Verified NSE4_FGT-7.2 Exam Dumps PDF [2023] Access using ExamDumpsVCE
Try Best NSE4_FGT-7.2 Exam Questions from Training Expert ExamDumpsVCE
NEW QUESTION # 71
Refer to the exhibit.
Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
- A. The IPS engine was inspecting high volume of traffic.
- B. The IPS engine was unable to prevent an intrusion attack .
- C. The IPS engine will continue to run in a normal state.
- D. The IPS engine was blocking all traffic.
Answer: A
Explanation:
fortinet-fortigate-security-study-guide-for-fortios-72 page 417 If there are high-CPU use problems caused by the IPS, you can use the diagnose test application ipsmonitor command with option 5 to isolate where the problem might be. Option 5 enables IPS bypass mode. In this mode, the IPS engine is still running, but it is not inspecting traffic. If the CPU use decreases after that, it usually indicates that the volume of traffic being inspected is too high for that FortiGate model.
Reference:
https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/232929/troubleshooting-high-cpu-usage
NEW QUESTION # 72
Which two settings are required for SSL VPN to function between two FortiGate devices? (Choose two.)
- A. The client FortiGate requires a manually added route to remote subnets.
- B. The client FortiGate requires a client certificate signed by the CA on the server FortiGate.
- C. The server FortiGate requires a CA certificate to verify the client FortiGate certificate.
- D. The client FortiGate uses the SSL VPN tunnel interface type to connect SSL VPN.
Answer: C,D
Explanation:
https://docs.fortinet.com/document/fortigate/7.0.9/administration-guide/508779/fortigate-as-ssl-vpn-client
NEW QUESTION # 73
FortiGate_Infrastructure_6.4_Study_Guide question 23 51 Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?
- A. The application signature database inspects traffic only from the original web application server.
- B. The security actions applied on the web applications will also be explicitly applied on the third-party websites.
- C. FortiGate can inspect sub-application traffic regardless where it was originated.
- D. FortiGuard maintains only one signature of each web application that is unique.
Answer: C
NEW QUESTION # 74
If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?
- A. The Services field prevents SNAT and DNAT from being combined in the same policy.
- B. The Services field removes the requirement to create multiple VIPs for different services.
- C. The Services field is used when you need to bundle several VIPs into VIP groups.
- D. The Services field prevents multiple sources of traffic from using multiple services to connect to a single computer.
Answer: B
NEW QUESTION # 75
Refer to the exhibit.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.
What is the impact of using the Include in every user group option in a RADIUS configuration?
- A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
- B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- C. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
- D. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
Answer: A
NEW QUESTION # 76
Refer to the exhibit.
Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
- A. Traffic matching the signature will be allowed and logged.
- B. Traffic matching the signature will be silently dropped and logged.
- C. The signature setting uses a custom rating threshold.
- D. The signature setting includes a group of other signatures.
Answer: B
Explanation:
Explanation
Action is drop, signature default action is listed only in the signature, it would only match if action was set to default.
NEW QUESTION # 77
Refer to the exhibits.
Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details.
Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?
- A. Apple FaceTime will be allowed, based on the Apple filter configuration.
- B. Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.
- C. Apple FaceTime will be allowed, based on the Categories configuration.
- D. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.
Answer: D
Explanation:
FortiGate Security 7.2 Study Guide (p.310): "Then, FortiGate scans packets for matches, in this order, for the application control profile: 1. Application and filter overrides: If you have configured any application overrides or filter overrides, the application control profile considers those first. It looks for a matching override starting at the top of the list, like firewall policies. 2. Categories: Finally, the application control profile applies the action that you've configured for applications in your selected categories."
NEW QUESTION # 78
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
- A. The firmware image must be manually uploaded to each FortiGate.
- B. Uninterruptable upgrade is enabled by default.
- C. Only secondary FortiGate devices are rebooted.
- D. Traffic load balancing is temporally disabled while upgrading the firmware.
Answer: B,D
NEW QUESTION # 79
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)
- A. Security policy
- B. SSL inspection and authentication policy
Answer: A,B
NEW QUESTION # 80
Refer to the exhibit.
Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
- A. The port3 default route has the highest distance.
- B. The port1 and port2 default routes are active in the routing table.
- C. The port3 default route has the lowest metric.
- D. There will be eight routes active in the routing table.
Answer: A,B
NEW QUESTION # 81
Refer to the exhibit.
The exhibit shows the output of a diagnose command.
What does the output reveal about the policy route?
- A. It is a regular policy route.
- B. It is an ISDB policy route with an SDWAN rule.
- C. It is an SDWAN rule in policy route.
- D. It is an ISDB route in policy route.
Answer: B
NEW QUESTION # 82
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
- A. Intrusion prevention system engine
- B. Detection engine
- C. Antivirus engine
- D. Flow engine
Answer: A
Explanation:
http://docs.fortinet.com/document/fortigate/6.0.0/handbook/240599/application-control
NEW QUESTION # 83
A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded.
What is the reason for the failed virus detection by FortiGate?
- A. The EICAR test file exceeds the protocol options oversize limit.
- B. The browser does not trust the FortiGate self-signed CA certificate.
- C. The selected SSL inspection profile has certificate inspection enabled.
- D. The website is exempted from SSL inspection.
Answer: B,D
Explanation:
https traffic requires SSL decryption. Check the ssh inspection profile
NEW QUESTION # 84
Which statement about video filtering on FortiGate is true?
- A. Full SSL inspection is not required.
- B. Otis available only on a proxy-based firewall policy.
- C. It does not require a separate FortiGuard license.
- D. Video filtering FortiGuard categories are based on web filter FortiGuard categories.
Answer: C
NEW QUESTION # 85
Which statement about the IP authentication header (AH) used by IPsec is true?
- A. AH does not support perfect forward secrecy.
- B. AH does not provide any data integrity or encryption.
- C. AH provides strong data integrity but weak encryption.
- D. AH provides data integrity bur no encryption.
Answer: D
NEW QUESTION # 86
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)
- A. It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
- B. Tunnels are negotiated dynamically between spokes.
- C. ADVPN is only supported with IKEv2.
- D. Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
Answer: A,B
NEW QUESTION # 87
......
Latest 100% Passing Guarantee - Brilliant NSE4_FGT-7.2 Exam Questions PDF: https://braindump2go.examdumpsvce.com/NSE4_FGT-7.2-valid-exam-dumps.html
