🛡️ Fortinet NSE4 – FGT_AD-7.6 | Preguntas 41-50

Which two statements about the Security Fabric rating are true? (Choose two answers). A license is required to obtain an executive summary in the Security Rating section. The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric. The Security Posture category provides PCI compliance results. Security Rating Insights are available only in the Security Rating page.

Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?. Antivirus scan is disabled under System - > Feature visibility. None of the inspected protocols are active in this profile. The Feature Set for the profile is Flow-based but it must be Proxy-based. FortiGate. with less than 2 GB RAM. does not support the Antivirus scan feature.

What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields. FortiGate will close the connection if the SNI does not match the CN or SAN fields. FortiGate will close the connection if the SNI does not match the CN and SAN fields.

As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit What could be the possible reason of the diagnose output shown in the exhibit?. There is a no firewall policy configured with an IPS security profile. Administrator entered the command diagnose test application ipsmonitor 5. FortiGate entered into IPS fail open state. Administrator entered the command diagnose test application ipsmonitor 99.

You have configured an application control profile, set peer-o-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, you peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?. Replacement Messages for UDP-based Applications. Network Protocol Enforcement. Application and Filter Overrides. FortiGuard category ratings.

An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic. Which DPD mode on FortiGate meets this requirement?. On Demand. Enabled. On Idle. Usabled.

Refer to the exhibit, which shows a partial configuration from the remote authentication server. Why does the FortiGate administrator need this configuration? (Choose one answer). To authenticate only the Training user group. To set up a RADIUS server Secret. To authenticate and match the Training OU on the RADIUS server. To authenticate Any FortiGate user groups.

Refer to the exhibit. An intrusion prevention system (IPS) profile signature setting is shown. What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?An intrusion prevention system (IPS) profile signature setting is shown. What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?. The signature setting uses a custom rating threshold. FortiGate allows this low severity signature packet and creates a log. FortiGate stores a local copy of the packet that matches the signature. The signature setting includes a group of other signatures.

The FortiGate device HQ-NGFW-1 with the IP address 10.0.13.254 sends logs to the FortiAnalyzer device with the IP address 10.0.13.125. The administrator wants to verify that reliable logging is enabled on HQ-NGFW-1. Which exhibit helps with the verification?. A. B. C. D.

You are onboarding an agentless, secure web gateway (SWG) endpoint for secure internet access (SIA). What will happen to the user ' s nonweb traffic? (Choose one answer). All the nonweb traffic will bypass FortiSASE. The endpoint will use split tunneling to redirect nonweb traffic to FortiSASE. FortiSASE will use Firewall-as-a-Service (FWaaS) to redirect nonweb traffic. FortiSASE will use SWG to redirect nonweb traffic to FortiExtender.