Fortinet NSE 4 - FortiOS 7.2 - C_HRHFC

Question 1

Why does FortiGate Keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?

A. To generate logs

B. To remove the NAT operation

C. To allow for out-of-order packets that could arrive after the FIN/ACK packets

D. To finish any inspection operations

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An administrator has configured outgoing Interface any in a firewall policy. Which statement is true about the policy list view?

A. Interface Pair view will be disabled.

B. Search option will be disabled

C. Policy lookup will be disabled.

D. By Sequence view will be disabled.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Examine the exhibit, which contains a virtual IP and firewall policy configuration.

The WAN (port1) interface has the IP address 10.200. 1. 1/24. The LAN (port2) interface has the IP address 10.0. 1.254/24.
The first firewall policy has NAT enabled on the outgoing interface address. The second firewall policy is configured with a VIP as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0. 1. 10/24?

A. 10.200. 1. 10

B. 10.200. 1. 1

C. Any available IP address in the WAN (port1) subnet 10.200. 1.0/24

D. 10.0. 1.254

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which statement regarding the firewall policy authentication timeout is true?

A. It is a hard timeout. The FortiGate removes the temporary policy for a user's source MAC address after this timer has expired.

B. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source IP.

C. It is an idle timeout. The FortiGate considers a user to be "idle" if it does not see any packets coming from the user's source MAC.

D. It is a hard timeout. The FortiGate removes the temporary policy for a user's source IP address after this timer has expired.

Correct Answer: B

Question 5

Refer to the exhibit.

The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200. 1. 1/24.
The LAN (port3) interface has the IP address 10.0. 1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0. 1. 10) pings the IP address of Remote-FortiGate (10.200.3. 1)?

A. 10.200. 1. 149

B. 10.200. 1.99

C. 10.200. 1. 1

D. 10.200. 1.49

Correct Answer: B

Question 6

Which statement is correct regarding the security fabric?

A. FortiGate devices must be operating in NAT mode.

B. FortiGate Cloud cannot be used for logging purposes.

C. A minimum of two Fortinet devices is required.

D. FortiManager is one of the required member devices.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Refer to the exhibits.
Exhibit A shows the application sensor configuration. Exhibit B shows the Excessive-Bandwidth and Apple filter details.

Based on the configuration, what will happen to Apple FaceTime if there are only a few calls originating or incoming?

A. Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration.

B. Apple FaceTime will be allowed, based on the Apple filter configuration.

C. Apple FaceTime will be allowed, based on the Categories configuration.

D. Apple FaceTime will be allowed only if the Apple filter in Application and Filter Overrides is set to Allow.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which three statements explain a flow-based antivirus profile? (Choose three.)

A. Flow-based inspection optimizes performance compared to proxy-based inspection.

B. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

C. FortiGate buffers the whole file but transmits to the client at the same time.

D. If a virus is detected, the last packet is delivered to the client.

E. The IPS engine handles the process as a standalone.

Correct Answer: A,B,C

Question 9

Refer to the exhibits.

The exhibits show the SSL and authentication policy (Exhibit A) and the security policy (Exhibit B) for Facebook .
Users are given access to the Facebook web application. They can play video content hosted on Facebook but they are unable to leave reactions on videos or other types of posts.
Which part of the policy configuration must you change to resolve the issue?

A. Make SSL inspection needs to be a deep content inspection.

B. Add Facebook in the URL category in the security policy.

C. Force access to Facebook using the HTTP service.

D. Get the additional application signatures are required to add to the security policy.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Refer to the exhibit.

Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?

A. The signature setting uses a custom rating threshold.

B. The signature setting includes a group of other signatures.

C. Traffic matching the signature will be allowed and logged.

D. Traffic matching the signature will be silently dropped and logged.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?

A. It limits the scope of application control to the browser-based technology category only.

B. It limits the scope of application control to scan application traffic based on application category only.

C. It limits the scope of application control to scan application traffic using parent signatures only

D. It limits the scope of application control to scan application traffic on DNS protocol only.

Correct Answer: B

SAP Fortinet NSE 4 - FortiOS 7.2 - C_HRHFC_2311 Exam Practice Test

Latest Update

Useful Links

Contact Us