View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 261. Which FortiGate feature allows an administrator to create a logical collection of interfaces and reference them collectively in firewall policies?

1. Interface zone
2. IP pool
3. Virtual IP
4. Service group

Correct Answer: 1. Interface zone

Explanation :-

An interface zone allows multiple FortiGate interfaces to be grouped into a logical object that can be referenced by firewall policies. This can simplify policy configuration when several interfaces should have similar security treatment. An IP pool provides addresses for source NAT, a virtual IP performs destination NAT, and a service group combines service objects. Interface zones are therefore useful for reducing repetitive policy configuration while maintaining consistent access control across several interfaces.

Question 262. A FortiGate administrator needs to verify whether a firewall policy is actually receiving traffic. Which information can be reviewed directly in the policy configuration?

1. DNS cache entries
2. Policy hit count
3. DHCP lease duration
4. IPsec encryption algorithm

Correct Answer: 2. Policy hit count

Explanation :-

Policy hit information can help administrators determine whether traffic has matched a particular firewall policy. When troubleshooting policy behavior, reviewing hit counts and associated logging can provide evidence that a rule is being used. DNS cache entries, DHCP lease duration, and IPsec encryption algorithms address different functions and do not directly indicate whether a firewall policy is receiving traffic. Policy hit information is therefore useful for validating policy usage and identifying rules that may not be matching expected traffic.

Question 263. Which FortiGate feature can use a predefined set of security profiles together so they can be applied consistently to multiple firewall policies?

1. Security profile group
2. Address group
3. User group
4. IP pool

Correct Answer: 1. Security profile group

Explanation :-

A security profile group combines selected security profiles into a reusable collection. This can simplify policy administration by allowing administrators to apply a consistent set of protections to multiple firewall policies. Address groups combine network addresses, user groups combine authenticated users, and IP pools provide addresses for source NAT. Security profile groups are therefore useful when several policies should use a standardized combination of protections such as Antivirus, IPS, Web Filter, and Application Control.

Question 264. Which FortiGate feature can authenticate administrators or users using a centralized directory based on LDAP?

1. ECMP
2. LDAP
3. Traffic shaping
4. Virtual IP

Correct Answer: 2. LDAP

Explanation :-

LDAP integration allows FortiGate to communicate with an external directory service for authentication and identity-related access control. This is useful when an organization maintains centralized user accounts and wants FortiGate to use those identities instead of maintaining every account locally. ECMP manages multiple equal-cost routes, traffic shaping controls bandwidth, and virtual IPs perform destination NAT. LDAP is therefore the appropriate authentication mechanism when credentials and group information are maintained in an external directory service.

Question 265. Which FortiGate feature is used to define a manually configured route to a destination network?

1. Static route
2. Application Control
3. Web Filter
4. Captive portal

Correct Answer: 1. Static route

Explanation :-

A static route is a manually configured route that specifies how FortiGate should reach a particular destination network. It can define a destination prefix, gateway or next hop, and outgoing interface as appropriate. Application Control identifies applications, Web Filter controls web access, and captive portal provides authentication through a web interface. Static routes are therefore appropriate when an administrator needs to explicitly define a forwarding path rather than relying on a dynamically learned route.

Question 266. Which FortiGate feature can determine whether traffic belongs to a known application and then apply a configured action?

1. DHCP relay
2. Application Control
3. Static route
4. HA heartbeat

Correct Answer: 2. Application Control

Explanation :-

Application Control uses FortiGate application signatures and traffic characteristics to identify applications. Administrators can then configure actions for recognized applications, such as allowing, monitoring, or blocking them. DHCP relay forwards DHCP requests, static routes control forwarding paths, and HA heartbeat communication supports cluster operation. Application Control is therefore the appropriate feature when the security decision needs to be based on application identity rather than simply on IP addresses or service ports.

Question 267. Which FortiGate feature can provide a backup path when the primary route becomes unavailable, assuming an appropriate route with a different administrative distance is configured?

1. Web Filter
2. Antivirus
3. Floating static route
4. Service group

Correct Answer: 3. Floating static route

Explanation :-

A floating static route can be configured with a higher administrative distance than a preferred route. Under normal conditions, the preferred route is selected, while the floating static route can become active when the preferred route is no longer available. Web Filter and Antivirus are security profiles, while a service group combines service objects. A floating static route is therefore useful for providing a manually configured backup forwarding path when redundancy is required and dynamic routing is not being used for that purpose.

Question 268. Which FortiGate command can display the configured firewall policies from the CLI?

1. show firewall policy
2. execute ping
3. get system performance status
4. diagnose sniffer packet

Correct Answer: 1. show firewall policy

Explanation :-

The show firewall policy command displays firewall policy configuration from the FortiGate CLI. Administrators can use it to inspect policy IDs, source and destination objects, services, schedules, actions, NAT settings, and associated security profiles. execute ping is used for connectivity testing, get system performance status provides resource information, and diagnose sniffer packet captures traffic. The firewall policy command is therefore appropriate when an administrator needs to review the configured policy definitions directly from the CLI.

Question 269. Which FortiGate feature can allow an administrator to see applications, users, destinations, and traffic patterns through a graphical monitoring interface?

1. DHCP server
2. FortiView
3. IP pool
4. Link aggregation

Correct Answer: 2. FortiView

Explanation :-

FortiView provides graphical and detailed visibility into traffic and security activity on FortiGate. Depending on the selected view and available logging information, administrators can investigate applications, users, destinations, sources, sessions, and security events. DHCP Server provides client addressing, IP pools support source NAT, and link aggregation combines physical interfaces. FortiView is therefore the appropriate monitoring feature when administrators need an operational overview of network activity and want to drill into traffic information through the FortiGate interface.

Question 270. Which FortiGate feature is used to define the protocol and destination port that a firewall policy should match?

1. Schedule
2. Address object
3. Service
4. User group

Correct Answer: 3. Service

Explanation :-

A service object defines the protocol and port or port range that FortiGate should match when evaluating traffic against a firewall policy. Standard services such as HTTP, HTTPS, SSH, and DNS can be used, and administrators can create custom services for non-standard requirements. Schedules define when policies are active, address objects identify network endpoints, and user groups identify authenticated users. The Service field is therefore the policy component that controls which network protocols and ports are matched.

Question 271. Which FortiGate feature can use FortiGuard intelligence to categorize websites and determine whether access should be permitted?

1. Web Filter
2. ECMP
3. IPsec Monitor
4. DHCP relay

Correct Answer: 1. Web Filter

Explanation :-

Web Filter can use FortiGuard web categorization and reputation information to classify websites and apply configured access actions. Administrators can configure categories according to organizational requirements, including blocking or monitoring selected categories. ECMP provides multiple equal-cost routing paths, IPsec Monitor displays VPN information, and DHCP relay forwards DHCP requests. Web Filter is therefore the appropriate FortiGate security feature when website access needs to be controlled using category or reputation information.

Question 272. Which FortiGate feature allows a device to forward DHCP requests to a DHCP server located on another network?

1. DHCP relay
2. DHCP reservation
3. DNS Filter
4. Virtual IP

Correct Answer: 1. DHCP relay

Explanation :-

DHCP relay forwards DHCP client requests between a local client network and a DHCP server located on another network. This is useful when a centralized DHCP server serves multiple network segments and FortiGate is responsible for forwarding the requests. DHCP reservation assigns a predictable address to a particular client, DNS Filter controls DNS-based access, and virtual IP provides destination NAT. DHCP relay is therefore the correct feature when FortiGate needs to connect clients with a remote DHCP server.

Question 273. Which FortiGate feature can provide encrypted connectivity between two private networks across the public Internet?

1. Web Filter
2. IPsec VPN
3. Traffic shaping
4. Address group

Correct Answer: 2. IPsec VPN

Explanation :-

An IPsec VPN can establish an encrypted tunnel between two private networks across an untrusted network such as the Internet. FortiGate uses IPsec negotiation and security parameters to establish and protect the tunnel according to the configured VPN design. Web Filter controls website access, Traffic Shaping manages bandwidth, and Address Groups organize network addresses. IPsec VPN is therefore the appropriate technology for securely connecting geographically separated private networks over a public network.

Question 274. Which FortiGate feature can inspect traffic for malicious network activity by comparing it against intrusion signatures?

1. IPS
2. DHCP Server
3. IP pool
4. Loopback interface

Correct Answer: 1. IPS

Explanation :-

The Intrusion Prevention System examines traffic for known attack patterns and signatures. When an IPS profile is applied to a firewall policy, FortiGate can detect, log, and potentially block traffic associated with recognized threats according to the configured action. DHCP Server provides client addressing, IP pools provide NAT addresses, and loopback interfaces provide logical endpoints. IPS is therefore the security feature intended to identify and protect against network attacks using intrusion detection and prevention techniques.

Question 275. Which FortiGate feature can restrict an administrator account so that management access is accepted only from specified trusted IP addresses?

1. Trusted hosts
2. Application Control
3. Security profile group
4. ECMP

Correct Answer: 1. Trusted hosts

Explanation :-

Trusted hosts restrict where an administrator account can be used to access FortiGate management services. Administrators can specify trusted source IP addresses or networks, reducing the exposure of management access to unauthorized locations. Application Control identifies applications, security profile groups combine security profiles, and ECMP manages equal-cost routes. Trusted hosts are therefore particularly useful as an additional administrative security control when management access should be limited to designated networks or workstation addresses.

Question 276. Which FortiGate feature allows an administrator to inspect the current active connection entries maintained by the firewall?

1. get system status
2. diagnose sys session list
3. execute ping
4. show firewall address

Correct Answer: 2. diagnose sys session list

Explanation :-

The diagnose sys session list command displays active sessions currently maintained in the FortiGate session table. Session information can help administrators troubleshoot connectivity, identify whether traffic has established a session, and investigate source and destination information or policy references. get system status provides general system details, execute ping tests connectivity, and show firewall address displays address configuration. The session-list command is therefore the appropriate diagnostic tool when investigating active connections through the firewall.

Question 277. Which FortiGate feature can provide centralized storage and analysis of logs generated by one or more FortiGate devices?

1. FortiAnalyzer
2. DHCP relay
3. Virtual IP
4. VLAN interface

Correct Answer: 1. FortiAnalyzer

Explanation :-

FortiAnalyzer is designed to collect, store, analyze, and report on logs from Fortinet security devices. FortiGate can forward supported traffic, security, and event logs to FortiAnalyzer, allowing administrators to perform centralized investigations and generate reports. DHCP relay forwards DHCP requests, virtual IPs perform destination NAT, and VLAN interfaces provide connectivity to tagged networks. FortiAnalyzer is therefore the appropriate centralized logging platform when organizations need broader historical analysis than local FortiGate logs alone can provide.

Question 278. Which FortiGate feature can combine several related TCP or UDP ports into a single reusable service definition?

1. Address group
2. Custom service
3. User group
4. Loopback interface

Correct Answer: 2. Custom service

Explanation :-

A custom service can define protocols and port ranges that are not represented by an existing predefined service. Administrators can then use the custom service in firewall policies to control applications or network services using specific ports. Address groups combine network addresses, user groups combine authenticated identities, and loopback interfaces provide logical endpoints. Custom services are therefore useful when a firewall policy needs to match a non-standard or specifically defined TCP or UDP port range.

Question 279. Which FortiGate routing principle selects the most specific route when multiple routes match a destination IP address?

1. Highest interface number
2. Longest prefix match
3. Oldest route
4. Largest gateway address

Correct Answer: 2. Longest prefix match

Explanation :-

The longest prefix match principle means FortiGate prefers the route with the most specific destination prefix when multiple routes match the same destination address. For example, a route for a /24 network is more specific than a route for the encompassing /16 network and will be selected for destinations within that /24 when both are available. This principle is fundamental to routing decisions and helps ensure that more specific network paths override broader destination routes when appropriate.

Question 280. A FortiGate administrator wants to reduce the available bandwidth consumed by a particular class of traffic without blocking it. Which feature should be used?

1. Virtual IP
2. Traffic Shaping
3. LDAP
4. IPsec Phase 1

Correct Answer: 2. Traffic Shaping

Explanation :-

Traffic Shaping allows FortiGate administrators to control how much bandwidth selected traffic can consume without necessarily blocking that traffic. Shaping can be applied to appropriate firewall policies or traffic classes to manage network capacity and prevent a particular type of traffic from consuming excessive resources. Virtual IP provides destination NAT, LDAP supports external authentication, and IPsec Phase 1 establishes VPN negotiation parameters. Traffic Shaping is therefore the appropriate feature when traffic should remain permitted but its bandwidth usage needs to be controlled.