Fortinet NSE4_FGT-7.2 問題集

質問 1：
Which two statements describe how the RPF check is used? (Choose two.)
A. The RPF check is run on the first sent packet of any new session.
B. The RPF check is run on the first sent and reply packet of any new session.
C. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks.
D. The RPF check is run on the first reply packet of any new session.
正解：A,C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibits.
Exhibit A

Exhibit B

The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration.
How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
A. If there is a fall-through policy in place, users will not be prompted for authentication.
B. Authentication is enforced at a policy level; all users will be prompted for authentication.
C. All users will be prompted for authentication, users from the Sales group can authenticate successfully with the correct credentials.
D. All users will be prompted for authentication, users from the HR group can authenticate successfully with the correct credentials.
正解：D

質問 3：
Which of statement is true about SSL VPN web mode?
A. It assigns a virtual IP address to the client.
B. The tunnel is up while the client is connected.
C. The external network application sends data through the VPN.
D. It supports a limited number of protocols.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which two features of IPsec IKEv1 authentication are supported by FortiGate? (Choose two.)
A. Extended authentication (XAuth) for faster authentication because fewer packets are exchanged
B. Extended authentication (XAuth) to request the remote peer to provide a username and password
C. Pre-shared key and certificate signature as authentication methods
D. No certificate is required on the remote peer when you set the certificate signature as the authentication method
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.

Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?
A. On HQ-FortiGate, enable Auto-negotiate.
B. On Remote-FortiGate, set Seconds to 43200.
C. On HQ-FortiGate, enable Diffie-Hellman Group 2.
D. On HQ-FortiGate, set Encryption to AES256.
正解：D

質問 6：
Refer to the exhibit.

The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0. 1. 10?
A. 10.200. 1. 1
B. 10.200. 1. 10
C. 10.200. 1. 100
D. 10.200.3. 1
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
In an explicit proxy setup, where is the authentication method and database configured?
A. Authentication scheme
B. Authentication Rule
C. Firewall Policy
D. Proxy Policy
正解：A