最新的Fortinet NSE4_FGT-7.2免費考試真題

問題1

Which two statements are correct about NGFW Policy-based mode? (Choose two.)

A. NGFW policy-based mode does not require the use of central source NAT policy

B. NGFW policy-based mode can only be applied globally and not on individual VDOMs

C. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy

D. NGFW policy-based mode policies support only flow inspection

正確答案: C,D

問題2

Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

A. The sensor will reset all connections that match these signatures.

B. The sensor will block all attacks aimed at Windows servers.

C. The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

D. The sensor will gather a packet log for all matched traffic.

正確答案: B,C

問題3

Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

A. The host field in the HTTP header

B. The subject alternative name (SAN) field in the server certificate

C. The serial number in the server certificate

D. The subject field in the server certificate

E. The server name indication (SNI) extension in the client hello message

正確答案: B,D,E

說明：（僅 Fast2test 成員可見）

問題4

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

A. The issuer must be a public CA.

B. The CA extension must be set to TRUE.

C. The common name on the subject field must use a wildcard name.

D. The keyUsage extension must be set to keyCertSign.

正確答案: B,D

說明：（僅 Fast2test 成員可見）

問題5

Refer to the exhibit showing a debug flow output.

What two conclusions can you make from the debug flow output? (Choose two.)

A. The debug flow is for ICMP traffic.

B. Anew traffic session was created.

C. The default route is required to receive a reply.

D. A firewall policy allowed the connection.

正確答案: A,B

說明：（僅 Fast2test 成員可見）

問題6

Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

A. get system performance status

B. diagnose sys top

C. get system status

D. get system arp

正確答案: D

說明：（僅 Fast2test 成員可見）

問題7

Which of statement is true about SSL VPN web mode?

A. It assigns a virtual IP address to the client.

B. It supports a limited number of protocols.

C. The tunnel is up while the client is connected.

D. The external network application sends data through the VPN.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題8

View the exhibit.

Which of the following statements are correct? (Choose two.)

A. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used only if the TunnelB VPN is down.

B. This is a redundant IPsec setup.

C. This setup requires at least two firewall policies with the action set to IPsec.

D. Dead peer detection must be disabled to support this type of IPsec setup.

正確答案: A,B

說明：（僅 Fast2test 成員可見）

問題9

In an explicit proxy setup, where is the authentication method and database configured?

A. Authentication Rule

B. Firewall Policy

C. Authentication scheme

D. Proxy Policy

正確答案: C

問題10

Which of the following are purposes of NAT traversal in IPsec? (Choose two.)

A. To encapsulation ESP packets in UDP packets using port 4500.

B. To dynamically change phase 1 negotiation mode aggressive mode.

C. To detect intermediary NAT devices in the tunnel path.

D. To force a new DH exchange with each phase 2 rekey.

正確答案: A,C

最新的Fortinet NSE 4 - FortiOS 7.2 - NSE4_FGT-7.2免費考試真題

聯系我們

站內鏈接

最新更新