Lead4Pass NSE4_FGT-7.2 dumps | Fortinet NSE 4 – FortiOS 7.2 Exam Materials

leads4pass NSE4_FGT-7.2 dumps come with PDF and VCE, both formats contain 155 up-to-date exam questions and answers, real Fortinet NSE 4 – FortiOS 7.2 exam material!

Use the leads4pass NSE4_FGT-7.2 dumps verified by the Fortinet NSE4 professional team: https://www.leads4pass.com/nse4_fgt-7-2.html to help you easily pass the Fortinet NSE 4 – FortiOS 7.2 certification exam.

Share some of the latest NSE4_FGT-7.2 exam questions and answers for free

From	Number of exam questions	Type	Related
leads4pass NSE4_FGT-7.2 dumps	15	Free	NSE4_FGT-7.0 dumps

Question 1:

A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.

*

All traffic must be routed through the primary tunnel when both tunnels are up

*

The secondary tunnel must be used only if the primary tunnel goes down

*

In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover

Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

A.

Configure a high distance on the static route for the primary tunnel and a lower distance on the static route for the secondary tunnel.

B.

Enable Dead Peer Detection.

C.

Configure a lower distance on the static route for the primary tunnel and a higher distance on the static route for the secondary tunnel.

D.

Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

Correct Answer: BC

Explanation: Study Guide?IPsec VPN?IPsec configuration?Phase 1 Network.

When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.

There are three DPD modes. On-demand is the default mode.

Study Guide?IPsec VPN?Redundant VPNs.

Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.

Add at least one phase 2 definition for each phase 1.

Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.

Configure FW policies for each IPsec interface.

Question 2:

Refer to the exhibit showing a debug flow output.

Which two statements about the debug flow output are correct? (Choose two.)

A. The debug flow is of ICMP traffic.

B. A firewall policy allowed the connection.

C. A new traffic session is created.

D. The default route is required to receive a reply.

Correct Answer: AC

Reference: https://docs.fortinet.com/document/fortigate/6.2.3/cookbook/54688/debugging- the-packet-flow

Question 3:

Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

A. diagnose sys top

B. execute ping

C. execute traceroute

D. diagnose sniffer packet any

E. get system arp

Correct Answer: BCD

Question 4:

Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)

A. Firewall policy

B. Policy rule

C. Security policy

D. SSL inspection and authentication policy

Correct Answer: CD

Question 5:

FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax. Which two syntaxes are correct to configure web ratings for the home page? (Choose two.)

A. www.example.com:443

B. www.example.com

C. example.com

D. www.example.com/index.html

Correct Answer: BC

When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for hostnames – no URLs or wildcard characters are allowed.

OK: google.com or www.google.com

NO OK: www.google.com/index.html or google.*

FortiGate_Security_6.4 page 384

When using FortiGuard category filtering to allow or block access to a website, one option is to make a web rating override and define the website in a different category. Web ratings are only for hostnames– “no URLs or wildcard characters are allowed”.

Question 6:

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

A. Heartbeat interfaces have virtual IP addresses that are manually assigned.

B. A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.

C. Virtual IP addresses are used to distinguish between cluster members.

D. The primary device in the cluster is always assigned IP address 169.254.0.1.

Correct Answer: BD

https://kb.fortinet.com/kb/documentLink.do?externalID=FD37221

Question 7:

Refer to the exhibit.

Which contains a network diagram and routing table output.

The Student is unable to access Webserver.

What is the cause of the problem and what is the solution for the problem?

A. The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

B. The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 10.0.4.0/24 through wan1.

C. The first reply packet for Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port 3.

D. The first packet sent from Student failed the RPF check. This issue can be resolved by adding a static route to 203.0. 114.24/32 through port 3.

Correct Answer: D

Question 8:

By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers.

Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

A. set fortiguard-anycast disable

B. set web filter-force-off to disable

C. set web filter-cache to disable

D. set protocol tcp

Correct Answer: A

Explanation: y default, “fortiguard-anycast” is enabled, and this setting only works with “set protocol https”. To use udp (ie. “set protocol udp”), “fortiguard-anycast” must be disabled.

Reference: https://kb.fortinet.com/kb/documentLink .do?externalID=FD48294

“By default, FortiGate is configured to enforce the use of HTTPS port 443 to perform live filtering with FortiGuard or FortiManager. Other ports and protocols are available by disabling the FortiGuard anycast setting on the CLI.”

Question 9:

Refer to the exhibits.

The exhibits show the firewall policies and the objects used in the firewall policies.

The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?

A. Policy with ID 4.

B. Policy with ID 5.

C. Policies with IDs 2 and 3.

D. Policy with ID 4.

Correct Answer: B

Reference: https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/497952/policy- views-and-policy-lookup

Question 10:

Which three statements explain a flow-based antivirus profile? (Choose three.)

A. IPS engine handles the process as a standalone.

B. FortiGate buffers the whole file but transmits it to the client simultaneously.

C. If the virus is detected, the last packet is delivered to the client.

D. Optimized performance compared to proxy-based inspection.

E. Flow-based inspection uses a hybrid of scanning modes available in the proxy-based inspection.

Correct Answer: BDE

Reference: https://forum .fortinet.com/tm.aspx?m=192309

Question 11:

Which three methods are used by the collector agent for AD polling? (Choose three.)

A. FortiGate polling

B. NetAPI

C. Novell API

D. WMI

E. WinSecLog

Correct Answer: BDE

Question 12:

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

A. It limits the scanning of application traffic to the DNS protocol only.

B. It limits the scanning of application traffic to use parent signatures only.

C. It limits the scanning of application traffic to the browser-based technology category only.

D. It limits the scanning of application traffic to the application category only.

Correct Answer: D

https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/38324/ngfw-policy-based-mode

In policy-based mode on a next-generation firewall (NGFW), you can use a URL list and application control in the same firewall policy to control traffic to and from specific websites or applications. However, there is a limitation to consider when using these features together:

It limits the scanning of application traffic to the application category only: The URL list and application control both rely on the firewall to inspect traffic and make decisions about what to allow or block. However, the URL list is limited to inspecting traffic at the URL level, while the application control can inspect traffic at a deeper level, such as at the application layer. This means that the application control is more comprehensive and can provide more granular control over specific applications, while the URL list is limited to controlling traffic at the URL level.

Question 13:

Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)

A. Web filter in flow-based inspection

B. Antivirus in flow-based inspection

C. DNS filter

D. Web application firewall

E. Application control

Correct Answer: ABE

Explanation: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/739623/dns-filter-handled-by-ips-engine-in-flow-mode

Question 14:

An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)

A. The interface has been configured for a one-arm sniffer.

B. The interface is a member of a virtual wire pair.

C. The operation mode is transparent.

D. The interface is a member of a zone.

E. Captive portal is enabled in the interface.

Correct Answer: ABC

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new- 54/Top_VirtualWirePair.htm

Question 15:

Which three authentication timeout types are available for selection on FortiGate? (Choose three.)

A. hard-timeout

B. auth-on-demand

C. soft-timeout

D. new-session

E. Idle-timeout

Correct Answer: ADE

…

---

The latest NSE4_FGT-7.2 exam questions above are from leads4pass NSE4_FGT-7.2 dumps for free sharing, aiming to help you understand your real situation, and provide you with verification of authenticity and effectiveness!

Now, download Fortinet NSE 4 – FortiOS 7.2 exam materials: NSE4_FGT-7.2 dumps with PDF and VCE: https://www.leads4pass.com/nse4_fgt-7-2.html, to help you pass the exam 100% successfully.