Fortinet NSE4_FGT-7.2 Fortinet NSE 4 – FortiOS 7.2 Online Training
Fortinet NSE4_FGT-7.2 Online Training
The questions for NSE4_FGT-7.2 were last updated at Apr 25,2024.
- Exam Code: NSE4_FGT-7.2
- Exam Name: Fortinet NSE 4 - FortiOS 7.2
- Certification Provider: Fortinet
- Latest update: Apr 25,2024
Refer to the exhibit.
Based on the raw log, which two statements are correct? (Choose two.)
- A . Traffic is blocked because Action is set to DENY in the firewall policy.
- B . Traffic belongs to the root VDOM.
- C . This is a security log.
- D . Log severity is set to error on FortiGate.
Which statements best describe auto discovery VPN (ADVPN). (Choose two.)
- A . It requires the use of dynamic routing protocols so that spokes can learn the routes to other spokes.
- B . ADVPN is only supported with IKEv2.
- C . Tunnels are negotiated dynamically between spokes.
- D . Every spoke requires a static tunnel to be configured to other spokes so that phase 1 and phase 2 proposals are defined in advance.
Refer to the exhibit.
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
- A . FortiGate SN FGVM010000065036 HA uptime has been reset.
- B . FortiGate devices are not in sync because one device is down.
- C . FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
- D . FortiGate SN FGVM010000064692 has the higher HA priority.
Refer to the exhibit.
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
- A . FortiGate SN FGVM010000065036 HA uptime has been reset.
- B . FortiGate devices are not in sync because one device is down.
- C . FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
- D . FortiGate SN FGVM010000064692 has the higher HA priority.
Refer to the exhibit.
The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
- A . FortiGate SN FGVM010000065036 HA uptime has been reset.
- B . FortiGate devices are not in sync because one device is down.
- C . FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
- D . FortiGate SN FGVM010000064692 has the higher HA priority.
Refer to the exhibit.
Examine the intrusion prevention system (IPS) diagnostic command.
Which statement is correct If option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
- A . The IPS engine was inspecting high volume of traffic.
- B . The IPS engine was unable to prevent an intrusion attack .
- C . The IPS engine was blocking all traffic.
- D . The IPS engine will continue to run in a normal state.
Refer to the exhibit.
The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10 .0.1.254. /24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?
- A . 10.200.1.1
- B . 10.200.3.1
- C . 10.200.1.100
- D . 10.200.1.10
In which two ways can RPF checking be disabled? (Choose two )
- A . Enable anti-replay in firewall policy.
- B . Disable the RPF check at the FortiGate interface level for the source check
- C . Enable asymmetric routing.
- D . Disable strict-arc-check under system settings.
Refer to the exhibit.
An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic.
Why is FortiGate not sending probes to 4.2.2.2 and 4.2.2.1 servers? (Choose two.)
- A . The Detection Mode setting is not set to Passive.
- B . Administrator didn’t configure a gateway for the SD-WAN members, or configured gateway is not valid.
- C . The configured participants are not SD-WAN members.
- D . The Enable probe packets setting is not enabled.
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
- A . The keyUsage extension must be set to keyCertSign.
- B . The common name on the subject field must use a wildcard name.
- C . The issuer must be a public CA.
- D . The CA extension must be set to TRUE.
Latest NSE4_FGT-7.2 Dumps Valid Version with 154 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
