Fortinet NSE4_FGT-7.2 問題集

質問 1：
Refer to the exhibits.
The exhibits show a network diagram and firewall configurations.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2. Remote-User1 must be able to access the Webserver. Remote-User2 must not be able to access the Webserver.


In this scenario, which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
A. Enable match vip in the Deny policy.
B. Set the Destination address as Web_server in the Deny policy.
C. Disable match-vip in the Deny policy.
D. Set the Destination address as Deny_IP in the Allow-access policy.
正解：A,D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibit.
The exhibit shows a diagram of a FortiGate device connected to the network and the firewall policy and IP pool configuration on the FortiGate device.

Which two actions does FortiGate take on internet traffic sourced from the subscribers? (Choose two.)
A. FortiGate allocates 128 port blocks per user.
B. FortiGate generates a system event log for every port block allocation made per user.
C. FortiGate allocates port blocks per user, based on the configured range of internal IP addresses.
D. FortiGate allocates port blocks on a first-come, first-served basis.
正解：B,D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Refer to the exhibits.
The exhibits show the firewall policies and the objects used in the firewall policies.
The administrator is using the Policy Lookup feature and has entered the search criteria shown in the exhibit.

Which policy will be highlighted, based on the input criteria?
A. Policy with ID 4.
B. Policies with ID 2 and 3.
C. Policy with ID 5.
D. Policy with ID 4.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
A. It limits the scanning of application traffic to the browser-based technology category only.
B. It limits the scanning of application traffic to the DNS protocol only.
C. It limits the scanning of application traffic to the application category only.
D. It limits the scanning of application traffic to use parent signatures only.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
A. The subject alternative name (SAN) field in the server certificate
B. The serial number in the server certificate
C. The host field in the HTTP header
D. The server name indication (SNI) extension in the client hello message
E. The subject field in the server certificate
正解：A,D,E
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Refer to the exhibit.

In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
What should the administrator do next to troubleshoot the problem?
A. Capture the traffic using an external sniffer connected to port1.
B. Run a sniffer on the web server.
C. Execute a debug flow.
D. Execute another sniffer in the FortiGate, this time with the filter host 10.0.1.10€
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)
A. Log backups from the CLI cannot be restored to another FortiGate.
B. Log backups from the CLI can be configured to upload to FTP as a scheduled time
C. Log downloads from the GUI are stored as LZ4 compressed files.
D. Log downloads from the GUI are limited to the current filter view
正解：A,D