NSE4_FGT-7.2: Fortinet NSE 4 -FortiOS 7-2 - Free download from Exam Files

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

The firewall policy performs the full content inspection on the file.
The flow-based inspection is used, which resets the last packet to the user.
The volume of traffic being inspected is too high for this model of FortiGate.
The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

Correct answer: B

Explanation:

* 'ONLY' If the virus is detected at the 'START' of the connection, the IPS engine sends the block replacement message immediately* When a virus is detected on a TCP session (FIRST TIME), but where 'SOME PACKETS' have been already forwarded to the receiver, FortiGate 'resets the connection' and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a 'SECOND ATTEMPT' to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

* 'ONLY' If the virus is detected at the 'START' of the connection, the IPS engine sends the block replacement message immediately

* When a virus is detected on a TCP session (FIRST TIME), but where 'SOME PACKETS' have been already forwarded to the receiver, FortiGate 'resets the connection' and does not send the last piece of the file.

Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that if a 'SECOND ATTEMPT' to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.

In flow mode, the FortiGate drops the last packet killing the file. But because of that the block replacement message cannot be displayed. If the file is attempted to download again the block message will be shown.

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

All traffic must be routed through the primary tunnel when both tunnels are up
The secondary tunnel must be used only if the primary tunnel goes down
In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
Enable Dead Peer Detection.
Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

Correct answer: BC

Explanation:

Study Guide -- IPsec VPN -- IPsec configuration -- Phase 1 Network.When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.There are three DPD modes. On demand is the default mode.Study Guide -- IPsec VPN -- Redundant VPNs.Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.Add at least one phase 2 definition for each phase 1.Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.Configure FW policies for each IPsec interface.

Study Guide -- IPsec VPN -- IPsec configuration -- Phase 1 Network.

When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.

There are three DPD modes. On demand is the default mode.

Study Guide -- IPsec VPN -- Redundant VPNs.

Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.

Add at least one phase 2 definition for each phase 1.

Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.

Configure FW policies for each IPsec interface.

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Antivirus engine
Intrusion prevention system engine
Flow engine
Detection engine

Correct answer: B

Explanation:

http://docs.fortinet.com/document/fortigate/6.0.0/handbook/240599/application-control

Refer to the exhibit.

Given the interfaces shown in the exhibit. which two statements are true? (Choose two.)

Traffic between port2 and port2-vlan1 is allowed by default.
port1-vlan10 and port2-vlan10 are part of the same broadcast domain.
port1 is a native VLAN.
port1-vlan and port2-vlan1 can be assigned in the same VDOM or to different VDOMs.

Correct answer: CD

Explanation:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interfhttps://kb.fortinet.com/kb/viewContent.do?externalId=FD30883

https://community.fortinet.com/t5/FortiGate/Technical-Tip-rules-about-VLAN-configuration-and-VDOM-interf

https://kb.fortinet.com/kb/viewContent.do?externalId=FD30883

Which statement about video filtering on FortiGate is true?

Full SSL Inspection is not required.
It is available only on a proxy-based firewall policy.
It inspects video files hosted on file sharing services.
Video filtering FortiGuard categories are based on web filter FortiGuard categories.

Correct answer: B

Which two types of traffic are managed only by the management VDOM? (Choose two.)

FortiGuard web filter queries
PKI
Traffic shaping
DNS

Correct answer: AD

Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?

diagnose wad session list
diagnose wad session list | grep hook-pre&&hook-out
diagnose wad session list | grep hook=pre&&hook=out
diagnose wad session list | grep 'hook=pre'&'hook=out'

Correct answer: A

Which statements best describe auto discovery VPN (ADVPN). (Choose two.)

It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
ADVPN is only supported with IKEv2.
Tunnels are negotiated dynamically between spokes.
Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.

Correct answer: AC

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

By default, FortiGate uses WINS servers to resolve names.
By default, the SSL VPN portal requires the installation of a client's certificate.
By default, split tunneling is enabled.
By default, the admin GUI and SSL VPN portal use the same HTTPS port.

Correct answer: D

Refer to the exhibits.

The exhibits show the firewall policies and the objects used in the firewall policies.

The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?

Policy with ID 4.
Policy with ID 5.
Policies with ID 2 and 3.
Policy with ID 4.

Correct answer: B

Explanation:

We are looking for a policy that will allow or deny traffic from the source interface Port3 and source IP address 10.1.1.10 (LOCAL_CLIENT) to facebook.com TCP port 443 (HTTPS). There are only two policies that will match this traffic, policy ID 2 and 5. In FortiGate, firewall policies are evaluated from top to bottom. This means that the first policy that matches the traffic is applied, and subsequent policies are not evaluated. Based on the Policy Lookup criteria, Policy ID 5 will be highlighted