NSE4_FGT-7.2 Free Practice Test

Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

1. A. The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.
2. B. The sensor will block all attacks aimed at Windows servers.
3. C. The sensor will reset all connections that match these signatures.
4. D. The sensor will gather a packet log for all matched traffic.

Correct Answer: AB

By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers. Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?

1. A. set fortiguard-anycast disable
2. B. set webfilter-force-off disable
3. C. set webfilter-cache disable
4. D. set protocol tcp

Correct Answer: A
y default, "fortiguard-anycast" is enabled, and this setting only works with "set protocol https". To use udp (ie. "set protocol udp"), "fortiguard-anycast" must be disabled.

Which two statements explain antivirus scanning modes? (Choose two.)

1. A. In proxy-based inspection mode, files bigger than the buffer size are scanned.
2. B. In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client.
3. C. In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client.
4. D. In flow-based inspection mode, files bigger than the buffer size are scanned.

Correct Answer: BC
An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware regardless of file size, a firewall would need infinitely large RAM--something that no device has in the real world. Most viruses are very small. This table shows a typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.
FortiGate Security 7.2 Study Guide (p.350 & 352): "In flow-based inspection mode, the IPS engine reads the payload of each packet, caches a local copy, and forwards the packet to the receiver at the same time. Because the file is ransmitted simultaneously, flow-based mode consumes more CPU cycles than proxy-based." "Each protocol’s proxy picks up a connection and buffers the entire file first (or waits until the oversize limit is reached) before scanning. The client must wait for the scanning to finish."

FortiGate is operating in NAT mode and is configured with two virtual LAN (VLAN) subinterfaces added to the same physical interface.
In this scenario, which statement about VLAN IDs is true?

1. A. The two VLAN subinterfaces can have the same VLAN ID only if they belong to different VDOMs.
2. B. The two VLAN subinterfaces must have different VLAN IDs.
3. C. The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in the same subnet.
4. D. The two VLAN subinterfaces can have the same VLAN ID only if they have IP addresses in different subnets.

Correct Answer: CD

Refer to the exhibit.

The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode.
The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem .
With this configuration, which statement is true?

1. A. Inter-VDOM links are required to allow traffic between the Local and Root VDOMs.
2. B. A static route is required on the To_Internet VDOM to allow LAN users to access the internet.
3. C. Inter-VDOM links are required to allow traffic between the Local and DMZ VDOMs.
4. D. Inter-VDOM links are not required between the Root and To_Internet VDOMs because the Root VDOM is used only as a management VDOM.

Correct Answer: A