View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 81. Which FortiGate feature allows an administrator to create a logical grouping of multiple interfaces and apply policies to the group?

1. Virtual IP
2. Interface zone
3. IP pool
4. Route map

Correct Answer: 2. Interface zone

Explanation :-

An interface zone allows multiple FortiGate interfaces to be grouped logically so that firewall policies can reference the zone rather than configuring each interface separately. This can simplify policy management when several interfaces have similar security requirements. A virtual IP performs destination NAT, an IP pool provides addresses for source NAT, and a route map is used in routing-related configurations. Interface zones are therefore useful when administrators want to manage multiple interfaces collectively within firewall policies.

Question 82. An administrator wants to prevent a specific internal subnet from accessing the internet while leaving other internal subnets unaffected. Which firewall policy design is most appropriate?

1. Create a deny policy matching the specific subnet
2. Disable the WAN interface
3. Remove the default route
4. Disable source NAT globally

Correct Answer: 1. Create a deny policy matching the specific subnet

Explanation :-

A firewall policy can specifically match the source subnet that should be blocked and deny its traffic to the internet. Other internal networks can continue using their existing policies because the restriction is limited to the defined source address. Disabling the WAN interface or removing the default route would affect other networks as well, while disabling source NAT does not by itself provide the required access-control decision. A targeted deny policy therefore provides the most controlled solution.

Question 83. Which FortiGate command displays the configured firewall policies from the CLI?

1. get system status
2. execute ping
3. show firewall policy
4. diagnose sniffer packet

Correct Answer: 3. show firewall policy

Explanation :-

The show firewall policy command displays the configured firewall policies and their relevant settings from the FortiGate CLI. It is useful when administrators need to inspect policy configuration, policy identifiers, interfaces, addresses, services, actions, and other policy parameters. get system status provides system information, execute ping tests connectivity, and diagnose sniffer packet captures packets. The firewall-policy command is therefore appropriate when reviewing the configured policy definitions.

Question 84. Which FortiGate feature can automatically assign a fixed IP address to a client based on its MAC address through DHCP?

1. DHCP reservation
2. Virtual IP
3. Static route
4. Security profile group

Correct Answer: 1. DHCP reservation

Explanation :-

A DHCP reservation allows a specific client to receive a predictable IP address based on its identifying information, commonly its MAC address. This is useful for devices such as printers, servers, or managed endpoints that should consistently receive the same address while still obtaining configuration through DHCP. A virtual IP is used for address translation, a static route controls forwarding, and a security profile group combines inspection profiles. DHCP reservation is therefore the appropriate feature for predictable DHCP addressing.

Question 85. Which FortiGate configuration can be used to authenticate administrators through an external RADIUS server?

1. Local certificate
2. RADIUS server configuration
3. IP pool
4. Traffic shaper

Correct Answer: 2. RADIUS server configuration

Explanation :-

FortiGate can integrate with an external RADIUS server for authentication. After the RADIUS server is configured on FortiGate, it can be referenced by authentication-related configurations and administrator accounts or user authentication mechanisms as appropriate. A local certificate provides certificate-based security functions, an IP pool supports NAT addressing, and a traffic shaper manages bandwidth. RADIUS is therefore the appropriate external authentication method when centralized credentials are maintained on a RADIUS server.

Question 86. A FortiGate administrator needs to ensure that a route to a specific subnet is preferred over a less-specific route. Which routing principle determines this preference?

1. Longest prefix match
2. Highest interface bandwidth
3. Lowest firewall policy ID
4. Web category rating

Correct Answer: 1. Longest prefix match

Explanation :-

FortiGate routing uses destination-prefix matching, and the most specific matching route is preferred over a less-specific route. This is commonly described as longest prefix match. For example, a route for a specific subnet can take precedence over a broader route covering a larger address range. Interface bandwidth, firewall policy IDs, and web categories do not determine this fundamental destination-prefix selection principle. Understanding longest prefix matching is important when troubleshooting why traffic follows a particular route.

Question 87. Which FortiGate security profile is specifically designed to detect and remove or block malware in supported traffic?

1. Application Control
2. Web Filter
3. Antivirus
4. Traffic Shaping

Correct Answer: 3. Antivirus

Explanation :-

The FortiGate Antivirus security profile examines supported traffic for malicious files and malware-related content and can take configured actions when threats are detected. It can be applied to firewall policies to provide content-level malware protection. Application Control identifies applications, Web Filter controls access to websites, and Traffic Shaping manages bandwidth. Antivirus is therefore the appropriate security profile when the primary requirement is detecting and preventing malware carried through supported network traffic.

Question 88. Which FortiGate feature provides a graphical view of traffic, applications, sources, destinations, and other activity for analysis?

1. FortiView
2. DHCP relay
3. IP pool
4. Static route

Correct Answer: 1. FortiView

Explanation :-

FortiView provides graphical and interactive visibility into network and security activity. Depending on the FortiGate configuration and available logs, administrators can examine traffic sources, destinations, applications, interfaces, threats, and other useful information. DHCP relay forwards DHCP requests, IP pools provide addresses for NAT, and static routes define forwarding paths. FortiView is therefore useful when administrators need an operational overview of network activity and want to investigate traffic patterns through a graphical interface.

Question 89. An administrator wants to create a firewall policy that permits traffic only from a particular internal subnet to a specific application server. Which policy elements should be restricted?

1. Source address and destination address
2. Administrator username and hostname
3. FortiGuard license and firmware version
4. CPU and memory thresholds

Correct Answer: 1. Source address and destination address

Explanation :-

Firewall policies can precisely control communication by defining source and destination addresses. To allow only a particular internal subnet to reach a specific application server, the source address should represent the permitted subnet and the destination address should represent the server. Additional criteria such as service and schedule can further restrict the policy. Administrator credentials, FortiGuard licensing, firmware versions, CPU usage, and memory thresholds are not the primary policy-matching elements for this network-access requirement.

Question 90. Which FortiGate feature can use DNS queries to enforce security or filtering policies before a client connects to a destination?

1. DNS Filter
2. IPsec monitor
3. Traffic Shaper
4. Static route

Correct Answer: 1. DNS Filter

Explanation :-

FortiGate DNS Filter can inspect DNS requests and apply configured filtering decisions based on domain information and security classifications. This provides a way to control access at the DNS-resolution stage and can help block domains associated with malicious or unwanted content. IPsec Monitor provides VPN visibility, Traffic Shaper manages bandwidth, and Static Route controls packet forwarding. DNS Filter is therefore the feature designed specifically for enforcing policies based on DNS requests and domain classifications.

Question 91. Which FortiGate HA setting helps determine which cluster member should become the primary unit based on configured device priorities?

1. HA priority
2. Web Filter priority
3. DNS server priority
4. IP pool priority

Correct Answer: 1. HA priority

Explanation :-

HA priority is one of the factors used by FortiGate when determining cluster-member roles. Administrators can configure device priority so that a preferred unit has a greater likelihood of becoming or remaining the primary unit, subject to other HA conditions. Web Filter, DNS server, and IP pool configurations do not determine the primary HA role. HA priority is therefore an important configuration when administrators want to influence which device normally operates as the primary cluster member.

Question 92. A FortiGate administrator needs to export the current configuration for backup purposes. Which approach is appropriate?

1. Use a configuration backup function
2. Delete the current configuration
3. Disable all firewall policies
4. Restart the FortiGate

Correct Answer: 1. Use a configuration backup function

Explanation :-

FortiGate provides configuration backup capabilities that allow administrators to save the device configuration for recovery, migration, or disaster-recovery purposes. Maintaining current backups is important before significant configuration changes or firmware operations. Deleting policies, disabling firewall policies, or restarting the device does not create a backup and can disrupt network services. A configuration backup should therefore be used when the objective is to preserve the current FortiGate configuration for future restoration.

Question 93. Which FortiGate feature can use FortiGuard intelligence to classify applications and websites for security policy enforcement?

1. FortiGuard services
2. DHCP relay
3. Static NAT
4. Link aggregation

Correct Answer: 1. FortiGuard services

Explanation :-

FortiGuard services provide security intelligence used by FortiGate features such as web filtering, application identification, antivirus, and other security controls. This intelligence can help classify content and identify threats so that security profiles can make informed policy decisions. DHCP relay handles DHCP forwarding, static NAT performs address translation, and link aggregation combines physical interfaces. FortiGuard services therefore provide the external security intelligence that supports several FortiGate security features.

Question 94. Which FortiGate routing feature can distribute traffic across multiple routes with equivalent routing characteristics?

1. ECMP
2. Web Filter
3. Antivirus
4. DHCP reservation

Correct Answer: 1. ECMP

Explanation :-

Equal-Cost Multi-Path, or ECMP, allows FortiGate to use multiple routes that have equivalent routing characteristics for forwarding traffic. This can provide load distribution and path redundancy when multiple suitable routes are available. Web Filter and Antivirus are security profiles, while DHCP reservations provide predictable client addresses. ECMP is therefore the routing feature associated with using multiple equal-cost paths instead of relying exclusively on a single route.

Question 95. Which FortiGate feature can be used to create a logical interface that remains available independently of a specific physical interface?

1. Loopback interface
2. Physical switch interface
3. IP pool
4. Virtual IP

Correct Answer: 1. Loopback interface

Explanation :-

A loopback interface is a logical interface that is not directly dependent on the physical state of a particular network port. It can be useful for management, routing protocols, VPN configurations, or other functions that benefit from a stable logical address. A physical switch interface represents physical connectivity, an IP pool is used for source NAT, and a virtual IP performs destination address translation. A loopback interface is therefore appropriate when a stable logical interface is required.

Question 96. An administrator wants to prevent a firewall policy from being used outside a specified recurring time period. Which setting should be configured?

1. Schedule
2. Address group
3. NAT mode
4. Interface speed

Correct Answer: 1. Schedule

Explanation :-

A firewall policy schedule determines when the policy is active. A recurring schedule can specify days and time periods during which the policy should be applied, while traffic outside that schedule will not match that scheduled policy. Address groups organize network objects, NAT mode controls address translation behavior, and interface speed is a physical or link-related property. A schedule is therefore the correct setting when access needs to be restricted to specific recurring periods.

Question 97. Which FortiGate diagnostic command can display the current routing table and its learned routes?

1. get router info routing-table all
2. execute ping
3. diagnose debug reset
4. get system performance status

Correct Answer: 1. get router info routing-table all

Explanation :-

The get router info routing-table all command displays routing information maintained by FortiGate. It can help administrators identify connected, static, dynamic, and other routes that may influence packet forwarding. execute ping tests connectivity, diagnose debug reset resets diagnostic settings, and get system performance status provides resource-related information. Reviewing the routing table is an important troubleshooting step when traffic is not reaching its expected destination or when an unexpected forwarding path is suspected.

Question 98. Which FortiGate feature can protect a management connection by requiring administrators to connect through HTTPS rather than unencrypted HTTP?

1. HTTPS administrative access
2. Static routing
3. DHCP relay
4. Traffic shaping

Correct Answer: 1. HTTPS administrative access

Explanation :-

HTTPS administrative access provides encrypted communication between an administrator’s browser and the FortiGate management interface. Using HTTPS helps protect administrative credentials and management traffic from being exposed in clear text. Static routing controls packet forwarding, DHCP relay forwards DHCP messages, and traffic shaping controls bandwidth. HTTPS administration is therefore the appropriate management-access method when encrypted browser-based access to the FortiGate GUI is required.

Question 99. Which FortiGate feature allows an administrator to define separate firewall and routing environments for different organizations using one physical FortiGate?

1. VDOM
2. IP pool
3. Application Control
4. Traffic Shaping

Correct Answer: 1. VDOM

Explanation :-

VDOMs provide logical separation within a FortiGate appliance, allowing different virtual firewall environments to maintain separate configurations and policies. This capability can be useful in multi-tenant deployments or organizations that need isolated administrative and network environments on the same hardware. IP pools support source NAT, Application Control manages application traffic, and Traffic Shaping manages bandwidth. VDOMs are therefore the feature designed to create separate virtual firewall environments within one physical FortiGate.

Question 100. A FortiGate administrator observes that traffic reaches the firewall but is not forwarded to the expected destination. Which combination of information is most useful for initial troubleshooting?

1. Routing table and firewall policy
2. Web category and administrator password
3. DHCP lease time and hostname
4. Antivirus database and interface description

Correct Answer: 1. Routing table and firewall policy

Explanation :-

The routing table and firewall policy are two fundamental areas to check when traffic reaches FortiGate but does not reach its intended destination. The firewall policy determines whether the traffic is permitted and what processing is applied, while the routing table determines where permitted traffic should be forwarded. Reviewing both can reveal policy mismatches, incorrect destinations, missing routes, or unexpected forwarding paths. Web categories, passwords, DHCP lease times, and antivirus databases do not provide the same initial visibility into this forwarding problem.