiGate, set Seconds to 43200
B. On HQ-FortiGate, set Encryption to AES256
C. On HQ-FortiGate, enable Diffie-Hellman Group 2
D. On HQ-FortiGate, enable Auto-negotiate
View answer
Correct Answer: B
Question #18
An organization requires remote users to send external application data running on their PCs and access FTP resources through an SSL/TLS connection. Which FortiGate configuration can achieve this goal?
A. SSL VPN bookmark
B. SSL VPN tunnel
C. Zero trust network access
D. SSL VPN quick connection
View answer
Correct Answer: B
Question #19
Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
A. To allow for out-of-order packets that could arrive after the FIN/ACK packets
B. To finish any inspection operations
C. To remove the NAT operation
D. To generate logs
View answer
Correct Answer: B
Question #20
- (Exam Topic 2) Examine the two static routes shown in the exhibit, then answer the following question. Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
A. FortiGate will load balance all traffic across both routes
B. FortiGate will use the port1 route as the primary candidate
C. FortiGate will route twice as much traffic to the port2 route
D. FortiGate will only actuate the port1 route in the routing table
View answer
Correct Answer: CD
Question #21
An administrator configures outgoing interface any in a firewall policy. What is the result of the policy list view?
A. Search option is disabled
B. Policy lookup is disabled
C. By Sequence view is disabled
D. Interface Pair view is disabled
View answer
Correct Answer: C
Question #22
On FortiGate, which type of logs record information about traffic directly to and from the FortiGate management IP addresses?
A. System event logs
B. Forward traffic logs
C. Local traffic logs
D. Security logs
View answer
Correct Answer: ABE
Question #23
Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
A. The signature setting uses a custom rating threshold
B. The signature setting includes a group of other signatures
C. Traffic matching the signature will be allowed and logged
D. Traffic matching the signature will be silently dropped and logged
View answer
Correct Answer: AC
Question #24
- (Exam Topic 2) Which scanning technique on FortiGate can be enabled only on the CLI?
A. Heuristics scan
B. Trojan scan
C. Antivirus scan
D. Ransomware scan
View answer
Correct Answer: A
Question #25
Examine this output from a debug flow: Why did the FortiGate drop the packet?
A. The next-hop IP address is unreachable
B. It failed the RPF check
C. It matched an explicitly configured firewall policy with the action DENY
D. It matched the default implicit firewall policy
View answer
Correct Answer: C
Question #26
Based on the ZTNA tag, the security posture of the remote endpoint has changed. What will happen to endpoint active ZTNA sessions?
A. They will be re-evaluated to match the endpoint policy
B. They will be re-evaluated to match the firewall policy
C. They will be re-evaluated to match the ZTNA policy
D. They will be re-evaluated to match the security policy
View answer
Correct Answer: A
Question #27
What are two features of collector agent advanced mode? (Choose two.)
A. In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate
B. In advanced mode, security profiles can be applied only to user groups, not individual users
C. Advanced mode uses the Windows convention—NetBios: Domain\Username
D. Advanced mode supports nested or inherited groups
View answer
Correct Answer: AC
Question #28
Examine this FortiGate configuration: How does the FortiGate handle web proxy traffic coming from the IP address 10.2.1.200 that requires authorization?
A. It always authorizes the traffic without requiring authentication
B. It drops the traffic
C. It authenticates the traffic using the authentication scheme SCHEME2
D. It authenticates the traffic using the authentication scheme SCHEME1
View answer
Correct Answer: ADE
Question #29
In which two ways can RPF checking be disabled? (Choose two )
A. Enable anti-replay in firewall policy
B. Disable the RPF check at the FortiGate interface level for the source check
C. Enable asymmetric routing
D. Disable strict-arc-check under system settings
View answer
Correct Answer: BD

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.