Question 1

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Accepted Answer

When a packet arrives, how does FortiGate find a matching policy? Each policy has match criteria, which you can define using the following objects:
• Incoming Interface
• Outgoing Interface
• Source: IP address, user, internet services
• Destination: IP address or internet services
• Service: IP protocol and port number
• Schedule: Applies during configured times

Question 2

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning
errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?

Accepted Answer

FortiGate Security 7.2 Study Guide (p.235): "If FortiGate receives a trusted SSL certificate, then it generates a temporary certificate signed by the built-in
Fortinet_CA_SSL certificate and sends it to the browser. If the browser trusts the Fortinet_CA_SSL certificate, the browser completes the SSL handshake.
Otherwise, the browser also presents a warning message informing the user that the site is untrusted. In other words, for this function to work as intended, you
must import the Fortinet_CA_SSL certificate into the trusted root CA certificate store of your browser."

Question 3

Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase
2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, which configuration change will bring phase 2 up?

Accepted Answer

Correct answer: B

Question 4

What are two functions of the ZTNA rule? (Choose two.)

Accepted Answer

A ZTNA rule is a policy that enforces access control and applies security profiles to protect traffic between the client and the access proxy1. A ZTNA rule defines
the following parameters1:
 Incoming interface: The interface that receives the client request.
 Source: The address and user group of the client.
 ZTNA tag: The tag that identifies the domain that the client belongs to.
 ZTNA server: The server that hosts the access proxy.
 Destination: The address of the application that the client wants to access.
 Action: The action to take for the traffic that matches the rule. It can be accept, deny, or redirect.
 Security profiles: The security features to apply to the traffic, such as antivirus, web filter, application control, and so on.
A ZTNA rule does not redirect the client request to the access proxy. That is the function of a policy route that matches the ZTNA tag and sends the traffic to the
ZTNA server2.
A ZTNA rule does not define the access proxy. That is done by creating a ZTNA server object that specifies the IP address, port, and certificate of the access
proxy3.
FortiGate Infrastructure 7.2 Study Guide (p.177): "A ZTNA rule is a proxy policy used to enforce access control. You can define ZTNA tags or tag groups to enforce
zero-trust role-based access. To create a rule, type a rule name, and add IP addresses and ZTNA tags or tag groups that are allowed or blocked access. You also
select the ZTNA server as the destination. You can also apply security profiles to protect this traffic."

Question 5

Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)

Accepted Answer

Correct answer: BCD

Question 6

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

Accepted Answer

"In order for FortiGate to act in these roles, its CA certificate must have the basic constraints extension set to cA=True and the value of the keyUsage extension set
to keyCertSign."

Question 7

Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services.
Which CLI command must the administrator use to view the route?

Accepted Answer

/NSE4_FGT-7.0-exam/ (172 Q&As)
ISDB static route will not create entry directly in routing-table. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-forPredefined-Internet/ta-p/1
and here
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Verify-the-matching-policy-route/ta-p/190640
FortiGate Infrastructure 7.2 Study Guide (p.16 and p.59): "Even though they are configured as static routes, ISDB routes are actually policy routes and take
precedence over any other routes in the routing table. As such, ISDB routes are added to the policy routing table." "FortiOS maintains a policy route table that you
can view by running the diagnose firewall proute list command."

Question 8

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 fails to come up. The
administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes will bring phase 1 up? (Choose two.)

Accepted Answer

"In IKEv1, there are two possible modes in which the IKE SA negotiation can take place: main, and aggressive mode. Settings on both ends must agree;
otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel."

Question 9

Which two types of traffic are managed only by the management VDOM? (Choose two.)

Accepted Answer

Correct answer: AD

Question 10

The IPS engine is used by which three security features? (Choose three.)

Accepted Answer

FortiGate Security 7.2 Study Guide (p.385): "The IPS engine is responsible for most of the features shown in this lesson: IPS and protocol decoders. It’s also
responsible for application control, flow-based antivirus protection, web filtering, and email filtering."