View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 201. Which FortiGate feature allows an administrator to assign different security policies to traffic based on the authenticated user rather than only the source IP address?

1. Identity-based policy
2. Static route
3. IP pool
4. Link aggregation

Correct Answer: 1. Identity-based policy

Explanation :-

An identity-based policy allows FortiGate to use authenticated user or group information when determining whether traffic should be permitted. This is useful when access needs to follow user identity rather than relying only on network addresses. Static routes determine forwarding paths, IP pools provide addresses for source NAT, and link aggregation combines physical interfaces. Identity-based policies can work with supported authentication methods and user groups, allowing administrators to create more granular access controls for authenticated users.

Question 202. Which FortiGate command displays detailed information about the current system resource utilization, including CPU and memory usage?

1. execute ping
2. get system performance status
3. show firewall policy
4. diagnose sys session list

Correct Answer: 2. get system performance status

Explanation :-

The get system performance status command provides information about FortiGate system performance and resource utilization. It can be useful when investigating high CPU or memory usage, system responsiveness, or performance-related problems. execute ping tests connectivity, show firewall policy displays firewall configuration, and diagnose sys session list focuses on active sessions. When an administrator needs a quick view of the FortiGate’s current resource condition, the system performance command is an appropriate diagnostic tool.

Question 203. Which FortiGate feature can apply a different action to traffic based on the website category identified by FortiGuard services?

1. Web Filter
2. ECMP
3. DHCP Server
4. Loopback interface

Correct Answer: 1. Web Filter

Explanation :-

Web Filter can use FortiGuard web categorization to classify websites and apply configured actions to those categories. Administrators can allow, block, monitor, or otherwise control access according to the organization’s security requirements. ECMP manages multiple equal-cost routes, DHCP Server assigns network configuration, and a loopback interface provides a logical network endpoint. Web Filter is therefore the FortiGate security feature used when web access needs to be controlled according to website categories.

Question 204. A FortiGate administrator needs to translate the source address of internal clients to the IP address of the outgoing interface. Which NAT method is appropriate?

1. Destination NAT through a VIP
2. Source NAT using the outgoing interface address
3. DHCP reservation
4. Static routing

Correct Answer: 2. Source NAT using the outgoing interface address

Explanation :-

Source NAT using the outgoing interface address translates the private source address of internal clients to the IP address assigned to the FortiGate’s outgoing interface. This is a common configuration for internet-bound traffic when clients should appear to external systems as the firewall’s public interface address. A VIP performs destination NAT for inbound connections, DHCP reservations assign predictable client addresses, and static routing determines forwarding. Source NAT is therefore the appropriate mechanism for translating internal client source addresses.

Question 205. Which FortiGate feature can associate multiple interfaces with one logical security zone so that policies can reference the zone instead of each interface individually?

1. Interface zone
2. Service group
3. IP pool
4. Security profile group

Correct Answer: 1. Interface zone

Explanation :-

An interface zone groups multiple interfaces into a logical security object that can be referenced by firewall policies. This can simplify policy management when several interfaces should receive similar treatment. A service group combines service definitions, an IP pool provides addresses for source NAT, and a security profile group combines security profiles. An interface zone is therefore useful when administrators want to reduce repetitive interface references while maintaining consistent policy behavior across multiple interfaces.

Question 206. Which FortiGate feature is designed to detect applications based on application signatures and traffic characteristics?

1. Application Control
2. Static routing
3. DHCP relay
4. HA heartbeat

Correct Answer: 1. Application Control

Explanation :-

Application Control identifies applications using FortiGate application signatures and related traffic characteristics. It can then apply configured actions such as allowing, monitoring, or blocking selected applications. Static routing determines packet forwarding, DHCP relay forwards DHCP requests between network segments, and HA heartbeat communication supports cluster operation. Application Control is therefore the appropriate security feature when administrators need visibility or control based on the application generating network traffic rather than simply its IP address or port.

Question 207. Which FortiGate component is responsible for forwarding DHCP requests between a client network and an external DHCP server?

1. DHCP server
2. DHCP relay
3. DNS Filter
4. Virtual IP

Correct Answer: 2. DHCP relay

Explanation :-

DHCP relay allows DHCP requests from clients on one network segment to be forwarded to a DHCP server located on another network segment. This is useful when the FortiGate is not itself providing DHCP services but needs to relay requests between clients and a centralized DHCP server. A DHCP server directly assigns addresses, DNS Filter controls DNS-based access, and a virtual IP performs destination NAT. DHCP relay is therefore appropriate when DHCP services are hosted on a separate network.

Question 208. Which FortiGate feature can inspect encrypted traffic by decrypting SSL/TLS sessions so that security profiles can inspect the underlying content?

1. Certificate inspection
2. Deep inspection
3. Traffic shaping
4. Static routing

Correct Answer: 2. Deep inspection

Explanation :-

Deep inspection can decrypt supported SSL/TLS traffic so FortiGate security profiles can inspect the underlying content. Because this involves interception and re-encryption, appropriate certificates and client trust configuration are important. Certificate inspection provides visibility into certificate information without performing equivalent full content decryption. Traffic shaping controls bandwidth, while static routing controls forwarding. Deep inspection is therefore the appropriate inspection method when administrators need security inspection of the contents of encrypted sessions.

Question 209. Which FortiGate feature can distribute incoming connections across multiple backend servers?

1. Server Load Balance
2. DNS Filter
3. IPsec Monitor
4. DHCP reservation

Correct Answer: 1. Server Load Balance

Explanation :-

FortiGate server load balancing can distribute incoming connections among multiple backend servers according to configured virtual server and load-balancing settings. This can improve service availability and distribute client requests across a server pool. DNS Filter controls domain-based access, IPsec Monitor displays VPN status, and DHCP reservations provide predictable client addresses. Server Load Balance is therefore the appropriate feature when external clients should access a service through FortiGate while connections are distributed among multiple internal servers.

Question 210. Which FortiGate routing decision generally takes precedence when multiple routes match the same destination network but have different prefix lengths?

1. Route with the longest prefix match
2. Route with the highest metric only
3. Route with the oldest creation time
4. Route with the largest interface number

Correct Answer: 1. Route with the longest prefix match

Explanation :-

FortiGate uses the longest prefix match principle when selecting among routes that match a destination. A more specific route, such as a /24, takes precedence over a less specific route, such as a /16, when both cover the destination address. Metrics and administrative distance can also influence route selection when routes have comparable prefixes, but the most specific matching prefix is considered first. This principle is fundamental to understanding how FortiGate chooses forwarding paths when multiple routes overlap.

Question 211. Which FortiGate feature can provide centralized authentication using a RADIUS server?

1. RADIUS server configuration
2. Loopback interface
3. Traffic shaper
4. Virtual IP

Correct Answer: 1. RADIUS server configuration

Explanation :-

FortiGate can integrate with a RADIUS server for centralized authentication. This allows authentication requests to be handled by an external RADIUS infrastructure rather than requiring all credentials to be maintained locally on the FortiGate. A loopback interface provides a logical network endpoint, a traffic shaper controls bandwidth, and a virtual IP performs destination NAT. RADIUS integration is therefore appropriate when an organization already uses a centralized authentication service and wants FortiGate users or administrators to authenticate through it.

Question 212. Which FortiGate diagnostic command can capture packets entering or leaving a specific interface for troubleshooting?

1. diagnose sniffer packet
2. get system status
3. show firewall address
4. execute backup config

Correct Answer: 1. diagnose sniffer packet

Explanation :-

The diagnose sniffer packet command provides packet-capture functionality directly on the FortiGate. Administrators can specify an interface and apply filters to focus on relevant traffic. This can help determine whether packets are reaching the firewall, identify source and destination information, and investigate protocol behavior. get system status provides general device information, show firewall address displays address configuration, and configuration backup saves settings. Packet sniffer is therefore an important tool for low-level network troubleshooting.

Question 213. Which FortiGate feature can limit the number of concurrent sessions or control resource consumption for selected traffic?

1. Traffic shaping
2. Address object
3. VLAN interface
4. DNS server

Correct Answer: 1. Traffic shaping

Explanation :-

Traffic shaping provides mechanisms for controlling bandwidth consumption and managing traffic resources. Depending on the configured shaping method and policy settings, administrators can regulate how selected traffic uses available network capacity. Address objects define network identities, VLAN interfaces provide logical interfaces for VLANs, and DNS server settings control name-resolution behavior. Traffic shaping is therefore the relevant feature when the objective is to manage traffic resource consumption rather than define network addressing or routing.

Question 214. Which FortiGate configuration is used to define a protocol and port combination that is not available in the default service list?

1. Custom service
2. Address group
3. User group
4. VDOM

Correct Answer: 1. Custom service

Explanation :-

A custom service allows administrators to define specific protocols and port ranges when the required traffic does not correspond to an existing predefined service object. The custom service can then be selected in firewall policies to control that traffic. Address groups combine address objects, user groups organize authenticated identities, and VDOMs provide logical firewall separation. Custom services are therefore appropriate when an application or network requirement uses a non-standard port or protocol combination that needs explicit policy control.

Question 215. Which FortiGate feature allows multiple administrators to have different levels of permissions when managing the device?

1. Administrator profiles
2. IP pools
3. Static routes
4. Web Filter profiles

Correct Answer: 1. Administrator profiles

Explanation :-

Administrator profiles define the permissions available to FortiGate administrators. They can be used to provide different levels of access, such as read-only permissions or broader configuration privileges, depending on the assigned profile. IP pools support source NAT, static routes control forwarding, and Web Filter profiles control website access. Administrator profiles are therefore essential for role-based administrative access and help ensure that each administrator receives only the permissions required for their responsibilities.

Question 216. Which FortiGate feature can log security events and traffic information locally on the appliance for later review?

1. Local logging
2. ECMP
3. DHCP relay
4. Link aggregation

Correct Answer: 1. Local logging

Explanation :-

FortiGate can store supported logs locally on the appliance, allowing administrators to review traffic, security, system, and event information depending on the configured logging settings and available storage. Local logging can be useful for troubleshooting and operational monitoring, while external logging platforms can provide additional centralized storage and analysis. ECMP handles routing, DHCP relay forwards DHCP requests, and link aggregation combines interfaces. Local logging is therefore the relevant feature for retaining log information directly on the FortiGate.

Question 217. Which FortiGate feature can authenticate users against a local database maintained directly on the firewall?

1. Local users
2. ECMP
3. Web Filter
4. Virtual server

Correct Answer: 1. Local users

Explanation :-

FortiGate supports local user accounts that are stored in the device’s own configuration. These accounts can be used for supported authentication scenarios and can be organized into user groups for policy-based access. ECMP provides multiple equal-cost routing paths, Web Filter controls website access, and virtual servers can provide traffic distribution or publishing functionality. Local users are therefore appropriate when authentication credentials need to be maintained directly on the FortiGate rather than through an external directory service.

Question 218. Which FortiGate feature can help identify whether a firewall policy is being matched by displaying policy-related traffic information in FortiView?

1. FortiView
2. DHCP relay
3. IP pool
4. Loopback interface

Correct Answer: 1. FortiView

Explanation :-

FortiView provides graphical and tabular visibility into traffic, applications, users, security events, and other operational information. Depending on the view and FortiOS configuration, administrators can use it to investigate traffic behavior and identify information associated with firewall policies and sessions. DHCP relay handles DHCP forwarding, IP pools provide NAT addresses, and loopback interfaces provide logical endpoints. FortiView is therefore useful for quickly analyzing traffic patterns and investigating whether expected policy behavior is occurring.

Question 219. Which FortiGate feature can automatically distribute traffic across multiple available internet connections when equal-cost routes are configured?

1. ECMP
2. Antivirus
3. Captive portal
4. LDAP

Correct Answer: 1. ECMP

Explanation :-

Equal-Cost Multi-Path routing allows FortiGate to use multiple routes with equivalent routing characteristics. When multiple internet paths have equal routing preference, ECMP can enable traffic to use more than one available path according to the configured ECMP behavior. Antivirus inspects traffic for malware, captive portal provides user authentication, and LDAP provides directory-based authentication. ECMP is therefore the routing mechanism relevant to using multiple equal-cost paths for internet connectivity and redundancy.

Question 220. Which FortiGate security profile is designed to identify and control applications such as social media, peer-to-peer applications, or messaging services?

1. Application Control
2. DHCP Server
3. Static route
4. HA heartbeat

Correct Answer: 1. Application Control

Explanation :-

Application Control identifies network applications using FortiGate application signatures and allows administrators to define actions for selected applications or application categories. This can be used to control services such as social media, peer-to-peer applications, messaging platforms, and other recognized applications. DHCP Server provides client network configuration, static routes determine packet forwarding, and HA heartbeat supports cluster communication. Application Control is therefore the appropriate security profile when traffic needs to be controlled according to application identity.