PDFを無料でダウンロードにはNSE4_FGT-7.0有効な練習テスト問題があります [Q95-Q112]

PDFを無料でダウンロードにはNSE4_FGT-7.0有効な練習テスト問題があります

NSE4_FGT-7.0テストエンジンお試しセット、NSE4_FGT-7.0問題集PDF

Fortinet NSE4_FGT-7.0（Fortinet NSE 4 - FortiOS 7.0）試験は、ネットワークプロフェッショナルの知識とスキルをテストする認定試験であり、Fortinetセキュリティソリューションの設定と管理に関するものです。この試験は、ネットワーク管理者、エンジニア、セキュリティアナリストなど、Fortinet FortiOS 7.0を使用する人々を対象にしています。この認定は、ネットワークセキュリティのスキルの検証として認識され、Fortinet製品を使用する組織にとって高く評価されています。

質問 # 95
An organization's employee needs to connect to the office through a high-latency internet connection.
Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?

A. Change the idle-timeout.
B. Change the login timeout.
C. Change the udp idle timer.
D. Change the session-ttl.

正解：B

質問 # 96
Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?

A. Web application firewall
B. Application control
C. Antivirus
D. Denial of Service

正解：A

解説：
Reference:
WAF is situated or facing internal servers such as Web Servers with purpose of protecting them from attacks such as XSS,SQL Inj, DOS,...

質問 # 97
Refer to the exhibit.

Which contains a Performance SLA configuration.
An administrator has configured a performance SLA on FortiGate. Which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?

A. You need to turn on the Enable probe packets switch.
B. There may not be a static route to route the performance SLA traffic.
C. Participants configured are not SD-WAN members.
D. The Ping protocol is not supported for the public servers that are configured.

正解：A

解説：
Reference:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performance-sla-linkmonitoring

質問 # 98
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration?
(Choose three.)

A. The policy table in the GUI can be filtered to display policies with IPv4, IPv6 or IPv4 and IPv6 sources and destinations.
B. The policy table in the GUI will be consolidated to display policies with IPv4 and IPv6 sources and destinations.
C. The IP version of the sources and destinations in a firewall policy must be different.
D. The Incoming Interface. Outgoing Interface. Schedule, and Service fields can be shared with both IPv4 and IPv6.
E. The IP version of the sources and destinations in a policy must match.

正解：B、D、E

質問 # 99
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?

A. Customer VDOM
B. FG-traffic VDOM
C. Global VDOM
D. Root VDOM

正解：D

質問 # 100
Refer to the exhibits.

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) tor Facebook.
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?

A. Additional application signatures are required to add to the security policy.
B. Force access to Facebook using the HTTP service.
C. Add Facebook in the URL category in the security policy.
D. The SSL inspection needs to be a deep content inspection.

正解：D

解説：
The lock logo behind Facebook_like.Button indicates that SSL Deep Inspection is Required.

質問 # 101
Which two statements are correct about SLA targets? (Choose two.)

A. You can configure only two SLA targets per one Performance SLA.
B. SLA targets are required for SD-WAN rules with a Best Quality strategy.
C. SLA targets are optional.
D. SLA targets are used only when referenced by an SD-WAN rule.

正解：C、D

解説：
Reference:
Fortigate Infrastructure 7.0 Study Guide P.81

質問 # 102
An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)

A. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy.
B. Create a new service object for HTTP service and set the session TTL to never
C. Set the session TTL on the HTTP policy to maximum
D. Set the TTL value to never under config system-ttl

正解：B、D

質問 # 103
An administrator has configured two-factor authentication to strengthen SSL VPN access. Which additional best practice can an administrator implement?

A. Configure Source IP Pools.
B. Configure split tunneling in tunnel mode.
C. Configure different SSL VPN realms.
D. Configure host check.

正解：D

質問 # 104
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?

A. System event logs
B. Local traffic logs
C. Forward traffic logs
D. Security logs

正解：B

解説：
Reference: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/476970

質問 # 105
Which two statements about antivirus scanning mode are true? (Choose two.)

A. In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.
B. In flow-based inspection mode, files bigger than the buffer size are scanned.
C. In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
D. In proxy-based inspection mode, files bigger than the buffer size are scanned.

正解：A、C

解説：
An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware regardless of file size, a firewall would need infinitely large RAM-something that no device has in the real world. Most viruses are very small. This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.

質問 # 106
Refer to the exhibits.

Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds. Based on the system performance output, which two statements are correct? (Choose two.)

A. FortiGate will start sending all files to FortiSandbox for inspection.
B. FortiGate has entered conserve mode.
C. Administrators cannot change the configuration.
D. Administrators can access FortiGate only through the console port.

正解：B、C

質問 # 107
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
* All traffic must be routed through the primary tunnel when both tunnels are up
* The secondary tunnel must be used only if the primary tunnel goes down
* In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two,)

A. Enable Dead Peer Detection.
B. Configure a high distance on the static route for the primary tunnel, and a lower distance on the static route for the secondary tunnel.
C. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
D. Enable Auto-negotiate and Autokey Keep Alive on the phase 2 configuration of both tunnels.

正解：A、C

解説：
B - because the customer requires the tunnels to notify when a tunnel goes down. DPD is designed for that purpose. To send a packet over a firewall to determine a failover for the next tunnel after a specific amount of time of not receiving a response from its peer.
C - remember when it comes to choosing a route with regards to Administrative Distance. The route with the lowest distance for that particular route will be chosen. So, by configuring a lower routing distance on the primary tunnel, means that the primary tunnel will be chosen to route packets towards their destination.

質問 # 108
Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?

A. It is allowed, but with no inspection
B. It is dropped.
C. It is allowed and inspected, as long as the only inspection required is antivirus.
D. It is allowed and inspected as long as the inspection is flow based

正解：B

質問 # 109
Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

A. Enable two-factor authentication
B. Enable restrict access to trusted hosts
C. Change Administrator profile
D. Change password

正解：C

質問 # 110
Which statement about the IP authentication header (AH) used by IPsec is true?

A. AH provides data integrity bur no encryption.
B. AH does not support perfect forward secrecy.
C. AH provides strong data integrity but weak encryption.
D. AH does not provide any data integrity or encryption.

正解：A

質問 # 111
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)