Fortinet NSE4_FGT-7.0 問題集

質問 1：
A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not.
Which two configuration changes are the most effective way to support this requirement? (Choose two.)
A. Implement web category authentication for the specified website using a web filter profile.
B. Implement a firewall policy with authentication for the specified users.
C. Implement a DNS filter for the specified website.
D. Implement web filter quotas for the specified website.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibits.


The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?
A. Change the idle-timeout.
B. Change the SSL VPN portal to the tunnel.
C. Change the Server IP address.
D. Change the SSL VPN port on the client.
正解：D

質問 3：
Refer to the exhibit, which contains a radius server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator selected the Include in every user group option.
What will be the impact of using Include in every user group option in a RADIUS configuration?
A. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
B. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
C. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
D. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
正解：C

質問 4：
Examine this FortiGate configuration:

Examine the output of the following debug command:

Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?
A. It is dropped.
B. It is allowed and inspected as long as the inspection is flow based
C. It is allowed and inspected, as long as the only inspection required is antivirus.
D. It is allowed, but with no inspection
正解：A

質問 5：
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source filed of a firewall policy?
A. IP address
B. User or User Group
C. FQDN address
D. Once Internet Service is selected, no other object can be added
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which two statements ate true about the Security Fabric rating? (Choose two.)
A. Many of the security issues can be fixed immediately by clicking Apply where available.
B. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric.
C. The Security Fabric rating is a free service that comes bundled with alt FortiGate devices.
D. It provides executive summaries of the four largest areas of security focus.
正解：A,B

質問 7：
Refer to the exhibit.



The exhibit contains a network diagram, firewall policies, and a firewall address object configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-user2. Remote-user2 is still able to access Webserver.
Which two changes can the administrator make to deny Webserver access for Remote-User2? (Choose two.)
A. Enable match vip in the Deny policy.
B. Set the Destination address as Web_server in the Deny policy.
C. Disable match-vip in the Deny policy.
D. Set the Destination address as Deny_IP in the Allow-access policy.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 8：
Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)
A. FortiGate supports pre-shared key and signature as authentication methods.
B. A certificate is not required on the remote peer when you set the signature as the authentication method.
C. Enabling XAuth results in a faster authentication because fewer packets are exchanged.
D. For a stronger authentication, you can also enable extended authentication (XAuth) to request the remote peer to provide a username and password
正解：A,D

質問 9：
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
A. By default, the SSL VPN portal requires the installation of a client's certificate.
B. By default, the admin GUI and SSL VPN portal use the same HTTPS port.
C. By default, FortiGate uses WINS servers to resolve names.
D. By default, split tunneling is enabled.
正解：B