NSE4_FGT-7.2 Free Practice Test

An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?

1. A. The administrator can register the same FortiToken on more than one FortiGate.
2. B. The administrator must use a FortiAuthenticator device
3. C. The administrator can use a third-party radius OTP server.
4. D. The administrator must use the user self-registration server.

Correct Answer: B

Examine the exhibit, which contains a virtual IP and firewall policy configuration.


The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

1. A. 10.200. 1. 10
2. B. Any available IP address in the WAN (port1) subnet 10.200. 1.0/24 66 of 108
3. C. 10.200. 1. 1
4. D. 10.0. 1.254

Correct Answer: A
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall Objects/Virtual IPs.

Refer to the exhibit.


The exhibit contains the configuration for an SD-WAN Performance SLA, as well as the output of diagnose sys virtual-wan-link health-check . Which interface will be selected as an outgoing interface?

1. A. port2
2. B. port4
3. C. port3
4. D. port1

Correct Answer: D
Port 1 shows the lowest latency.

An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?

1. A. The strict RPF check is run on the first sent and reply packet of any new session.
2. B. Strict RPF checks the best route back to the source using the incoming interface.
3. C. Strict RPF checks only for the existence of at least one active route back to the source using the incoming interface.
4. D. Strict RPF allows packets back to sources with all active routes.

Correct Answer: B
Strict Reverse Path Forwarding (RPF) is a security feature that is used to detect and prevent IP spoofing attacks on a network. It works by checking the routing information for incoming packets to ensure that they are coming from the source address that is indicated in the packet's header. In strict RPF mode, the firewall will check the best route back to the source of the incoming packet using the incoming interface. If the packet's source address does not match the route back to the source, the packet is dropped. This helps to prevent attackers from spoofing their IP address and attempting to access the network.

Which of the following are valid actions for FortiGuard category based filter in a web filter profile ui proxy-based inspection mode? (Choose two.)

1. A. Warning
2. B. Exempt
3. C. Allow
4. D. Learn

Correct Answer: AC