NSE4_FGT-7.0 Free Practice Test

- (Exam Topic 2)
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

1. A. It limits the scope of application control to the browser-based technology category only.
2. B. It limits the scope of application control to scan application traffic based on application category only.
3. C. It limits the scope of application control to scan application traffic using parent signatures only
4. D. It limits the scope of application control to scan application traffic on DNS protocol only.

Correct Answer: B

- (Exam Topic 1)
Which two statements are correct about NGFW Policy-based mode? (Choose two.)

1. A. NGFW policy-based mode does not require the use of central source NAT policy
2. B. NGFW policy-based mode can only be applied globally and not on individual VDOMs
3. C. NGFW policy-based mode supports creating applications and web filtering categories directly in a firewall policy
4. D. NGFW policy-based mode policies support only flow inspection

Correct Answer: CD

- (Exam Topic 2)
What is the primary FortiGate election process when the HA override setting is disabled?

1. A. Connected monitored ports > System uptime > Priority > FortiGate Serial number
2. B. Connected monitored ports > HA uptime > Priority > FortiGate Serial number
3. C. Connected monitored ports > Priority > HA uptime > FortiGate Serial number
4. D. Connected monitored ports > Priority > System uptime > FortiGate Serial number

Correct Answer: B
Reference: http://myitmicroblog.blogspot.com/2018/11/what-should-you-know-about-ha-override.html

- (Exam Topic 1)
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

1. A. FortiCache
2. B. FortiSIEM
3. C. FortiAnalyzer
4. D. FortiSandbox
5. E. FortiCloud

Correct Answer: BCE
Reference:
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/265052/logging-and-reporting-overview

- (Exam Topic 2)
Examine this output from a debug flow:

Why did the FortiGate drop the packet?

1. A. The next-hop IP address is unreachable.
2. B. It failed the RPF check.
3. C. It matched an explicitly configured firewall policy with the action DENY.
4. D. It matched the default implicit firewall policy.

Correct Answer: D
https://kb.fortinet.com/kb/documentLink.do?externalID=13900