Fortinet NSE4_FGT-7.0 問題集

質問 1：
Examine the following web filtering log.

Which statement about the log message is true?
A. The name of the applied web filter profile is default.
B. The web site miniclip.com matches a static URL filter whose action is set to Warning.
C. The usage quota for the IP address 10.0.1.10 has expired
D. The action for the category Games is set to block.
正解：A

質問 2：
Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
A. Set the maximum session TTL value for the TELNET service object.
B. Create a new service object for TELNET and set the maximum session TTL.
C. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.
D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.
正解：B,D

質問 3：
Examine this PAC file configuration.

Which of the following statements are true? (Choose two.)
A. All requests not made to Fortinet.com or the 172.25.120.0/24 subnet, have to go through altproxy.corp.com: 8060.
B. Any web request fortinet.com is allowed to bypass the proxy.
C. Any web request to the 172.25.120.0/24 subnet is allowed to bypass the proxy.
D. Browsers can be configured to retrieve this PAC file from the FortiGate.
正解：B,D

質問 4：
Refer to the exhibits.


The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?
A. Change the idle-timeout.
B. Change the SSL VPN portal to the tunnel.
C. Change the Server IP address.
D. Change the SSL VPN port on the client.
正解：D

質問 5：
Refer to the exhibit.

The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster.
Which two statements are true? (Choose two.)
A. FortiGate devices are not in sync because one device is down.
B. FortiGate SN FGVM010000064692 has the higher HA priority.
C. FortiGate SN FGVM010000065036 HA uptime has been reset.
D. FortiGate SN FGVM010000064692 is the primary because of higher HA uptime.
正解：B,C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Refer to the exhibit.

The exhibit shows a CLI output of firewall policies, proxy policies, and proxy addresses.
How does FortiGate process the traffic sent to http://www.fortinet.com?
A. Traffic will be redirected to the transparent proxy and it will be denied by the proxy implicit deny policy.
B. Traffic will not be redirected to the transparent proxy and it will be allowed by firewall policy ID 1.
C. Traffic will be redirected to the transparent proxy and it will be allowed by proxy policy ID 3.
D. Traffic will be redirected to the transparent proxy and It will be allowed by proxy policy ID 1.
正解：A

質問 7：
View the exhibit.

A user behind the FortiGate is trying to go to http://www.addictinggames.com (Addicting Games). Based on this configuration, which statement is true?
A. Addcting.Games is allowed based on the Categories configuration.
B. Addicting.Games is allowed based on the Application Overrides configuration.
C. Addicting.Games can be allowed only if the Filter Overrides actions is set to Exempt.
D. Addicting.Games is blocked on the Filter Overrides configuration.
正解：B

質問 8：
Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)
A. Full Content inspection
B. Certificate inspection
C. Flow-based inspection
D. Proxy-based inspection
正解：C,D

質問 9：
Refer to the exhibit.

The exhibits show a network diagram and the explicit web proxy configuration.
In the command diagnose sniffer packet, what filter can you use to capture the traffic between the client and the explicit web proxy?
A. 'host 10.0.0.50 and port 80'
B. 'host 192.168.0.2 and port 8080'
C. 'host 10.0.0.50 and port 8080'
D. 'host 192.168.0.1 and port 80'
正解：B