Question 1

If Internet Service is already selected as Destination in a firewall policy, which other configuration object can be selected for the Destination field of a firewall
policy?

Accepted Answer

FortiGate Security 7.2 Study Guide (p.59): "When configuring your firewall policy, you can use Internet Service as the destination in a firewall policy, which
contains all the IP addresses, ports, and protocols used by that service. For the same reason, you cannot mix regular address objects with ISDB objects, and you
cannot select services on a firewall policy. The ISDB objects already have services information, which is hardcoded."
This is true because Internet Service is a special type of destination object that can only be used alone in a firewall policy. Internet Service is a feature that allows
FortiGate to identify and filter traffic based on the internet service or application that it belongs to, such as Facebook, YouTube, Skype, etc. Internet Service uses a
database of IP addresses and ports that are associated with each internet service or application, and updates it regularly from FortiGuard. When Internet Service is
selected as the destination in a firewall policy, FortiGate will match the traffic to the corresponding internet service or application, and apply the appropriate action
and security profiles to it. However, Internet Service cannot be combined with any other destination object, such as IP address, FQDN address, user or user group,
etc., as this would create a conflict or ambiguity in the firewall policy. Therefore, no other object can be added if Internet Service is already selected as the
destination in a firewall policy

Question 2

Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)

Accepted Answer

When a packet arrives, how does FortiGate find a matching policy? Each policy has match criteria, which you can define using the following objects:
• Incoming Interface
• Outgoing Interface
• Source: IP address, user, internet services
• Destination: IP address or internet services
• Service: IP protocol and port number
• Schedule: Applies during configured times

Question 3

Refer to the exhibits.
Exhibit A shows a topology for a FortiGate HA cluster that performs proxy-based inspection on traffic. Exhibit B shows the HA configuration and the partial output
of the get system ha status command.

From SurePassExam
https://www.surepassexam.com/NSE4_FGT-7.2-exam-dumps.html (156 New Questions)
Based on the exhibits, which two statements about the traffic passing through the cluster are true? (Choose two.)

Accepted Answer

FortiGate Infrastructure 7.2 Study Guide (p.317 & p.320): "To forward traffic correctly, a FortiGate HA solution uses virtual MAC addresses." "The primary forwards
the SYN packet to the selected secondary. (...) This is also known as MAC address rewrite. In addition, the primary encapsulates the packet in an Ethernet frame
type 0x8891. The encapsulation is done only for the first packet of a load balanced session. The encapsulated packet includes the original packet plus session
information that the secondary requires to process the traffic."

Question 4

An administrator wants to simplify remote access without asking users to provide user credentials. Which access control method provides this solution?

Accepted Answer

FortiGate Infrastructure 7.2 Study Guide (p.165): "ZTNA access proxy allows users to securely access resources through an SSL-encrypted access proxy. This
simplifies remote access by eliminating the use of VPNs."
This is true because ZTNA access proxy is a feature that allows remote users to access internal applications without requiring VPN or user credentials. ZTNA
access proxy uses a secure tunnel between the user’s device and the FortiGate, and authenticates the user based on device identity and context. The user only
needs to install a lightweight agent on their device, and the FortiGate will automatically assign them to the appropriate application group based on their device
profile. This simplifies remote access and enhances security by reducing the attack surface12

Question 5

A network administrator has enabled full SSL inspection and web filtering on FortiGate. When visiting any HTTPS websites, the browser reports certificate warning
errors. When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?

Accepted Answer

FortiGate Security 7.2 Study Guide (p.235): "If FortiGate receives a trusted SSL certificate, then it generates a temporary certificate signed by the built-in
Fortinet_CA_SSL certificate and sends it to the browser. If the browser trusts the Fortinet_CA_SSL certificate, the browser completes the SSL handshake.
Otherwise, the browser also presents a warning message informing the user that the site is untrusted. In other words, for this function to work as intended, you
must import the Fortinet_CA_SSL certificate into the trusted root CA certificate store of your browser."

Question 6

Which two statements explain antivirus scanning modes? (Choose two.)

Accepted Answer

An antivirus profile in full scan mode buffers up to your specified file size limit. The default is 10 MB. That is large enough for most files, except video files. If your
FortiGate model has more RAM, you may be able to increase this threshold. Without a limit, very large files could exhaust the scan memory. So, this threshold
balances risk and performance. Is this tradeoff unique to FortiGate, or to a specific model? No. Regardless of vendor or model, you must make a choice. This is
because of the difference between scans in theory, that have no limits, and scans on real-world devices, that have finite RAM. In order to detect 100% of malware
regardless of file size, a firewall would need infinitely large RAM--something that no device has in the real world. Most viruses are very small. This table shows a
typical tradeoff. You can see that with the default 10 MB threshold, only 0.01% of viruses pass through.
FortiGate Security 7.2 Study Guide (p.350 & 352): "In flow-based inspection mode, the IPS engine reads the payload of each packet, caches a local copy, and
forwards the packet to the receiver at the same time. Because the file is ransmitted simultaneously, flow-based mode consumes more CPU cycles than proxybased." "Each protocol’s proxy picks up a connection and buffers the entire file first (or waits until the oversize limit is reached) before scanning. The client must
wait for the scanning to finish."

Question 7

What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?

Accepted Answer

Correct answer: D

Question 8

Which statement about the policy ID number of a firewall policy is true?

Accepted Answer

Correct answer: A

Question 9

Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?

Accepted Answer

http://docs.fortinet.com/document/fortigate/6.0.0/handbook/240599/application-control

Question 10

In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true
about consolidated IPv4 and IPv6 policy configuration? (Choose three.)

Accepted Answer

Correct answer: BDE