Fortinet Exam NSE4_FGT-7.2 Topic 3 Question 32 Discussion

Actual exam question for Fortinet's NSE4_FGT-7.2 exam

Question #: 32
Topic #: 3

[All NSE4_FGT-7.2 Questions]

What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?

AFortiGate automatically negotiates different local and remote addresses with the remote peer.

BFortiGate automatically negotiates a new security association after the existing security association expires.

CFortiGate automatically negotiates different encryption and authentication algorithms with the remote peer.

DFortiGate automatically brings up the IPsec tunnel and keeps it up, regardless of activity on the IPsec tunnel.

Show Suggested Answer

Suggested Answer: B

by Julianna at Jun 19, 2024, 10:57 PM

Limited Time Offer

25%

Off

Get Premium NSE4_FGT-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Micaela

9 months ago

Ah, the age-old question of how to disable RPF checking. Option B is the way to go, my friends. Disable that src-check and you're golden!

upvoted 0 times

Melita

8 months ago

I've always disabled fail-detect on the interface level settings, works like a charm.

upvoted 0 times

...

Huey

8 months ago

I think I'll go with option A, disabling strict-src-check seems like a good idea.

upvoted 0 times

...

Carline

8 months ago

I agree, option B is the best way to disable RPF checking.

upvoted 0 times

...

Earleen

8 months ago

I've always disabled src-check on the interface level settings, option B all the way.

upvoted 0 times

...

Janine

8 months ago

I think option A might also work, disabling strict-src-check under system settings.

upvoted 0 times

...

Jody

8 months ago

I agree, option B is the best way to disable RPF checking.

upvoted 0 times

...

Leslie

10 months ago

Hmm, I think Option C is the way to go. Unset that fail-alert-interfaces thingy and you should be good to go!

upvoted 0 times

Lavera

9 months ago

I think disabling src-check on the interface level settings might work better.

upvoted 0 times

...

Jade

9 months ago

I agree, unsetting fail-alert-interfaces should do the trick.

upvoted 0 times

...

Georgene

10 months ago

I think the answer is A as well, because disabling strict-src-check should disable RPF checking.

upvoted 0 times

...

Raymon

10 months ago

I'm not sure, but I think it could also be B) Disable src-check on the interface level settings.

upvoted 0 times

...

Charlette

10 months ago

I agree with Shaun, that makes sense because RPF checking is related to strict source checking.

upvoted 0 times

...

Lezlie

10 months ago

Ha! Disabling RPF checking? Isn't that like asking the cops to ignore speeding tickets? Just kidding, but Option B seems legit.

upvoted 0 times

Nicolette

9 months ago

Teri: Good to know, thanks for the info!

upvoted 0 times

...

Nikita

9 months ago

Agreed, that seems like the safest option to disable RPF checking.

upvoted 0 times

...

Teri

9 months ago

I think Option B is the way to go, disabling src-check on the interface level settings.

upvoted 0 times

...

Dorothea

10 months ago

Yeah, disabling RPF checking does sound risky.

upvoted 0 times

...

Shaun

10 months ago

I think the answer is A) Disable strict-src-check under system settings.

upvoted 0 times

...

Iluminada

10 months ago

I'm not sure, but maybe Option D is the answer? Disabling fail-detect sounds like it could disable RPF checking.

upvoted 0 times

Junita

9 months ago

I'm not sure, maybe we should check the documentation.

upvoted 0 times

...

Maile

9 months ago

I think Option D could work.

upvoted 0 times

...

Junita

10 months ago

Option B looks like the way to go. Disabling src-check on the interface level should do the trick.

upvoted 0 times

Juan

10 months ago

Yeah, just disable src-check on the interface level and you should be good to go.

upvoted 0 times

...

Nu

10 months ago

I agree, option B seems like the most straightforward solution.

upvoted 0 times

...