NSE4_FGT_AD-7.6: Fortinet NSE 4 - FortiOS 7.6 Administrator Fortigate Practice Questions

There are multiple dialup IPsec VPNs configured in aggressive mode on the HQ FortiGate. The requirement is to connect dial-up users to their respective department VPN tunnels. Which phase 1 setting you can configure to match the user to the tunnel?

• AA. Local Gateway
• BB. Dead Peer Detection
• CC. Peer ID
• DD. IKE Mode Config

Refer to the exhibit. The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team? (Choose one answer)

• AA. Move NOC_Access to the top of the list to ensure all profile settings take effect.
• BB. Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
• CC. Ensure that all NOC_Access users are assigned the super_admin role to guarantee access.
• DD. Increase the admintimeout value under config system accprofile NOC_Access.

You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab. and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?

• AA. FortiGuard category ratings
• BB. Network Protocol Enforcement
• CC. Replacement Messages for UDP-based Applications
• DD. Application and Filter Overrides

Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)

Select 2 answers.

• AA. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.
• BB. On HQ-NGFW. enable Diffie-Hellman Group 2.
• CC. On BR1-FGT. set Seconds to 43200
• DD. On HQ-NGFW. set Encryption to AES256.

A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode. Which step is not part of the expected process?

• AA. The DC agent sends login event data directly to FortiGate.
• BB. FortiGate determines user identity based on the IP address in the FSSO list.
• CC. The collector agent forwards login event data to FortiGate.
• DD. The user logs into the windows domain.

Which two statements are correct when FortiGate enters conserve mode? (Choose two answers)

Select 2 answers.

• AA. FortiGate continues to run critical security actions, such as quarantine.
• BB. FortiGate refuses to accept configuration changes.
• CC. FortiGate halts complete system operation and requires a reboot to regain available resources.
• DD. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.