Fortinet NSE 4 - FortiOS 7.2 (C_HRHFC_2311) Free Practice Test

Question 1

Refer to the exhibit.

Based on the administrator profile settings, what permissions must the administrator set to run the diagnose firewall auth list CLI command on FortiGate?

A. CLI diagnostics commands permission

B. Read/Write permission for Firewall

C. Read/Write permission for Log & Report

D. Custom permission for Network

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

A. SMMIE Capabilities value

B. Subject value

C. Subject Key Identifier value

D. Subject Alternative Name value

Correct Answer: C

Question 3

Consider the topology:
Application on a Windows machine <--{SSL VPN} -->FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)

A. Set the maximum session TTL value for the TELNET service object.

B. Create a new service object for TELNET and set the maximum session TTL.

C. Set the session TTL on the SSLVPN policy to maximum, so the idle session timeout will not happen after 90 minutes.

D. Create a new firewall policy and place it above the existing SSLVPN policy for the SSL VPN traffic, and set the new TELNET service object in the policy.

Correct Answer: B,D

Question 4

In an explicit proxy setup, where is the authentication method and database configured?

A. Proxy Policy

B. Firewall Policy

C. Authentication scheme

D. Authentication Rule

Correct Answer: C

Question 5

How does FortiGate act when using SSL VPN in web mode?

A. FortiGate acts as an HTTP reverse proxy.

B. FortiGate acts as an FDS server.

C. FortiGate acts as DNS server.

D. FortiGate acts as router.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)

A. FortiCloud

B. FortiSIEM

C. FortiSandbox

D. FortiAnalyzer

E. FortiCache

Correct Answer: A,B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Which statement describes a characteristic of automation stitches?

A. They can have one or more triggers.

B. They can run multiple actions simultaneously.

C. They can be run only on devices in the Security Fabric.

D. They can be created on any device in the fabric.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

To complete the final step of a Security Fabric configuration, an administrator must authorize all the devices on which device?

A. Root FortiGate

B. FortiAnalyzer

C. Downstream FortiGate

D. FortiManager

Correct Answer: A

Question 9

An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192. 168. 1.0/24 and the remote quick mode selector is 192. 168.2.0/24.
Which subnet must the administrator configure for the local quick mode selector for site B?

A. 192. 168.3.0/24

B. 192. 168.2.0/24

C. 192. 168.0.0/24

D. 192. 168. 1.0/24

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

Which of the following statements about central NAT are true? (Choose two.)

A. Central NAT can be enabled or disabled from the CLI only.

B. IP tool references must be removed from existing firewall policies before enabling central NAT .

C. Source NAT, using central NAT, requires at least one central SNAT policy.

D. Destination NAT, using central NAT, requires a VIP object as the destination address in a firewall.

Correct Answer: A,B

Question 11

Refer to the exhibit.

Based on the ZTNA tag, the security posture of the remote endpoint has changed.
What will happen to endpoint active ZTNA sessions?

A. They will be re-evaluated to match the ZTNA policy.

B. They will be re-evaluated to match the security policy.

C. They will be re-evaluated to match the firewall policy.

D. They will be re-evaluated to match the endpoint policy.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)

A. The issuer must be a public CA.

B. The CA extension must be set to TRUE.

C. The keyUsage extension must be set to keyCertSign.

D. The common name on the subject field must use a wildcard name.

Correct Answer: B,C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 13

Refer to the exhibit.

The exhibit shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

A. The sensor will reset all connections that match these signatures.

B. The sensor will block all attacks aimed at Windows servers.

C. The sensor will allow attackers matching the Microsoft Windows.iSCSI.Target.DoS signature.

D. The sensor will gather a packet log for all matched traffic.

Correct Answer: B,C

Question 14

Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

A. 10.200. 1. 1

B. 10.200. 1. 10

C. Any available IP address in the WAN (port1) subnet 10.200. 1.0/24

D. 10.0. 1.254

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 15

In which two ways can RPF checking be disabled? (Choose two )

A. Disable the RPF check at the FortiGate interface level for the source check

B. Enable anti-replay in firewall policy.

C. Enable asymmetric routing.

D. Disable strict-arc-check under system settings.

Correct Answer: C,D

Welcome to TestSimulate

SAP Fortinet NSE 4 - FortiOS 7.2 (C_HRHFC_2311) Free Practice Test