Fortinet NSE4_FGT-7.0リアル試験問題テストエンジン問題集トレーニングには175問あります [Q74-Q89]

Rate this post

Fortinet NSE4_FGT-7.0リアル試験問題テストエンジン問題集トレーニングには175問あります

NSE4_FGT-7.0実際の問題解答PDFには100%カバー率リアル試験問題

Fortinet NSE 4プログラムは、ファイアウォールポリシー、VPN構成、侵入防止システム、ネットワークルーティングなど、ネットワークセキュリティのすべての側面をカバーする包括的なトレーニングプログラムです。NSE4_FGT-7.0試験は、このトレーニングプログラムで習得した知識とスキルをテストすることで、さらにビルドアップされます。

Fortinet NSE4_FGT-7.0の認定試験は、ITの専門家がFortinetベースのネットワークを管理および保護する能力と知識を検証する優れた方法です。この認定は、グローバルで認められており、候補者がネットワークとセキュリティ管理のキャリアを促進するのに役立ちます。

質問74、 Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?

On HQ-FortiGate, enable Auto-negotiate.

On Remote-FortiGate, set Seconds to 43200.

On HQ-FortiGate, enable Diffie-Hellman Group 2.

On HQ-FortiGate, set Encryption to AES256.

Reference:
Encryption and authentication algorithm needs to match in order for IPSEC be successfully established.

質問75、 When configuring a firewall virtual wire pair policy, which following statement is true?

Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.

Only a single virtual wire pair can be included in each policy.

Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.

Exactly two virtual wire pairs need to be included in each policy.

Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/166804/virtual-wire-pair

質問76、 Examine this output from a debug flow:

Why did the FortiGate drop the packet?

The next-hop IP address is unreachable.

It failed the RPF check.

It matched an explicitly configured firewall policy with the action DENY.

It matched the default implicit firewall policy.

https://kb.fortinet.com/kb/documentLink.do?externalID=13900
If it was dropped by RPF, the log would’ve been “reverse path check fail, drop” See KB ==> https://kb.fortinet.com/kb/documentLink.do?externalID=FD31702

質問77、 Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On both FortiGate devices, set Dead Peer Detection to On Demand.

On HQ-FortiGate, disable Diffie-Helman group 2.

On Remote-FortiGate, set port2 as Interface.

質問78、 Which three statements about security associations (SA) in IPsec are correct? (Choose three.)

Phase 2 SAs are used for encrypting and decrypting the data exchanged through the tunnel.

An SA never expires.

A phase 1 SA is bidirectional, while a phase 2 SA is directional.

Phase 2 SA expiration can be time-based, volume-based, or both.

Both the phase 1 SA and phase 2 SA are bidirectional.

質問79、 NGFW mode allows policy-based configuration for most inspection rules. Which security profile’s configuration does not change when you enable policy-based inspection?

Web filtering

Antivirus

Web proxy

Application control

質問80、 Refer to the exhibit.

Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)

There are five devices that are part of the security fabric.

Device detection is disabled on all FortiGate devices.

This security fabric topology is a logical topology view.

There are 19 security recommendations for the security fabric.

References:
https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/761085/results
https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/736125/security-fabric-topology

質問81、 When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

remote user’s public IP address

The public IP address of the FortiGate device.

The remote user’s virtual IP address.

The internal IP address of the FortiGate device.

Explanation
Source IP seen by the remote resources is FortiGate’s internal IP address and not the user’s IP address

質問82、 A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.
What is the reason for the failed virus detection by FortiGate?

Application control is not enabled

SSL/SSH Inspection profile is incorrect

Antivirus profile configuration is incorrect

Antivirus definitions are not up to date

https traffic requires SSL decryption. Check the ssh inspection profile

質問83、 An administrator needs to increase network bandwidth and provide redundancy.
What interface type must the administrator select to bind multiple FortiGate interfaces?

VLAN interface

Software Switch interface

Aggregate interface

Redundant interface

Reference:
https://www.fortinetguru.com/2016/12/aggregate-interfaces/

質問84、 An administrator must disable RPF check to investigate an issue.
Which method is best suited to disable RPF without affecting features like antivirus and intrusion prevention system?

Enable asymmetric routing, so the RPF check will be bypassed.

Disable the RPF check at the FortiGate interface level for the source check.

Disable the RPF check at the FortiGate interface level for the reply check.

Enable asymmetric routing at the interface level.

質問85、 Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)

The port3 default route has the highest distance.

The port3 default route has the lowest metric.

There will be eight routes active in the routing table.

The port1 and port2 default routes are active in the routing table.

質問86、 Refer to the exhibit.

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

Custom permission for Network

Read/Write permission for Log & Report

CLI diagnostics commands permission

Read/Write permission for Firewall

https://kb.fortinet.com/kb/documentLink.do?externalID=FD50220

質問87、 Refer to the exhibit.

The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check.
Which interface will be selected as an outgoing interface?

port2

port4

port3

port1

Port 1 shows the lowest latency.

質問88、 Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?

To remove the NAT operation.

To generate logs

To finish any inspection operations.

To allow for out-of-order packets that could arrive after the FIN/ACK packets.

質問89、 Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

To allow for out-of-order packets that could arrive after the FIN/ACK packets

To finish any inspection operations

To remove the NAT operation

To generate logs

Explanation
TCP provides the ability for one end of a connection to terminate its output while still receiving data from the other end. This is called a half-close. FortiGate unit implements a specific timer before removing an entry in the firewall session table.

Loading …

Fortinet NSE4_FGT-7.0 は、Fortinet のセキュリティソリューションを展開、設定、管理するスキルと知識を検証したい IT プロフェッショナルを対象とした認定試験です。この試験は、Fortinet のセキュリティアプライアンスにパワーを与える最新バージョンの FortiOS 7.0 に焦点を当てています。

PassTest NSE4_FGT-7.0試験練習テスト問題：https://www.passtest.jp/Fortinet/NSE4_FGT-7.0-shiken.html