NSE4_FGT-7.2 Exam Questions and Answers

QUESTION: 21

Refer to the exhibits.

An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).

What must the administrator do to synchronize the address object?

Change the csf setting on ISFW (downstream) to set configuration-sync local.
Change the csf setting on ISFW (downstream) to set authorization-request-type certificate.
Change the csf setting on both devices to set downstream-access enable.
Change the csf setting on Local-FortiGate (root) to set fabric-object-unification default.

Answer(s): C

Reference:

https://docs.fortinet.com/document/fortigate/6.4.5/administration- guide/880913/synchronizing-objects-across-the-security-fabric

Reveal Solution Next Question

QUESTION: 22

Which two settings can be separately configured per VDOM on a FortiGate device? (Choose two.)

System time
FortiGuaid update servers
Operating mode
NGFW mode

Answer(s): C,D

Explanation:

C: "Operating mode is per-VDOM setting. You can combine transparent mode VDOM's with NAT mode VDOMs on the same physical Fortigate.
D: "Inspection-mode selection has moved from VDOM to firewall policy, and the default inspection- mode is flow, so NGFW Mode can be changed from Profile-base (Default) to Policy-base directly in

System > Settings from the VDOM" Page 125 of FortiGate_Infrastructure_6.4_Study_Guide

Reveal Solution Next Question

QUESTION: 23

Which statement is correct regarding the inspection of some of the services available by web applications embedded in third-party websites?

The security actions applied on the web applications will also be explicitly applied on the third- party websites.
The application signature database inspects traffic only from the original web application server.
FortiGuard maintains only one signature of each web application that is unique.
FortiGate can inspect sub-application traffic regardless where it was originated.

Answer(s): D

Reference:

https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX- AdminGuide/300_System/303d_FortiG

Reveal Solution Next Question

QUESTION: 24

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.
Which DPD mode on FortiGate will meet the above requirement?

Disabled
On Demand
Enabled
On Idle

Answer(s): D

Reference:

https://kb.fortinet.com/kb/documentLink .do?externalID=FD40813

Reveal Solution Next Question

QUESTION: 25

Refer to the exhibit.

The global settings on a FortiGate device must be changed to align with company security policies.
What does the Administrator account need to access the FortiGate global settings?

Change password
Enable restrict access to trusted hosts
Change Administrator profile
Enable two-factor authentication

Answer(s): C

Reference:

https://kb.fortinet.com/kb/documentLink .do?externalID=FD34502

Reveal Solution Next Question

Fortinet NSE4_FGT-7.2 Exam (page: 5) Fortinet NSE 4 - FortiOS 7.2 Updated on: 13-Dec-2025

QUESTION: 21

Reference:

QUESTION: 22

Explanation:

QUESTION: 23

Reference:

QUESTION: 24

Reference:

QUESTION: 25

Reference:

Fortinet NSE4_FGT-7.2 Exam (page: 5)
Fortinet NSE 4 - FortiOS 7.2
Updated on: 13-Dec-2025