View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 101. Which FortiGate feature allows administrators to create a policy that uses a specific outgoing interface or gateway based on the source address?

1. Policy-based routing
2. Web Filter
3. IP pool
4. Application Control

Correct Answer: 1. Policy-based routing

Explanation :-

Policy-based routing allows FortiGate to make forwarding decisions using criteria beyond the destination address in the normal routing table. For example, traffic from a particular source subnet can be directed through a specific outgoing interface or next hop. Web Filter controls website access, IP pools provide addresses for source NAT, and Application Control identifies applications. Policy-based routing is therefore useful when traffic from different sources needs to use different forwarding paths or internet connections.

Question 102. An administrator wants to restrict management access to FortiGate so that only a specific trusted subnet can connect to the HTTPS administrative interface. Which configuration is most appropriate?

1. Traffic shaping
2. Trusted hosts
3. IPsec Phase 2
4. Web Filter

Correct Answer: 2. Trusted hosts

Explanation :-

Trusted hosts can restrict administrative access so that management connections are accepted only from specified source IP addresses or networks. This provides an additional layer of protection for administrator accounts by limiting where administrative logins can originate. Traffic shaping controls bandwidth, IPsec Phase 2 protects VPN traffic, and Web Filter controls web destinations. Configuring trusted hosts is therefore appropriate when management access should be limited to a known administrative subnet.

Question 103. Which FortiGate feature allows an administrator to define multiple IP addresses that can be used for source NAT instead of using the outgoing interface address?

1. Virtual IP
2. IP pool
3. Address group
4. DHCP scope

Correct Answer: 2. IP pool

Explanation :-

An IP pool contains one or more public IP addresses that FortiGate can use for source NAT. When a firewall policy is configured to use an IP pool, translated source traffic can use addresses from that configured pool rather than relying solely on the outgoing interface address. A virtual IP is primarily used for destination NAT, an address group organizes address objects, and a DHCP scope assigns client addresses. An IP pool is therefore the appropriate feature for controlled source NAT addressing.

Question 104. Which FortiGate security profile is designed to identify network applications and allow administrators to permit or block them independently of destination port alone?

1. Antivirus
2. DNS Filter
3. Application Control
4. Traffic Shaping

Correct Answer: 3. Application Control

Explanation :-

Application Control identifies applications using FortiGate application signatures and related traffic characteristics. This allows administrators to apply actions to applications rather than relying exclusively on traditional port-based definitions. For example, an administrator can configure a policy to block a particular application while allowing other traffic through the same general network path. Antivirus focuses on malware, DNS Filter controls domain requests, and Traffic Shaping manages bandwidth. Application Control is therefore the appropriate feature for application-specific enforcement.

Question 105. Which FortiGate HA component is used to monitor the health and availability of cluster members?

1. HA heartbeat
2. Web Filter
3. IP pool
4. Static route

Correct Answer: 1. HA heartbeat

Explanation :-

HA heartbeat communication allows FortiGate cluster members to exchange status and synchronization information. The heartbeat mechanism helps members determine whether peers are available and supports HA decisions such as failover. Web Filter provides web-access control, IP pools support source NAT, and static routes define forwarding paths. Reliable heartbeat communication is therefore a fundamental component of FortiGate HA because cluster members need a mechanism to monitor one another and coordinate their operating state.

Question 106. An administrator wants to inspect HTTPS traffic without decrypting the full content of every session. Which inspection approach can provide certificate and session-level inspection?

1. Deep inspection
2. Certificate inspection
3. Application Control
4. Antivirus scanning

Correct Answer: 2. Certificate inspection

Explanation :-

Certificate inspection examines information associated with an SSL/TLS session, such as the server certificate, without performing full content decryption in the same manner as deep inspection. This can provide visibility into encrypted connections while avoiding the broader decryption requirements of full SSL inspection. Deep inspection can decrypt and inspect supported encrypted content, while Application Control and Antivirus perform different security functions. Certificate inspection is therefore appropriate when session and certificate information is required without full content inspection.

Question 107. Which FortiGate object is used to represent a range of IP addresses in a firewall policy?

1. Address object
2. Service object
3. Schedule object
4. User group

Correct Answer: 1. Address object

Explanation :-

An address object can represent an individual IP address, subnet, range, or other supported address definition. These objects can then be referenced in firewall policies to define source and destination matching criteria. Service objects define protocols and ports, schedule objects determine when policies are active, and user groups represent authenticated identities. An address object is therefore the appropriate configuration for representing a range of IP addresses that needs to be referenced in a security policy.

Question 108. Which FortiGate feature provides centralized security event analysis and reporting using logs collected from FortiGate devices?

1. FortiAnalyzer
2. DHCP relay
3. Virtual IP
4. Policy route

Correct Answer: 1. FortiAnalyzer

Explanation :-

FortiAnalyzer provides centralized collection, storage, analysis, and reporting of logs from Fortinet devices. It can help administrators investigate security events, analyze historical traffic, create reports, and maintain centralized visibility across multiple FortiGate systems. DHCP relay forwards DHCP requests, virtual IPs perform destination NAT, and policy routes influence forwarding decisions. FortiAnalyzer is therefore the appropriate platform when an organization needs centralized log analysis and reporting for FortiGate-generated events.

Question 109. A firewall policy has a source address, destination address, and service that all appear correct, but the policy still does not match. Which additional policy element should be checked?

1. Incoming interface
2. Device serial number
3. FortiGuard contract name
4. CPU temperature

Correct Answer: 1. Incoming interface

Explanation :-

The incoming interface is an important firewall-policy matching criterion. A policy may contain the correct source, destination, and service but still fail to match if traffic enters through an interface that is not included in the policy. Administrators should verify both the incoming and outgoing interface requirements when troubleshooting policy matching. Device serial numbers, FortiGuard contract names, and CPU temperature do not normally determine whether an IPv4 firewall policy matches a particular traffic flow.

Question 110. Which FortiGate feature can redirect users from an HTTP request to an authentication process before allowing access to protected resources?

1. Captive portal
2. Static route
3. IP pool
4. Link aggregation

Correct Answer: 1. Captive portal

Explanation :-

A captive portal can require users to authenticate before they are granted access to protected network resources. This is commonly used in guest networks, wireless environments, and other scenarios where users must accept terms or authenticate through a web interface before receiving permitted access. Static routes determine forwarding paths, IP pools provide source NAT addresses, and link aggregation combines physical links. Captive portal functionality is therefore appropriate when web-based user authentication is required before network access.

Question 111. Which FortiGate command can be used to display information about active sessions?

1. diagnose sys session list
2. execute ping
3. get system status
4. show firewall address

Correct Answer: 1. diagnose sys session list

Explanation :-

The diagnose sys session list command provides information about active FortiGate sessions. Session information can help administrators troubleshoot connectivity, NAT behavior, policy matching, interfaces, and other aspects of active traffic flows. execute ping tests reachability, get system status displays system information, and show firewall address displays address-object configuration. Reviewing the session table is particularly useful when traffic appears to be established but behaves unexpectedly or when administrators need to inspect how FortiGate is tracking active connections.

Question 112. Which FortiGate feature allows a single physical interface to carry traffic for multiple VLANs using tagged frames?

1. VLAN interface
2. Loopback interface
3. Virtual IP
4. IP pool

Correct Answer: 1. VLAN interface

Explanation :-

A VLAN interface allows FortiGate to process traffic associated with a specific VLAN over a physical interface that carries tagged frames. This is commonly used with managed switches and trunk links where multiple logical networks share a physical connection. A loopback interface is a logical interface without direct physical dependence, a virtual IP performs destination NAT, and an IP pool supports source NAT. VLAN interfaces are therefore the appropriate choice for handling tagged VLAN traffic through a physical trunk.

Question 113. An administrator wants FortiGate to use an external DNS server for name resolution. Which configuration should be modified?

1. System DNS settings
2. Firewall policy schedule
3. IPsec Phase 2 selectors
4. Traffic shaping profile

Correct Answer: 1. System DNS settings

Explanation :-

FortiGate uses configured system DNS settings when it needs to resolve domain names for various system and security functions. Administrators can specify appropriate DNS servers according to the network design and service requirements. Firewall schedules determine policy timing, IPsec Phase 2 selectors define protected VPN traffic, and traffic shaping controls bandwidth. System DNS configuration is therefore the relevant area when an administrator needs FortiGate itself to use particular external DNS servers.

Question 114. Which FortiGate feature can block a domain based on its DNS reputation or category before a user establishes a web connection?

1. DNS Filter
2. IPsec monitor
3. Static route
4. Link aggregation

Correct Answer: 1. DNS Filter

Explanation :-

DNS Filter can evaluate DNS requests and apply actions based on domain categories, reputation, and configured filtering rules. Blocking at the DNS level can prevent a client from resolving domains that FortiGate identifies as unwanted or malicious. IPsec Monitor provides VPN status information, static routes control forwarding, and link aggregation combines interfaces. DNS Filter is therefore appropriate when domain-based protection is required at the DNS request stage rather than through full web-content inspection.

Question 115. Which FortiGate feature allows administrators to create a group of address objects so they can be referenced collectively in firewall policies?

1. Address group
2. User group
3. Service group
4. IP pool

Correct Answer: 1. Address group

Explanation :-

An address group combines multiple address objects into a single logical object that can be referenced by firewall policies. This simplifies policy administration when the same collection of networks or hosts needs to be used repeatedly. A user group contains authenticated identities, a service group combines service definitions, and an IP pool provides addresses for source NAT. An address group is therefore the appropriate object when multiple network addresses need to be treated collectively in policy configuration.

Question 116. Which FortiGate feature is primarily responsible for detecting known network intrusion signatures?

1. IPS
2. Web Filter
3. DHCP server
4. IP pool

Correct Answer: 1. IPS

Explanation :-

The Intrusion Prevention System, or IPS, examines traffic for known attack patterns and signatures. When a matching threat is detected, FortiGate can take an action such as blocking or logging the traffic according to the configured IPS profile. Web Filter focuses on website access, DHCP server provides IP configuration, and IP pools support source NAT. IPS is therefore the security feature specifically designed to identify and respond to recognized network intrusion patterns.

Question 117. An administrator wants to determine whether a FortiGate interface is receiving packets from a particular host. Which tool provides the most direct packet-level evidence?

1. Packet sniffer
2. Policy lookup
3. FortiView dashboard
4. Configuration backup

Correct Answer: 1. Packet sniffer

Explanation :-

A packet sniffer provides direct visibility into packets observed on a FortiGate interface. Administrators can apply filters for source or destination addresses, ports, and protocols to determine whether traffic from a particular host is actually reaching the interface. Policy lookup evaluates policy matching, FortiView provides higher-level traffic visibility, and configuration backup preserves settings. Packet sniffing therefore provides the most direct evidence when troubleshooting whether packets from a particular source are physically reaching a FortiGate interface.

Question 118. Which FortiGate feature can provide redundancy for a default internet connection when multiple equal-cost paths are available?

1. ECMP
2. Web Filter
3. Antivirus
4. Captive portal

Correct Answer: 1. ECMP

Explanation :-

Equal-Cost Multi-Path routing allows FortiGate to use multiple routes that have equivalent routing characteristics. When multiple suitable paths exist, ECMP can provide path redundancy and, depending on configuration, distribute traffic across available paths. Web Filter and Antivirus are security profiles, while captive portal provides user authentication functionality. ECMP is therefore the relevant routing feature when multiple equal-cost paths need to participate in forwarding decisions.

Question 119. Which FortiGate feature can apply different authentication requirements to users accessing network resources through a firewall policy?

1. Identity-based policy
2. Static route
3. IP pool
4. Traffic shaper

Correct Answer: 1. Identity-based policy

Explanation :-

Identity-based policies allow FortiGate to use authenticated user or group information when determining whether traffic should be permitted. This enables administrators to create access rules that distinguish between users rather than relying solely on source IP addresses. Static routes determine forwarding, IP pools provide addresses for source NAT, and traffic shapers manage bandwidth. Identity-based policy configuration is therefore appropriate when network access requirements depend on authenticated user identity or membership in specific user groups.

Question 120. A FortiGate administrator needs to verify which route FortiGate will use for a particular destination and investigate an unexpected forwarding path. Which information should be examined first?

1. Routing table
2. Web Filter profile
3. Antivirus signature list
4. DHCP reservation table

Correct Answer: 1. Routing table

Explanation :-

The routing table provides the routes FortiGate can use to reach destinations and is a fundamental source of information when investigating unexpected forwarding behavior. Administrators can examine route prefixes, next hops, interfaces, and route sources to understand why a particular path may have been selected. Web Filter and Antivirus profiles control security inspection, while DHCP reservations concern client address assignment. Reviewing the routing table should therefore be an initial step when troubleshooting an unexpected forwarding path.