Fortinet NSE4_FGT-7.0 問題集

質問 1：
Refer to the exhibits.


The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?
A. Change the idle-timeout.
B. Change the SSL VPN portal to the tunnel.
C. Change the Server IP address.
D. Change the SSL VPN port on the client.
正解：D

質問 2：
Which scanning technique on FortiGate can be enabled only on the CLI?
A. Antivirus scan
B. Trojan scan
C. Machine learning scan
D. Ransomware scan
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Examine the IPS sensor and DoS policy configuration shown in the exhibit, then answer the question below.

When detecting attacks, which anomaly, signature, or filter will FortiGate evaluate first?
A. Location: server Protocol: SMTP
B. IMAP.Login.brute.Force
C. SMTP.Login.Brute.Force
D. ip_src_session
正解：B

質問 4：
Refer to the exhibit.

The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http://www.fortinet.com? (Choose two.)
A. If a Microsoft Internet Explorer browser is used with User-B credentials, the HTTP request will be allowed.
B. If a Google Chrome browser is used with User-B credentials, the HTTP request will be allowed.
C. If a Mozilla Firefox browser is used with User-B credentials, the HTTP request will be allowed.
D. If a Mozilla Firefox browser is used with User-A credentials, the HTTP request will be allowed.
正解：A,B

質問 5：
A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service.
What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?
A. Dialup User
B. Static IP Address
C. Dynamic DNS
D. Pre-shared Key
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up. but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
A. On HQ-FortiGate, enable Auto-negotiate.
B. On Remote-FortiGate, set Seconds to 43200.
C. On HQ-FortiGate, enable Diffie-Hellman Group 2.
D. On HQ-FortiGate, set Encryption to AES256.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which two statements are correct about a software switch on FortiGate? (Choose two.)
A. All interfaces in the software switch share the same IP address
B. It can group only physical interfaces
C. Can act as a Layer 2 switch as well as a Layer 3 router
D. It can be configured only when FortiGate is operating in NAT mode
正解：A,D

質問 8：
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?
A. To remove the NAT operation.
B. To generate logs
C. To finish any inspection operations.
D. To allow for out-of-order packets that could arrive after the FIN/ACK packets.
正解：D

質問 9：
Refer to the exhibit.

Given the routing database shown in the exhibit, which two statements are correct? (Choose two.)
A. There will be eight routes active in the routing table.
B. The port1 and port2 default routes are active in the routing table.
C. The port3 default route has the highest distance.
D. The port3 default route has the lowest metric.
正解：B,C