View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 141. Which FortiGate feature allows multiple internal clients to access the internet by translating their private source addresses to a public address?

1. Destination NAT
2. Source NAT
3. Policy route
4. DHCP relay

Correct Answer: 2. Source NAT

Explanation :-

Source NAT changes the source address of traffic as it leaves the internal network. FortiGate commonly uses source NAT to translate private client addresses to a public address when users access the internet. Depending on the configuration, the translated address may be the outgoing interface address or an address from an IP pool. Destination NAT performs the opposite type of translation for incoming services. Policy routes influence forwarding decisions, while DHCP relay forwards DHCP requests. Source NAT is therefore the appropriate mechanism for shared internet access.

Question 142. An administrator wants FortiGate to authenticate users against Microsoft Active Directory through a directory protocol. Which configuration is appropriate?

1. LDAP server
2. IP pool
3. Traffic shaper
4. Virtual IP

Correct Answer: 1. LDAP server

Explanation :-

FortiGate can integrate with directory services using LDAP. When configured correctly, an LDAP server definition allows FortiGate to communicate with a directory and authenticate users or retrieve group information for identity-based access control. An IP pool provides source NAT addresses, a traffic shaper controls bandwidth, and a virtual IP performs destination NAT. LDAP is therefore the appropriate configuration when FortiGate needs to use an existing directory service for authentication and user-group-based access policies.

Question 143. Which FortiGate feature can prevent users from accessing websites categorized as phishing or malware-related?

1. Static route
2. Web Filter
3. DHCP server
4. Link aggregation

Correct Answer: 2. Web Filter

Explanation :-

Web Filter can use FortiGuard web-rating information to classify websites and apply configured actions to categories such as phishing, malware, or other unwanted content. The administrator can configure category-based policies and apply the Web Filter profile to relevant firewall policies. Static routes control forwarding, DHCP provides network addresses, and link aggregation combines physical links. Web Filter is therefore the appropriate security feature when access to dangerous or unwanted website categories needs to be restricted.

Question 144. Which FortiGate CLI command is commonly used to view the current system performance and resource usage?

1. get system performance status
2. execute ping
3. show firewall policy
4. diagnose sniffer packet

Correct Answer: 1. get system performance status

Explanation :-

The get system performance status command provides information about FortiGate system performance and resource utilization. Administrators can use performance information when investigating high CPU usage, memory consumption, session load, or other resource-related conditions. execute ping tests connectivity, show firewall policy displays policy configuration, and diagnose sniffer packet provides packet-level visibility. Performance status is therefore useful when troubleshooting whether the FortiGate itself is experiencing a resource-related condition.

Question 145. Which FortiGate feature can distribute traffic among multiple backend servers associated with a virtual server configuration?

1. Web Filter
2. Server Load Balance
3. DHCP Relay
4. Static Route

Correct Answer: 2. Server Load Balance

Explanation :-

FortiGate virtual server functionality can provide server load balancing by distributing client connections among configured real servers. This allows multiple backend servers to provide a service behind a common virtual address and can improve availability and resource utilization. Web Filter controls website access, DHCP Relay forwards DHCP requests, and Static Route determines network forwarding. Server load balancing is therefore the appropriate functionality when incoming connections need to be distributed across multiple backend servers.

Question 146. Which FortiGate feature can allow administrators to create a separate routing table and policy environment for a virtual firewall instance?

1. VDOM
2. IP Pool
3. Service Group
4. Web Filter

Correct Answer: 1. VDOM

Explanation :-

A Virtual Domain, or VDOM, provides a logically independent firewall environment within a FortiGate appliance. Depending on the deployment and configuration, a VDOM can have its own interfaces, policies, routing information, and other system resources. IP pools support source NAT, service groups organize service definitions, and Web Filter controls website access. VDOMs are therefore useful when an organization needs separate routing and security environments while operating them on the same physical FortiGate platform.

Question 147. Which FortiGate feature can restrict administrator access based on the source IP address of the management connection?

1. Trusted hosts
2. Application Control
3. IPsec Phase 2
4. Traffic Shaping

Correct Answer: 1. Trusted hosts

Explanation :-

Trusted hosts can restrict where an administrator is allowed to authenticate from by specifying permitted source IP addresses or networks. This reduces the exposure of administrative interfaces because credentials cannot be used successfully from arbitrary source locations when trusted-host restrictions are enforced. Application Control manages applications, IPsec Phase 2 defines protected VPN traffic, and Traffic Shaping manages bandwidth. Trusted hosts are therefore an important access-control mechanism for limiting administrative login sources.

Question 148. An administrator needs to inspect traffic to determine whether a firewall policy is receiving packets from a specific source address. Which diagnostic tool should be used?

1. Packet sniffer
2. Configuration backup
3. Firmware manager
4. User group

Correct Answer: 1. Packet sniffer

Explanation :-

A packet sniffer provides direct visibility into packets observed by FortiGate. Administrators can apply filters based on source address, destination address, protocol, or port to determine whether the expected packets are reaching an interface. Configuration backups preserve settings, firmware management handles software updates, and user groups organize authenticated identities. A packet sniffer is therefore especially useful when troubleshooting whether traffic is actually arriving before investigating higher-level policy or security-profile behavior.

Question 149. Which FortiGate routing feature allows administrators to define different forwarding behavior based on criteria such as source address and destination address?

1. Policy-based routing
2. Web Filter
3. Antivirus
4. DNS Filter

Correct Answer: 1. Policy-based routing

Explanation :-

Policy-based routing allows FortiGate to make forwarding decisions using configured traffic criteria rather than relying exclusively on the normal destination-based routing table. Criteria can include source and destination addresses and other supported attributes. This makes PBR useful for scenarios such as directing traffic from particular users or networks through a specific ISP. Web Filter, Antivirus, and DNS Filter are security inspection features and do not determine routing paths. Policy-based routing is therefore the appropriate feature for criteria-based forwarding decisions.

Question 150. Which FortiGate security profile is responsible for controlling applications such as peer-to-peer services, messaging applications, or streaming platforms?

1. Web Filter
2. Application Control
3. Antivirus
4. DNS Filter

Correct Answer: 2. Application Control

Explanation :-

Application Control identifies network applications and allows administrators to apply actions to them. It can be configured to allow, monitor, or block applications and application categories according to organizational requirements. Web Filter focuses primarily on websites and web categories, Antivirus detects malicious content, and DNS Filter evaluates DNS requests and domains. Application Control is therefore the appropriate security profile when administrators need to control specific applications such as peer-to-peer software, messaging platforms, or streaming services.

Question 151. Which FortiGate feature can provide encrypted communication between two fixed network locations over the internet?

1. Site-to-site IPsec VPN
2. Web Filter
3. DHCP Relay
4. Traffic Shaper

Correct Answer: 1. Site-to-site IPsec VPN

Explanation :-

A site-to-site IPsec VPN creates an encrypted tunnel between two network locations, allowing private traffic to traverse an untrusted network such as the internet. The tunnel uses IPsec and IKE negotiation to establish secure communications between the VPN peers. Web Filter controls web access, DHCP Relay forwards DHCP messages, and Traffic Shaper controls bandwidth. Site-to-site IPsec VPN is therefore the appropriate solution when two fixed networks need secure connectivity over a public network.

Question 152. Which FortiGate component can store information about active TCP and UDP connections passing through the firewall?

1. Session table
2. Web Filter
3. FortiGuard category database
4. DHCP reservation

Correct Answer: 1. Session table

Explanation :-

The FortiGate session table maintains state information about active traffic sessions. It can contain details associated with connections such as source and destination addresses, ports, interfaces, policy information, and session state. This information is important for stateful firewall processing and troubleshooting. Web Filter controls web access, FortiGuard categorization provides classification information, and DHCP reservations manage predictable address assignment. The session table is therefore the component that tracks active network connections through the FortiGate.

Question 153. An administrator wants to allow users to access a web application only from 9:00 AM to 5:00 PM on weekdays. Which FortiGate feature should be used?

1. IP Pool
2. Schedule
3. Virtual IP
4. Address Group

Correct Answer: 2. Schedule

Explanation :-

A firewall policy schedule can define the days and times during which a policy is active. A recurring schedule can be configured for weekdays between the required start and end times, and the schedule can then be associated with the policy controlling access to the web application. IP pools provide source NAT addresses, virtual IPs provide destination NAT, and address groups organize network objects. A schedule is therefore the appropriate feature for enforcing time-based access restrictions.

Question 154. Which FortiGate feature can identify a user’s group membership after successful authentication and use it in access policies?

1. User group
2. IP pool
3. Static route
4. Traffic shaper

Correct Answer: 1. User group

Explanation :-

User groups allow FortiGate to organize authenticated users and, depending on the configured authentication source, use group membership for access control. This is especially useful when organizations need different network permissions for different departments or roles. IP pools provide NAT addresses, static routes determine packet forwarding, and traffic shapers manage bandwidth. User groups are therefore appropriate when firewall policies need to distinguish users based on their authenticated directory or local group membership.

Question 155. Which FortiGate feature can detect and block malicious traffic using signatures maintained by FortiGuard?

1. DHCP Server
2. IPS
3. Interface Zone
4. Static Route

Correct Answer: 2. IPS

Explanation :-

FortiGate IPS uses intrusion-prevention signatures and related security intelligence to identify known malicious or suspicious traffic patterns. When a configured IPS profile detects matching traffic, it can take actions such as blocking or logging the event. DHCP Server provides network configuration, Interface Zones group interfaces, and Static Routes control forwarding. IPS is therefore the FortiGate security feature intended to identify and prevent recognized network attacks using signature-based inspection.

Question 156. Which FortiGate feature allows an administrator to define a service using a specific TCP port that is not included in the standard service objects?

1. Custom service
2. Address group
3. VDOM
4. Policy route

Correct Answer: 1. Custom service

Explanation :-

A custom service object allows administrators to define protocol and port combinations that are not represented by the default FortiGate service objects. The custom service can then be referenced by firewall policies to control access to the application using that non-standard port. Address groups organize network addresses, VDOMs provide logical firewall separation, and policy routes control forwarding paths. A custom service is therefore the correct configuration when a specific TCP or UDP port must be explicitly defined for policy matching.

Question 157. Which FortiGate feature can send security and traffic logs to a centralized Fortinet logging appliance?

1. FortiAnalyzer integration
2. DHCP relay
3. IP pool
4. Link aggregation

Correct Answer: 1. FortiAnalyzer integration

Explanation :-

FortiAnalyzer integration allows FortiGate to forward logs to a centralized Fortinet platform for storage, analysis, reporting, and investigation. Centralized logging is useful when administrators need visibility across multiple FortiGate devices or require historical security and traffic information. DHCP relay forwards DHCP messages, IP pools support source NAT, and link aggregation combines physical interfaces. FortiAnalyzer integration is therefore appropriate when FortiGate logs need to be centrally collected and analyzed within a Fortinet logging environment.

Question 158. Which FortiGate feature can provide a stable logical address for routing protocols or management without depending directly on a physical interface?

1. Loopback interface
2. Virtual IP
3. IP pool
4. DHCP scope

Correct Answer: 1. Loopback interface

Explanation :-

A loopback interface is a logical interface that is not directly tied to the operational state of a particular physical port. Its stable address can be useful for routing protocols, management, monitoring, or other services that benefit from a consistent logical endpoint. A virtual IP is used for address translation, an IP pool supports source NAT, and a DHCP scope assigns addresses to clients. A loopback interface is therefore suitable when a persistent logical address is required.

Question 159. Which FortiGate configuration determines whether an administrator can access the GUI through HTTPS on a particular interface?

1. Administrative access settings
2. Application Control
3. IPsec Phase 2
4. Traffic Shaping

Correct Answer: 1. Administrative access settings

Explanation :-

FortiGate interfaces can be configured with administrative access options that determine which management protocols are available through those interfaces. HTTPS can be enabled to provide secure GUI access, while other management services such as SSH can be controlled separately. Application Control, IPsec Phase 2, and Traffic Shaping serve different purposes. Administrative access settings are therefore the relevant configuration when determining whether the FortiGate GUI can be reached through HTTPS on a particular interface.

Question 160. An administrator suspects that FortiGate is dropping traffic because no firewall policy matches the packet. Which behavior should the administrator expect?

1. The traffic is automatically accepted.
2. The traffic is translated using the default IP pool.
3. The traffic is denied by the implicit policy.
4. The traffic is automatically routed through every available interface.

Correct Answer: 3. The traffic is denied by the implicit policy.

Explanation :-

FortiGate uses an implicit deny behavior for traffic that does not match an applicable firewall policy that permits it. This means administrators must explicitly configure policies for traffic that should be allowed. Unmatched traffic is not automatically accepted, translated using an arbitrary IP pool, or forwarded through every available interface. When troubleshooting a dropped packet, administrators should therefore verify the source, destination, interfaces, service, schedule, and policy order to determine why no intended allow policy matched the traffic.