View Full Fortinet NSE4_FGT_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 61

Which FortiGate feature allows an administrator to create multiple logical interfaces on a single physical interface using VLAN tags?

1. VLAN subinterfaces
2. Virtual IPs
3. Loopback interfaces
4. Software switches

Correct Answer: 1

Explanation

VLAN subinterfaces allow FortiGate to process traffic belonging to different VLANs through a single physical interface. Each subinterface is associated with a VLAN ID and can have its own IP address and configuration. This is useful when a trunk link connects the FortiGate to a switch carrying traffic for multiple VLANs. Virtual IPs are primarily used for destination NAT, loopback interfaces provide logical interfaces independent of physical ports, and software switches combine interfaces. Therefore, VLAN subinterfaces are the appropriate solution for VLAN-tagged traffic on one physical interface.

Question 62

Which FortiGate command displays the current status and basic information about the FortiGate system?

1. get system status
2. diagnose sys session list
3. get router info routing-table all
4. diagnose debug flow

Correct Answer: 1

Explanation

The get system status command provides general information about the FortiGate system, including the firmware version, serial number, hostname, and other system details. It is commonly used as an initial troubleshooting command when administrators need to identify the device and confirm its operating version. The session command displays active sessions, the routing-table command displays routing information, and debug flow is used for detailed packet-processing troubleshooting. Therefore, get system status is the appropriate command for checking basic FortiGate system information.

Question 63

Which FortiGate NAT method uses a pool of public IP addresses for translating internal source addresses?

1. DNAT
2. IP pool
3. Virtual IP
4. Port forwarding

Correct Answer: 2

Explanation

An IP pool provides a range or set of external IP addresses that FortiGate can use for source NAT. When an appropriate firewall policy is configured, internal clients can have their source addresses translated to addresses from the IP pool when accessing external networks. This is useful when an organization has multiple public addresses and wants outbound sessions to use those addresses instead of the FortiGate interface address. Virtual IPs are generally used for destination NAT. Therefore, an IP pool is the correct NAT method in this scenario.

Question 64

Which FortiGate feature can inspect DNS requests and apply filtering based on domain categories?

1. DNS Filter
2. Antivirus
3. IPS
4. Traffic Shaping

Correct Answer: 1

Explanation

DNS Filter can inspect DNS requests and apply controls based on domains and supported category information. It can be used to block or allow DNS queries according to configured filtering rules and security classifications. This provides a method of controlling access at the DNS level before a client establishes a connection to the requested destination. Antivirus focuses on malware detection, IPS detects network attacks, and Traffic Shaping manages bandwidth. Therefore, DNS Filter is the appropriate FortiGate security profile for controlling DNS requests according to domain-based filtering policies.

Question 65

Which FortiGate feature can display information about CPU, memory, sessions, and other system resources?

1. FortiView
2. System dashboard
3. Web Filter
4. Policy lookup

Correct Answer: 2

Explanation

The FortiGate system dashboard provides an overview of important device information and resource utilization. Depending on the FortiOS version and dashboard configuration, administrators can monitor CPU usage, memory utilization, session counts, interface activity, and other operational information. FortiView focuses on traffic and security visibility, Web Filter controls web access, and policy lookup helps determine which firewall policy may match traffic. Therefore, the system dashboard is the appropriate feature for viewing general FortiGate resource information and device status.

Question 66

Which firewall policy component identifies the destination network or address to which traffic is being sent?

1. Source
2. Destination
3. Schedule
4. Service

Correct Answer: 2

Explanation

The Destination field identifies the destination address, network, or address group that traffic must match for a firewall policy to apply. FortiGate evaluates this field together with other policy criteria such as source, incoming and outgoing interfaces, service, schedule, and action. The Source field identifies the traffic origin, Schedule determines when the policy is active, and Service identifies protocols or ports. Therefore, Destination is the correct field when a firewall policy must match traffic going toward a specific network or address.

Question 67

Which FortiGate feature can combine multiple physical interfaces into a single logical interface for switching purposes?

1. Software switch
2. IPsec tunnel
3. Virtual IP
4. Loopback

Correct Answer: 1

Explanation

A software switch can combine multiple FortiGate interfaces into a single logical interface for Layer 2 switching purposes. Devices connected to the member interfaces can communicate through the logical switch according to the configured network design. This can be useful when several physical ports need to participate in the same logical network segment. IPsec tunnels provide encrypted connectivity, Virtual IPs perform destination NAT, and loopback interfaces provide logical Layer 3 interfaces. Therefore, Software switch is the correct feature for combining physical interfaces into one logical switching interface.

Question 68

Which FortiGate routing protocol uses autonomous systems and is commonly used for exchanging routes between different organizations or large networks?

1. OSPF
2. RIP
3. BGP
4. DHCP

Correct Answer: 3

Explanation

Border Gateway Protocol, or BGP, is a path-vector routing protocol designed to exchange routing information between autonomous systems. It is widely used for inter-domain routing and can support complex routing policies across large networks. OSPF is primarily an interior gateway protocol used within an organization, RIP is an older distance-vector routing protocol, and DHCP provides IP configuration rather than route exchange. Therefore, BGP is the appropriate protocol when routing information needs to be exchanged between autonomous systems or large administrative domains.

Question 69

Which FortiGate feature allows an administrator to test whether a specific user belongs to an authentication group before applying identity-based policies?

1. User group configuration
2. Route monitor
3. Traffic shaper
4. IP pool

Correct Answer: 1

Explanation

User group configuration allows administrators to organize authenticated users into groups that can be referenced by FortiGate policies and authentication settings. Identity-based policies can then use these groups to control access to network resources. Administrators can verify group membership and authentication configuration when troubleshooting identity-based access. Route monitoring concerns routing information, traffic shapers control bandwidth, and IP pools provide addresses for source NAT. Therefore, User group configuration is the relevant feature for organizing and applying identity-based access controls.

Question 70

Which FortiGate feature is used to configure a virtual interface that has no physical port dependency and can be used for management or routing purposes?

1. VLAN interface
2. Loopback interface
3. Hardware switch
4. IP pool

Correct Answer: 2

Explanation

A loopback interface is a logical interface that does not depend on a specific physical interface being operational. It can be assigned an IP address and used for purposes such as management, routing protocols, or providing a stable endpoint within an appropriate network design. A VLAN interface depends on VLAN tagging through a physical or aggregate interface, a hardware switch combines physical ports according to platform capabilities, and an IP pool is used for NAT. Therefore, a loopback interface is the correct choice for a logical interface without direct physical-port dependency.

Question 71

Which FortiGate feature can inspect encrypted SSH traffic and apply security inspection policies when configured appropriately?

1. SSL/SSH Inspection
2. Web Filter
3. DHCP
4. Static route

Correct Answer: 1

Explanation

SSL/SSH Inspection provides mechanisms for inspecting encrypted SSL/TLS and SSH traffic according to the configured inspection profile and supported FortiOS capabilities. Administrators can define how encrypted sessions should be handled and which inspection approach should be applied. The appropriate configuration depends on the traffic type, security requirements, and certificate or trust considerations. Web Filter focuses on web access, DHCP provides address configuration, and static routes determine forwarding paths. Therefore, SSL/SSH Inspection is the appropriate feature for managing inspection of encrypted traffic.

Question 72

Which FortiGate feature can use a predefined list of IP addresses and domains associated with known malicious infrastructure?

1. Static route
2. Threat feed
3. DHCP server
4. Service group

Correct Answer: 2

Explanation

A threat feed can provide FortiGate with external intelligence containing indicators such as IP addresses or domains associated with potentially malicious activity. Administrators can use supported threat feeds in security policies or other configurations to help identify and control traffic matching those indicators. Static routes determine forwarding paths, DHCP servers assign network configuration, and service groups organize protocol and port objects. Threat feeds are useful when security teams need to incorporate externally maintained indicators into FortiGate enforcement. Therefore, Threat feed is the correct answer.

Question 73

Which FortiGate feature allows an administrator to create a policy that applies only to authenticated users?

1. Identity-based firewall policy
2. Static route
3. IP pool
4. DNS server

Correct Answer: 1

Explanation

An identity-based firewall policy can use authenticated users or user groups as part of its matching criteria. This allows administrators to control network access according to user identity rather than relying exclusively on source IP addresses. For example, different user groups can receive different permissions to applications or destinations. Static routes determine packet paths, IP pools provide source addresses for NAT, and DNS servers provide name-resolution services. Therefore, an identity-based firewall policy is the appropriate configuration when access must depend on authenticated users.

Question 74

Which FortiGate feature can collect information about users from an external authentication system and use it for identity-based policies?

1. FSSO
2. SNMP
3. NTP
4. DHCP

Correct Answer: 1

Explanation

Fortinet Single Sign-On, or FSSO, provides FortiGate with user identity information obtained through supported authentication and directory environments. This information can then be used to create identity-based firewall policies without requiring users to repeatedly authenticate directly to FortiGate for every access decision. SNMP is primarily used for monitoring, NTP synchronizes time, and DHCP provides network configuration. Therefore, FSSO is the appropriate feature when FortiGate needs to use externally obtained user identity information for policy enforcement.

Question 75

Which FortiGate feature can protect internal servers from unsolicited inbound internet traffic by controlling which connections are permitted?

1. Firewall policy
2. DHCP server
3. DNS filter
4. Route monitor

Correct Answer: 1

Explanation

Firewall policies control whether network traffic is accepted, denied, translated, logged, and inspected according to configured criteria. For inbound internet traffic, administrators can create policies that permit only required services and destinations while denying unauthorized connections. This helps reduce unnecessary exposure of internal resources. DHCP provides IP configuration, DNS Filter controls DNS requests, and Route Monitor provides routing information. Therefore, the firewall policy is the primary FortiGate mechanism for controlling unsolicited inbound traffic and protecting internal servers.

Question 76

Which FortiGate feature can provide a graphical map showing connected Fortinet devices in a Security Fabric environment?

1. FortiView
2. Security Fabric topology
3. Traffic shaper
4. Policy lookup

Correct Answer: 2

Explanation

Security Fabric topology provides a visual representation of participating Fortinet devices and their relationships within the Security Fabric environment. It can help administrators understand the structure of connected security components and identify device relationships or operational information. FortiView focuses on traffic and security analytics, Traffic Shaping manages bandwidth, and Policy Lookup assists with firewall-policy troubleshooting. Therefore, Security Fabric topology is the appropriate feature for viewing connected Fortinet devices and their relationships graphically.

Question 77

Which FortiGate feature can synchronize configuration and state information between members of an HA cluster?

1. HA synchronization
2. Web Filter
3. DNS Filter
4. IP pool

Correct Answer: 1

Explanation

HA synchronization allows cluster members to exchange relevant configuration and operational state information so that the HA cluster can operate consistently. Synchronization is important because the secondary unit must have the necessary information to take over when a failover occurs. Depending on the configuration and FortiOS capabilities, different types of state information can be synchronized between cluster members. Web Filter and DNS Filter are security profiles, while IP pools are used for NAT. Therefore, HA synchronization is the correct feature associated with keeping HA members coordinated.

Question 78

Which FortiGate feature allows administrators to define a trusted certificate authority for inspection of encrypted client traffic?

1. Certificate configuration
2. Static route
3. Traffic shaping
4. Address group

Correct Answer: 1

Explanation

Certificate configuration allows administrators to manage certificates and certificate authorities used by FortiGate for supported authentication and inspection functions. For deep inspection of encrypted client traffic, FortiGate may use a certificate authority to generate certificates dynamically for inspected destinations. Client devices must trust the appropriate CA certificate to avoid certificate warnings during inspection. Static routes control forwarding, Traffic Shaping manages bandwidth, and address groups organize network addresses. Therefore, Certificate configuration is the appropriate area for managing trusted certificate authorities used in inspection scenarios.

Question 79

Which FortiGate feature can help determine why a packet was denied by showing the policy and processing decisions applied to the packet?

1. Debug flow
2. System dashboard
3. FortiToken
4. DHCP monitor

Correct Answer: 1

Explanation

Debug flow is a detailed troubleshooting mechanism that can show how FortiGate processes packets through routing and firewall-policy decisions. It can help administrators identify whether traffic matched a policy, was denied, or encountered another processing issue. This makes it particularly useful when ordinary log information does not provide enough detail to determine the cause of a connectivity problem. The system dashboard displays general system information, FortiToken supports authentication, and DHCP monitoring focuses on address assignments. Therefore, Debug flow is the appropriate troubleshooting feature.

Question 80

Which FortiGate configuration allows administrators to specify that traffic destined for a particular network should use a specific gateway?

1. Firewall policy
2. Static route
3. Security profile
4. Service group

Correct Answer: 2

Explanation

A static route allows an administrator to manually specify how FortiGate should reach a particular destination network. The configuration can identify the destination prefix, next-hop gateway, and outgoing interface. FortiGate can then use this route when forwarding traffic toward the specified network, provided it is the selected route according to the routing process. Firewall policies control traffic permissions, security profiles inspect traffic, and service groups organize protocols and ports. Therefore, Static route is the correct configuration for specifying a gateway for a destination network.