Exam NSE4_FGT-7.2 topic 1 question 38 discussion

Very tricki question, the question is "which two changes can the administrator make to deny Webserver access for Remote-User2" , to achieve this question NO action is needed for the in place configuration, both A and D simply does not make sense, while B and C also achieve the result needed, so right answer is BC

BC But what if you want the first policy to block all incoming traffic to all destinations, including the traffic destined to any VIPs?. This is useful if your network is under attack, and you want to temporarily block all incoming external traffic. You can do this by enabling match-vip on the first firewall policy. In case you want to block only traffic destined to one or more VIPs, you can reference the VIPs as thedestination address on the deny firewall policy

B. Set the Destination address as Webserver in the Deny policy. Most Voted C. Enable match-vip in the Deny policy.

B. Set the Destination address as Webserver in the Deny policy. C. Enable match-vip in the Deny policy.

Answer is BC see below link for explanation https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641

FortiGate Security 7.2 Study Guide p.114

B. Set the Destination address as Webserver in the Deny policy. C. Enable match-vip in the Deny policy. Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

BC A. Disable match-vip in the Deny policy. - No, because you want to match destination IP 203.0.113.22 B. Set the Destination address as Webserver in the Deny policy. - Yes - Source Remote_user2, dest Webserver (203.0.113.22). - Best practice is to be explicit C. Enable match-vip in the Deny policy. - allows policy to match the Webserver - VIP IPs D. Set the Destination address as Deny_IP in the Allow_access policy. - No because we want to block Remote_user2

Correct

B and C

You are wrong with D. Look and read carefully this Fortinet guide, i.e. FortiGate_Security_7.2_Study_Guide, namely page 114. It says: In case you want to block only traffic destined to one ore more VIPs you can reference the VIP as the destination address in the deny firewall policy. The key here is the Deny policy, not the Allow policy

C and D - match-vip in deny policy needs to be enabled (set match-vip enable) or destination address needs to be the VIP object (set adstaddr "VIP object")

Because they only want to block one public IP

Selected Answer: CD Because they only want to block one public IP

Answer should be BC. It makes sense that the destination address be the webserver which needs to be denied for IP Deny_IP

Answer should be BC

Answer should be BC.