合格させる試験完全版NSE4_FGT-7.2問題集152解答
検証済みNSE4_FGT-7.2問題集と解答100%合格はここ
FortinetのNSE4_FGT-7.2試験は、Fortinetによって提供される認定試験であり、FortiOS 7.2を使用したFortinetセキュリティソリューションの展開と管理におけるネットワークセキュリティプロフェッショナルの知識とスキルをテストするために設計されています。この認定は、Fortinet製品を使用してセキュリティソリューションを設計、実装、管理する責任があるネットワーク管理者、セキュリティ管理者、およびその他のITプロフェッショナルを対象としています。
試験時間は60分で、受験者は35問の多肢選択問題に回答する必要があります。合格点は60%で、英語、中国語、日本語、スペイン語など複数の言語で試験が提供されています。Fortinet は、オンラインコース、ウェビナー、ワークショップなど、受験者が試験に備えるための様々なトレーニングリソースを提供しています。
Fortinet NSE4_FGT-7.2の試験は、Fortinetのセキュリティソリューションに関連する様々なトピックをカバーしています。試験でカバーされるトピックのいくつかには、Fortinet Security Fabric コンポーネント、ネットワークセキュリティポリシー、ファイアウォールポリシー、VPN、SSLインスペクション、およびwebフィルタリングが含まれます。試験は、セキュリティプロファイル、高度な脅威保護、および高可用性などの高度なトピックもカバーしています。
質問 # 50
Which two statements ate true about the Security Fabric rating? (Choose two.)
- A. Many of the security issues can be fixed immediately by clicking Apply where available.
- B. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
- C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
- D. It provides executive summaries of the four largest areas of security focus.
正解：A、C
質問 # 51
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
- A. Uninterruptable upgrade is enabled by default.
- B. Only secondary FortiGate devices are rebooted.
- C. Traffic load balancing is temporally disabled while upgrading the firmware.
- D. The firmware image must be manually uploaded to each FortiGate.
正解：A、C
質問 # 52
An administrator is configuring an Ipsec between site A and siteB. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192. 16. 1.0/24 and the remote quick mode selector is 192. 16.2.0/24. How must the administrator configure the local quick mode selector for site B?
- A. 192. 168.2.0/24
- B. 192. 168.3.0/24
- C. 192. 168.0.0/8
- D. 192. 168. 1.0/24
正解：A
質問 # 53
Which three security features require the intrusion prevention system (IPS) engine to function? (Choose three.)
- A. Application control
- B. Antivirus in flow-based inspection
- C. DNS filter
- D. Web filter in flow-based inspection
- E. Web application firewall
正解：A、B、D
解説：
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/739623/dns-filter-handled-by-ips-engine-in-flow-mode
質問 # 54
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
- A. To force a new DH exchange with each phase 2 rekey.
- B. To dynamically change phase 1 negotiation mode aggressive mode.
- C. To detect intermediary NAT devices in the tunnel path.
- D. To encapsulation ESP packets in UDP packets using port 4500.
正解：C、D
質問 # 55
When configuring a firewall virtual wire pair policy, which following statement is true?
- A. Any number of virtual wire pairs can be included, as long as the policy traffic direction is the same.
- B. Any number of virtual wire pairs can be included in each policy, regardless of the policy traffic direction settings.
- C. Only a single virtual wire pair can be included in each policy.
- D. Exactly two virtual wire pairs need to be included in each policy.
正解：A
質問 # 56
Why does FortiGate keep TCP sessions in the session table for some seconds even after both sides (client and server) have terminated the session?
- A. To generate logs
- B. To allow for out-of-order packets that could arrive after the FIN/ACK packets.
- C. To remove the NAT operation.
- D. To finish any inspection operations.
正解：B
質問 # 57
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile. What order must FortiGate use when the web filter profile has features enabled, such as safe search?
- A. DNS-based web filter and proxy-based web filter
- B. Static URL filter, FortiGuard category filter, and advanced filters
- C. Static domain filter, SSL inspection filter, and external connectors filters
- D. FortiGuard category filter and rating filter
正解：B
質問 # 58
Refer to the exhibit.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.
What is the impact of using the Include in every user group option in a RADIUS configuration?
- A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
- B. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
- C. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- D. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
正解：A
質問 # 59
An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?
- A. Search option will be disabled
- B. By Sequence view will be disabled.
- C. Policy lookup will be disabled.
- D. Interface Pair view will be disabled.
正解：D
解説：
https://kb.fortinet.com/kb/documentLink.do?externalID=FD47821
質問 # 60
Which two statements are correct about SLA targets? (Choose two.)
- A. SLA targets are optional.
- B. SLA targets are used only when referenced by an SD-WAN rule.
- C. SLA targets are required for SD-WAN rules with a Best Quality strategy.
- D. You can configure only two SLA targets per one Performance SLA.
正解：A、B
質問 # 61
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?
- A. Once Internet Service is selected, no other object can be added
- B. User or User Group
- C. IP address
- D. FQDN address
正解：A
解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.5/cookbook/179236/using-internet-service-in-policy
質問 # 62
Which two actions can you perform only from the root FortiGate in a Security Fabric? (Choose two.)
- A. Disable FortiAnalyzer logging for a downstream FortiGate device.
- B. Shut down/reboot a downstream FortiGate device.
- C. Log in to a downstream FortiSwitch device.
- D. Ban or unban compromised hosts.
正解：A、B
質問 # 63
Which of the following SD-WAN load balancing method use interface weight value to distribute traffic? (Choose two.)
- A. Volume
- B. Session
- C. Spillover
- D. Source IP
正解：A、B
解説：
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/49719/configuring-sd-wan-load-balancing
質問 # 64
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)
- A. Security policy
- B. SSL inspection and authentication policy
正解：A、B
質問 # 65
Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)
- A. NGFW mode
- B. System time
- C. Operating mode
- D. FortiGuaid update servers
正解：A、C
解説：
C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.
D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection-mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide
質問 # 66
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)
- A. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
- B. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.
- C. Enable Dead Peer Detection.
- D. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
正解：A、C
解説：
Study Guide - IPsec VPN - IPsec configuration - Phase 1 Network.
When Dead Peer Detection (DPD) is enabled, DPD probes are sent to detect a failed tunnel and bring it down before its IPsec SAs expire. This failure detection mechanism is very useful when you have redundant paths to the same destination, and you want to failover to a backup connection when the primary connection fails to keep the connectivity between the sites up.
There are three DPD modes. On demand is the default mode.
Study Guide - IPsec VPN - Redundant VPNs.
Add one phase 1 configuration for each tunnel. DPD should be enabled on both ends.
Add at least one phase 2 definition for each phase 1.
Add one static route for each path. Use distance or priority to select primary routes over backup routes (routes for the primary VPN must have a lower distance or lower priority than the backup). Alternatively, use dynamic routing.
Configure FW policies for each IPsec interface.
質問 # 67
......
NSE4_FGT-7.2問題集完全版解答で試験学習ガイド：https://jp.fast2test.com/NSE4_FGT-7.2-premium-file.html
100%NSE4_FGT-7.2試験一発合格保証2023問題集：https://drive.google.com/open?id=1sykZ8Vr6kayOctfL0PRhVs75KcZIh1ZZ