View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 181. Which FortiGate feature allows an administrator to divide a physical FortiGate into multiple independent virtual firewalls?

1. Security profile group
2. VDOM
3. Service group
4. IP pool

Correct Answer: 2. VDOM

Explanation :-

Virtual domains, or VDOMs, allow a FortiGate to be divided into multiple logical firewall environments. Each VDOM can have its own interfaces, routing configuration, firewall policies, administrators, and security settings, depending on the overall FortiGate configuration. Security profile groups organize inspection profiles, service groups combine service objects, and IP pools provide addresses for source NAT. VDOMs are therefore the feature used when one physical FortiGate must provide logically separated firewall environments for different departments, customers, or network functions.

Question 182. A FortiGate administrator wants to verify which routes are currently installed and being used for forwarding. Which command is most appropriate?

1. get router info routing-table all
2. get system performance status
3. diagnose sys session list
4. show firewall policy

Correct Answer: 1. get router info routing-table all

Explanation :-

The get router info routing-table all command displays the routing table and provides information about routes currently known to the FortiGate. This is useful when troubleshooting connectivity because the administrator can determine whether the expected destination route exists and which next hop or interface FortiGate intends to use. System performance status focuses on resource usage, the session command displays active sessions, and firewall policy output displays policy configuration. The routing-table command is therefore appropriate for examining installed routes.

Question 183. Which FortiGate HA component is primarily responsible for monitoring the health and connectivity of cluster members?

1. Security profiles
2. Virtual IPs
3. HA heartbeat interfaces
4. Service groups

Correct Answer: 3. HA heartbeat interfaces

Explanation :-

HA heartbeat interfaces carry communication used by FortiGate cluster members to monitor each other and exchange important HA information. Reliable heartbeat communication helps the cluster determine member availability and coordinate HA operations. Security profiles inspect traffic, virtual IPs perform destination NAT, and service groups organize service objects. Heartbeat interfaces are therefore a fundamental component of FGCP-based high availability because they allow cluster members to maintain awareness of each other’s status.

Question 184. A firewall policy allows HTTP traffic, but users cannot access the destination because the FortiGate has no route to the server network. What should the administrator check first?

1. Antivirus profile
2. Routing table
3. Web Filter category
4. User group

Correct Answer: 2. Routing table

Explanation :-

A firewall policy alone does not guarantee that traffic can reach its destination. FortiGate must also have an appropriate route to the destination network. If the server network is missing from the routing table, the firewall may accept the traffic but still be unable to forward it correctly. Antivirus, Web Filter, and user-group settings address security or identity controls rather than the fundamental forwarding path. The administrator should therefore verify the routing table and confirm that the expected route and next hop are available.

Question 185. Which FortiGate configuration can reserve a specific IP address for a DHCP client based on its MAC address?

1. DHCP reservation
2. Virtual IP
3. Policy route
4. Service group

Correct Answer: 1. DHCP reservation

Explanation :-

A DHCP reservation associates a specific client identity, commonly its MAC address, with a designated IP address. This allows the client to receive a predictable address whenever it requests a lease from the FortiGate DHCP server. A virtual IP performs destination NAT, a policy route influences forwarding decisions, and a service group combines service definitions. DHCP reservation is therefore the appropriate configuration when a particular DHCP client needs to consistently receive the same IP address.

Question 186. Which FortiGate feature can authenticate users against an external LDAP directory?

1. Traffic shaping
2. LDAP server configuration
3. IP pool
4. Static route

Correct Answer: 2. LDAP server configuration

Explanation :-

FortiGate can be configured to communicate with an LDAP directory for centralized user authentication. After the LDAP server is configured, user groups and authentication-based policies can use directory identities according to the network design. Traffic shaping manages bandwidth, IP pools support source NAT, and static routes determine forwarding paths. LDAP integration is therefore the appropriate mechanism when FortiGate needs to authenticate users against an external directory rather than maintaining every user account locally.

Question 187. Which firewall policy characteristic determines the order in which FortiGate evaluates policies for traffic matching?

1. Policy sequence/order
2. DNS filter category
3. IPsec Phase 2 proposal
4. DHCP lease duration

Correct Answer: 1. Policy sequence/order

Explanation :-

FortiGate evaluates firewall policies according to their configured order, and the first applicable policy that matches the traffic determines how the traffic is handled. This makes policy ordering especially important when multiple policies contain overlapping source, destination, service, or interface criteria. DNS Filter categories control domain filtering, IPsec Phase 2 defines VPN parameters, and DHCP lease duration controls address allocation timing. Policy sequence is therefore a critical factor when troubleshooting unexpected firewall-policy matches.

Question 188. Which FortiGate security feature can block traffic based on known attack signatures and intrusion patterns?

1. Application Control
2. IPS
3. DHCP Server
4. ECMP

Correct Answer: 2. IPS

Explanation :-

Intrusion Prevention System, or IPS, uses signatures and detection techniques to identify known attacks, exploits, and suspicious network activity. When an IPS profile is applied to an appropriate firewall policy, FortiGate can take configured actions such as blocking or logging detected threats. Application Control focuses on application identification and control, DHCP Server provides network configuration, and ECMP manages multiple equal-cost routes. IPS is therefore the security feature specifically designed to detect and prevent recognized network attacks.

Question 189. An administrator needs to allow management access to FortiGate only from a trusted administrative subnet. Which feature can restrict management access by source address?

1. Traffic shaping
2. Trusted hosts
3. Web Filter
4. IPsec monitor

Correct Answer: 2. Trusted hosts

Explanation :-

Trusted hosts can restrict administrative access by specifying the source IP addresses or networks from which an administrator account may connect. This provides an additional access-control layer for management interfaces and can reduce exposure to unauthorized management attempts. Traffic shaping controls bandwidth, Web Filter controls web access, and IPsec Monitor provides VPN status information. Trusted hosts are therefore appropriate when management access should be limited to specific administrative networks or trusted source addresses.

Question 190. Which FortiGate command is useful for viewing currently active sessions passing through the firewall?

1. diagnose sys session list
2. get system status
3. execute backup config
4. show system interface

Correct Answer: 1. diagnose sys session list

Explanation :-

The diagnose sys session list command displays information about active sessions currently tracked by the FortiGate session table. It can be useful for troubleshooting connectivity, verifying whether a session exists, and examining session-related information such as source and destination details, interfaces, and policy references. get system status provides general system information, while configuration backup and interface commands address different administrative tasks. The session-list command is therefore appropriate when investigating active traffic sessions.

Question 191. Which FortiGate feature can combine multiple physical interfaces into a logical interface for increased redundancy or bandwidth?

1. VLAN interface
2. Link aggregation
3. Virtual IP
4. DNS Filter

Correct Answer: 2. Link aggregation

Explanation :-

Link aggregation combines multiple physical network interfaces into a logical aggregated interface. Depending on the configuration and supported protocol, this can provide increased aggregate bandwidth and link redundancy. A VLAN interface creates a logical interface associated with a VLAN, a virtual IP performs destination NAT, and DNS Filter controls DNS-based access. Link aggregation is therefore the appropriate feature when multiple physical links need to operate together as a logical network connection.

Question 192. Which FortiGate feature can redirect unauthenticated users to a web-based authentication page before allowing access to protected resources?

1. Captive portal
2. Static route
3. IP pool
4. Traffic shaper

Correct Answer: 1. Captive portal

Explanation :-

A captive portal can require users to authenticate through a web-based portal before receiving permitted network access. It is commonly used on guest or controlled-access networks where users must sign in before reaching protected resources or the broader internet. Static routes control packet forwarding, IP pools provide NAT addresses, and traffic shapers manage bandwidth. Captive portal is therefore the appropriate FortiGate feature when web-based user authentication must occur before normal network access is granted.

Question 193. Which FortiGate feature can use an address object containing a specific subnet as the source or destination in a firewall policy?

1. Address object
2. Security Fabric connector
3. HA heartbeat
4. Application signature

Correct Answer: 1. Address object

Explanation :-

Address objects represent IP addresses, subnets, ranges, or other supported address definitions that can be referenced in firewall policies. An administrator can create an address object for a specific subnet and then use it as a source or destination condition. Security Fabric connectors support integration with other components, HA heartbeat interfaces support cluster communication, and application signatures identify applications. Address objects are therefore fundamental building blocks for defining the networks that a firewall policy should match.

Question 194. Which FortiGate inspection mode generally processes traffic using flow-based inspection rather than reconstructing the complete content stream for proxy processing?

1. Proxy-based inspection
2. Flow-based inspection
3. Captive portal authentication
4. Static routing

Correct Answer: 2. Flow-based inspection

Explanation :-

Flow-based inspection evaluates traffic as it passes through the FortiGate using security inspection techniques designed to process traffic flows efficiently. Proxy-based inspection instead provides more extensive proxy handling and content processing for supported security functions. Captive portal authentication is an access-control mechanism, while static routing determines packet forwarding. Flow-based inspection is therefore the inspection mode described when FortiGate analyzes traffic flows without relying on full proxy-based reconstruction of the communication.

Question 195. Which FortiGate feature can send logs to an external FortiAnalyzer for centralized storage and analysis?

1. FortiAnalyzer logging
2. DHCP reservation
3. ECMP
4. Service group

Correct Answer: 1. FortiAnalyzer logging

Explanation :-

FortiGate can be configured to send logs to FortiAnalyzer, allowing centralized collection, storage, analysis, and reporting of security and traffic events. This is useful in environments where administrators need historical visibility across one or multiple FortiGate devices. DHCP reservations manage client addressing, ECMP manages equal-cost routing, and service groups combine service objects. FortiAnalyzer logging is therefore the appropriate mechanism when FortiGate logs need to be forwarded to an external centralized analysis platform.

Question 196. Which FortiGate setting can determine which protocols or services are permitted by a firewall policy?

1. Administrative profile
2. Service
3. VDOM
4. Loopback interface

Correct Answer: 2. Service

Explanation :-

The Service field in a FortiGate firewall policy defines the protocols and ports that the policy can match. Standard services such as HTTP, HTTPS, DNS, SSH, and custom services can be selected depending on the required traffic. Administrative profiles control administrator permissions, VDOMs provide logical firewall separation, and loopback interfaces provide logical network endpoints. The service setting is therefore the policy component used to specify which network services the firewall policy permits or denies.

Question 197. Which FortiGate feature can provide a backup configuration file that can be restored if the device configuration needs to be recovered?

1. Configuration backup
2. Application Control
3. Web Filter
4. IPS

Correct Answer: 1. Configuration backup

Explanation :-

Configuration backup allows administrators to save the FortiGate configuration so it can be retained for recovery, migration, or troubleshooting purposes. Maintaining appropriate backups is especially important before significant configuration changes or firmware-related operations. Application Control, Web Filter, and IPS are security features that inspect or control traffic rather than preserve the device configuration. Configuration backup is therefore the appropriate mechanism for creating a recoverable copy of FortiGate settings.

Question 198. A FortiGate administrator wants to test basic IP connectivity to a remote gateway directly from the CLI. Which command should be used?

1. diagnose debug flow
2. execute ping
3. get router info routing-table all
4. diagnose sys session list

Correct Answer: 2. execute ping

Explanation :-

The execute ping command sends ICMP echo requests from the FortiGate and is commonly used to test basic IP reachability to a remote host or gateway. It can help determine whether a destination is reachable through the current routing configuration, although a failed ping does not always prove that the network path is completely unavailable because ICMP may be filtered. Debug flow, routing-table inspection, and session inspection provide different types of diagnostic information. For a basic connectivity test, execute ping is the appropriate command.

Question 199. Which FortiGate feature can protect administrator accounts by requiring an additional authentication factor beyond the password?

1. Two-factor authentication
2. Static route
3. IP pool
4. Service group

Correct Answer: 1. Two-factor authentication

Explanation :-

Two-factor authentication, or 2FA, adds an additional verification step beyond the administrator’s password. Depending on the configured authentication method, the second factor may involve a token or another supported authentication mechanism. Static routes control forwarding, IP pools support address translation, and service groups combine service objects. Two-factor authentication therefore provides an additional layer of protection for administrator accounts and can reduce the impact of compromised passwords.

Question 200. When troubleshooting why traffic is unexpectedly denied, which FortiGate behavior should the administrator remember if no explicit firewall policy matches the traffic?

1. FortiGate automatically creates a temporary allow policy
2. FortiGate forwards the traffic using the first static route
3. The traffic is handled by the implicit deny
4. The traffic is automatically sent to the captive portal

Correct Answer: 3. The traffic is handled by the implicit deny

Explanation :-

FortiGate applies an implicit deny when traffic does not match an explicit firewall policy that permits it. This default behavior is an important part of firewall security because traffic is not automatically allowed simply because a route exists. The administrator should verify the source interface, source address, destination address, service, schedule, and policy order when investigating an unexpected denial. An explicit policy must appropriately match and permit the traffic; otherwise, the implicit deny can prevent the session from being established.