Free Fortinet NSE 4 – FortiOS 7.0 Exam NSE4_FGT-7.0 Exam Practice Test

The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.What order must FortiGate use when the web filter profile has features enabled, such as safe search?

• DNS-based web filter and proxy-based web filter
  
• Static URL filter, FortiGuard category filter, and advanced filters
  
• Static domain filter, SSL inspection filter, and external connectors filters
  
• FortiGuard category filter and rating filter
  

Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

• The security actions applied on the web applications will also be explicitly applied on the third-party websites.
  
• The application signature database inspects traffic only from the original web application server.
  
• FortiGuard maintains only one signature of each web application that is unique.
  
• FortiGate can inspect sub-application traffic regardless where it was originated.
  

Which two statements ate true about the Security Fabric rating? (Choose two.)

• It provides executive summaries of the four largest areas of security focus.
  
• Many of the security issues can be fixed immediately by clicking Apply where available.
  
• The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
  
• The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
  

Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)

• Proxy-based inspection
  
• Certificate inspection
  
• Flow-based inspection
  
• Full Content inspection
  

Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?

• By default, FortiGate uses WINS servers to resolve names.
  
• By default, the SSL VPN portal requires the installation of a client's certificate.
  
• By default, split tunneling is enabled.
  
• By default, the admin GUI and SSL VPN portal use the same HTTPS port.
  

An administrator wants to configure timeouts for users. Regardless of the users behavior, the timer should start as soon as the user authenticates and expire after the configured value.Which timeout option should be configured on FortiGate?

• auth-on-demand
  
• soft-timeout
  
• idle-timeout
  
• new-session
  
• hard-timeout
  

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.Which DPD mode on FortiGate will meet the above requirement?

• Disabled
  
• On Demand
  
• Enabled
  
• On Idle
  

In which two ways can RPF checking be disabled? (Choose two )

• Enable anti-replay in firewall policy.
  
• Disable the RPF check at the FortiGate interface level for the source check
  
• Enable asymmetric routing.
  
• Disable strict-arc-check under system settings.
  

Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)

• Heartbeat interfaces have virtual IP addresses that are manually assigned.
  
• A change in the virtual IP address happens when a FortiGate device joins or leaves the cluster.
  
• Virtual IP addresses are used to distinguish between cluster members.
  
• The primary device in the cluster is always assigned IP address 169.254.0.1.
  

A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?

• Implement a web filter category override for the specified website
  
• Implement a DNS filter for the specified website.
  
• Implement web filter quotas for the specified website
  
• Implement web filter authentication for the specified website.