Exam Questions NSE4_FGT-7.0 Fortinet NSE 4 - FortiOS 7.0

An administrator wants to configure timeouts for users. Regardless of the user€™s behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should be configured on FortiGate?

• auth-on-demand

• soft-timeout

• idle-timeout

• new-session

• hard-timeout

Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

• FortiCache

• FortiSIEM

• FortiAnalyzer

• FortiSandbox

• FortiCloud

Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

• System time

• FortiGuaid update servers

• Operating mode

• NGFW mode

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

• The signature setting uses a custom rating threshold.

• The signature setting includes a group of other signatures.

• Traffic matching the signature will be allowed and logged.

• Traffic matching the signature will be silently dropped and logged

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

• The collector agent uses a Windows API to query DCs for user logins.

• NetAPI polling can increase bandwidth usage in large networks.

• The collector agent must search security event logs.

• The NetSession Enum function is used to track user logouts

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel. Which DPD mode on FortiGate will meet the above requirement?

• Disabled

• On Demand

• Enabled

• On Idle

An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic. Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)

• The Detection Mode setting is not set to Passive.

• Administrator didn't configure a gateway for the SD-WAN members, or configured gateway is not valid.

• The configured participants are not SD-WAN members.

• The Enable probe packets setting is not enabled.

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

• The strict RPF check is run on the first sent and reply packet of any new session.

• Strict RPF checks the best route back to the source using the incoming interface

• Strict RPF checks only for the existence of at cast one active route back to the source using the incoming interface.

• Strict RPF allows packets back to sources with all active routes

The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?

• Change password

• Enable restrict access to trusted hosts

• Change Administrator profile

• Enable two-factor authentication

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

• Antivirus engine

• Intrusion prevention system engine

• Flow engine

• Detection engine