NSE4_FGT-7-2 Practice Questions

The exhibit clearly shows that the FTP.Login.Failed signature has its Action set to "Drop" and Log is enabled (checked). In FortiGate IPS, the "Drop" action silently discards packets matching the signature without sending any notification to the source, while simultaneously logging the event since logging is enabled. This configuration ensures malicious traffic is blocked while maintaining visibility through logs for security monitoring and analysis.

A. No custom rating threshold is visible in the configuration shown.

B. The signature is listed individually, not as part of a signature group.

C. The action is "Drop" not "Pass" or "Allow", so traffic will be blocked.

1. FortiGate Security 7.2 Study Guide - NSE4, Chapter 8: IPS Configuration, pages 245-247

2. Fortinet Document Library, "FortiOS 7.2 IPS Administration Guide", Section: IPS Actions and Logging, DOC-FOS-72-IPS-001

3. FortiGate 7.2 CLI Reference Guide, IPS sensor configuration commands, pages 892-895

4. Fortinet Knowledge Base Article FD40577, "Understanding IPS Actions in FortiGate"

5. FortiOS 7.2.0 Handbook, Security Profiles Configuration, Section 4.3: IPS Profile Actions

The Reverse Path Forwarding (RPF) check is a security feature designed to mitigate IP spoofing attacks. It works by verifying that the source IP address of an incoming packet is reachable through the same interface on which the packet was received. This check is performed by the FortiOS kernel on the first packet of any new session before a session is created in the session table. If the RPF check fails, the packet is dropped, preventing sessions from being established with a spoofed source IP.

B. The RPF check is performed only on the first packet that initiates a session, not on the reply packet. Once the session is established, the check is not repeated.

D. The RPF check is specifically for the initiating packet of a session to validate its source. The reply packet's path is already known and trusted within the established session.

1. Fortinet. (2023). FortiOS Administration Guide 7.2.4. Page 574. "Reverse Path Forwarding (RPF), also known as anti spoofing, is a mechanism that protects the FortiGate device and your network from IP spoofing attacks."

2. Fortinet. (2023). FortiGate Security 7.2 Study Guide. Page 10. "The RPF check is performed on the first packet of a session. If the check fails, FortiGate drops the packet."

3. Fortinet. (2023). FortiOS Handbook - Troubleshooting 7.2.4. Page 45. The debug flow shows the ipropeincheck() function, which includes the RPF check, is performed on the first packet during session creation.

FortiGate keeps a TCP session in its session table for a brief period after termination (receiving FIN/ACKs from both ends) to handle out-of-order or delayed packets. This state, analogous to the TCP TIMEWAIT state, ensures that late-arriving packets from the old session are correctly discarded and not misinterpreted as part of a new session that might reuse the same source/destination IP and port combination.

B. Security inspection is performed on packets as they transit the device in an active session, not after the session has already been terminated.

C. The NAT operation is tied to the session entry itself. The entry is kept for packet ordering reasons, not to perform a separate NAT removal task.

D. Logs are generated based on events (session setup, teardown). Keeping the session entry after termination is not required for the logging process itself.

1. FortiOS CLI Reference 7.0, config system session-ttl, p. 1788. The tcp-timewait timer is described: "TCP session time-out for sessions in the TIMEWAIT state (1 - 300 sec, default = 1)." This confirms a specific state exists for this purpose.

2. FortiOS Handbook - Troubleshooting 7.0, "Session table", p. 11. "After the session is closed, it is kept in the session table for a short time (the default is defined by the tcp-timewait timer) to allow for any out-of-order packets."

The Intrusion Prevention System (IPS) engine in FortiOS is a core component responsible for advanced protocol decoding and signature-based inspection. Application Control, DNS Filter, and Web Application Firewall (WAF) all fundamentally rely on this engine to function. Application Control uses it to identify application traffic, DNS Filter uses it to inspect DNS requests against categories, and WAF uses it to detect web-specific attacks.

A. While flow-based web filtering uses the IPS engine for protocol decoding, its primary function is URL/category lookup, which is a separate subsystem.

B. Flow-based antivirus uses the IPS engine to extract files from traffic streams, but the actual malware scanning is performed by a distinct antivirus engine.

1. FortiGate Security 7.2 Study Guide, page 10. A diagram explicitly shows the IPS engine as the core component for IPS, Application Control, and Web Application Firewall (WAF) features.

2. FortiGate Security 7.2 Study Guide, page 171. It states, "DNS filter uses the IPS engine to inspect DNS traffic."

3. FortiOS Handbook 7.2 - Security Profiles, "Application Control" chapter. It details that application signatures are part of the IPS package and processed by the IPS engine.

4. FortiOS Handbook 7.2 - Security Profiles, "Web Application Firewall" chapter. It explains that WAF uses the IPS engine with a specialized signature set to protect against web application threats.

When enabling Central NAT, the NAT configuration is decoupled from firewall policies. Before switching, any NAT-related settings, such as IP pool references, must be removed from existing firewall policies to prevent configuration conflicts. Once Central NAT is active, source NAT is no longer configured in the firewall policy; instead, it is managed by creating specific policies in the Central SNAT policy table. At least one Central SNAT policy is required to perform source address translation for outbound traffic.

B. Central NAT can be enabled or disabled from the GUI under System > Feature Visibility, not just from the CLI.

D. In Central NAT mode, a firewall policy's destination is the real (internal) IP address. A Central DNAT policy handles the translation, not a VIP object in the firewall policy.

1. FortiOS 7.0.0 Firewall Handbook, "Central NAT," Page 101: "When Central NAT is enabled, NAT is configured in a single table... Source NAT is configured by creating a policy in the central SNAT policy table."

2. FortiOS 7.0.0 Firewall Handbook, "Enabling central NAT," Page 102: "Before enabling central NAT, you must remove any IP pool references from existing firewall policies."

3. FortiOS 7.0.0 Firewall Handbook, "Central DNAT + virtual IPs," Page 106: "The firewall policy is configured with the VIP's mapped IP address as the destination address." (This describes the firewall policy configuration, where the destination is the real IP, not the VIP object itself as in policy NAT).

The antivirus profile is correctly configured, as it successfully detects the EICAR file over unencrypted HTTP. The failure to detect the same file over HTTPS indicates that the traffic is not being decrypted by the FortiGate. A common reason for this is an SSL inspection exemption for the specific website or web category from which the file is being downloaded. When a site is exempted, its traffic passes through the FortiGate without being decrypted, preventing the antivirus engine from inspecting the encrypted file content.

B. The EICAR test file is extremely small (68 bytes) and would not trigger any oversize limit, which is typically configured in megabytes.

C. If the profile was set to 'certificate inspection', AV would fail. However, an exemption is a more specific reason for a single site failing inspection.

D. If the browser did not trust the CA certificate, the user would receive a browser warning, but if they proceeded, the traffic would still be decrypted and inspected.

- FortiOS 7.2 Administration Guide, "Security Profiles > SSL/SSH Inspection" section. It details how exemptions can be configured to bypass SSL inspection for specific sites, which would prevent content inspection like antivirus scanning.

- FortiOS 7.2 Cookbook, "SSL Deep Inspection" chapter, "Exempting traffic from SSL inspection" recipe. This explains that exempted traffic is not decrypted or inspected by security profiles.

The sniffer command diagnose sniffer packet any 'host 10.1.1.10' 4 0 l uses a verbosity level of 4. According to FortiOS documentation, verbosity level 4 is defined to display the packet headers along with the interface name. The exhibit shows the interface name (port1), the Ethernet header (Layer 2), and the IP header (Layer 3). While the exhibit also shows the packet payload, the documented function of verbosity level 4 is limited to headers and interface name, making the payload's presence in the exhibit anomalous. The application header is not explicitly parsed, but is part of the payload. Therefore, the most accurate answers based on the command's definition are the interface name and the packet headers.

D. The sniffer does not parse and display the application header as a distinct element; it is part of the raw payload data.

E. The documented behavior for verbosity level 4 is to show only packet headers and the interface name, not the full packet payload.

1. FortiOS 7.2.4 CLI Reference, p. 1130. Under diagnose sniffer packet, the verbose option 4 is described as: "print header of packets with interface name."

2. FortiOS 7.2.0 Cookbook, "Packet sniffing," p. 1. The guide shows examples where different verbosity levels display different information, confirming that level 4 focuses on headers and interface.

Based on the exhibit and FortiOS interface principles:

C: When VLAN subinterfaces (like port1-vlan10) are created on a physical interface (port1), the physical interface itself handles untagged traffic. In a trunking context, this corresponds to the native VLAN.

D: FortiGate's Virtual Domain (VDOM) architecture allows for the flexible assignment of any interface, physical or virtual (like VLAN subinterfaces), to any VDOM. Therefore, port1-vlan10 and port2-vlan1 can exist in the same VDOM or be separated into different VDOMs.

A. Traffic between any two distinct FortiGate interfaces, even a physical port and a VLAN subinterface on it, is blocked by default and requires an explicit firewall policy to be allowed.

B. port1-vlan10 and port2-vlan10 are separate Layer 3 interfaces on the FortiGate. While they connect to the same external Layer 2 broadcast domain (VLAN 10), they are not part of the same broadcast domain on the device itself.

1. Fortinet. (2022). FortiOS 7.2.1 Networking Guide. Page 113, "VLANs". The guide states: "The physical interface is the native VLAN and will accept untagged packets." This confirms option C.

2. Fortinet. (2022). FortiOS 7.2.1 Administration Guide. Page 169, "Virtual Domains". The guide explains: "You can assign specific physical and virtual interfaces to each VDOM." This confirms the flexibility described in option D.

In a site-to-site IPsec VPN configuration, the Phase 2 selectors (Quick Mode Selectors) must be a mirror image of each other on the peer gateways. Site A defines its local network (192.168.1.0/24) as the local selector and Site B's network (192.168.2.0/24) as the remote selector. Consequently, Site B must configure its local selector to be its own network (192.168.2.0/24) and its remote selector to be Site A's network (192.168.1.0/24). This ensures that both ends of the tunnel agree on which traffic is to be encrypted.

A. 192.168.3.0/24 is an unrelated subnet and would cause a Phase 2 negotiation mismatch and failure.

C. 192.168.1.0/24 is Site A's local network, so it must be configured as the remote selector on Site B, not the local one.

D. 192.168.0.0/8 is a supernet that does not match the specific remote selector configured on Site A, leading to a mismatch.

1. FortiOS 7.0.0 IPsec VPN Administration Guide, "Phase 2 configuration," Page 71: "The settings must be the same on both peers, except for Source Address and Destination Address, which must be mirrors of each other."

2. FortiOS 7.0.0 IPsec VPN Administration Guide, "Quick mode selectors," Page 29: "The quick mode selectors determine which traffic is to be encrypted and protected by IPsec... The local and remote selectors on the local FortiGate must be mirrored on the remote FortiGate."

When configuring a Virtual IP (VIP) object, the port forwarding feature allows you to map multiple external service ports to different internal ports on the destination server. This consolidates the configuration, removing the need to create a separate VIP object for each service (e.g., one for HTTP on port 80, another for HTTPS on port 443). This functionality is independent of whether central NAT or policy-based NAT is used.

A. The Services field in a VIP defines port mapping; it does not control or prevent how SNAT and DNAT are combined in a central NAT policy.

B. VIP groups are separate objects used to bundle multiple, distinct VIP objects. The Services field configures port mapping within a single VIP.

D. This statement is the opposite of the feature's purpose. The Services field explicitly enables multiple services to connect to a server through a single VIP.

1. Fortinet. (2021). FortiGate Infrastructure Study Guide for FortiOS 7.0, p. 178. "If you enable Port Forwarding, you can configure multiple port mappings. This allows you to use a single VIP to forward traffic for different services to different ports on the real server."

2. Fortinet. (2021). FortiOS Administration Guide 7.0.1, p. 311. "Port forwarding can be used to forward a port or a range of ports. You can also map a port to another port or port range."