Fortinet NSE 4 - FortiOS 7.0 Exam Questions

Here you have the best Fortinet NSE4_FGT-7.0 practice exam questions.

Some things you may want to keep in mind about this practice exam questions:

You have 106 total questions to study from
Each page has 5 questions, making a total of 22 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on September 17, 2024

Question 1 of 106

Which two statements about FortiGate FSSO agentless polling mode are true? (Choose two.)

A.

FortiGate uses the AD server as the collector agent.

B.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

C.

FortiGate does not support workstation check.

D.

FortiGate directs the collector agent to use a remote LDAP server.

Correct Answer: BC

In FortiGate FSSO agentless polling mode, FortiGate uses the SMB protocol to read the event viewer logs from the domain controllers (DCs), which confirms the first correct statement. Additionally, in this mode, FortiGate does not support workstation check, which means it cannot perform workstation-based verifications as it would in some other modes. Therefore, the correct statements are that FortiGate uses the SMB protocol to read the event viewer logs from the DCs and does not support workstation check.

Question 2 of 106

FortiGuard categories can be overridden and defined in different categories. To create a web rating override for example.com home page, the override must be configured using a specific syntax.

Which two syntaxes are correct to configure web rating override for the home page? (Choose two.)

A.

www.exaple.com

B.

www.example.com/index.html

C.

example.com

D.

www.example.com:443

Correct Answer: AC

To configure a web rating override for the home page using FortiGuard category filtering, only host names can be used without including URLs or port numbers. The correct syntaxes are 'www.example.com' and 'example.com'. This ensures the override is applied correctly at the host name level without any additional path or port, which would be invalid.

Question 3 of 106

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).

Exhibit A.

Exhibit B.

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

A.

The flow-based inspection is used, which resets the last packet to the user.

B.

The volume of traffic being inspected is too high for this model of FortiGate.

C.

The firewall policy performs the full content inspection on the file.

D.

The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

Correct Answer: A

The flow-based inspection mode being used resets the last packet to the user when a virus is detected, preventing the complete file from being received. If the infected file is requested again, a block replacement message would be sent immediately. This explains why the user does not receive a block replacement message on the first attempt.

Question 4 of 106

Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

A.

FortiSandbox

B.

FortiCloud

C.

FortiSIEM

D.

FortiCache

E.

FortiAnalyzer

Correct Answer: BCE

FortiGate supports several remote log storage options for efficient logging and monitoring. The three primary remote log storage options are FortiCloud, which provides cloud-based logging and analytics; FortiSIEM, which integrates security information and event management capabilities; and FortiAnalyzer, which offers advanced security analytics and log management. These options ensure that logs are stored externally, providing redundancy and better log management capabilities.

Question 5 of 106

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

A.

NetAPI polling can increase bandwidth usage in large networks.

B.

The NetSessionEnum function is used to track user logouts.

C.

The collector agent must search security event logs.

D.

The collector agent uses a Windows API to query DCs for user logins.

Correct Answer: D

NetAPI polling mode for the FSSO collector agent involves using a Windows API to query Domain Controllers (DCs) for user logins. The agent makes use of the NetSessionEnum function to identify users who have logged in by polling the sessions created on the DC. This approach allows the collection of login information without heavily relying on security event logs or excessively increasing bandwidth usage.