Certification Provider: Fortinet
Exam: NSE 4
Exam Code: NSE4 v7.0
Total Question: 131
Question per Quiz: 60
Updated On: 24 July 2022
1.
Which two types of traffic are managed only by the management VDOM? (Choose two.)
2.
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
3.
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
4.
When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?
5.
Which statement regarding the firewall policy authentication timeout is true?
6.
What is the effect of enabling auto-negotiate on the phase 2 configuration of an IPsec tunnel?
7.
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)
8.
Refer to the exhibit. The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
9.
An administrator has configured outgoing interface any in a firewall policy. Which statement is true about the policy list view?
10.
What inspection mode does FortiGate use if it is configured as a policy-based next-generation firewall (NGFW)?
11.
Refer to the FortiGuard connection debug output. Based on the output shown in the exhibit, which two statements are correct? (Choose two.)
12.
Based on the raw logs shown in the exhibit, which statement is correct?
13.
Which two statements are true about collector agent advanced mode? (Choose two.)
14.
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
15.
How does FortiGate act when using SSL VPN in web mode?
16.
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?
17.
Which two statements are true about the Security Fabric rating?
18.
How do you format the FortiGate flash disk?
19.
Refer to the exhibit, which contains a static route configuration. An administrator created a static route for Amazon Web Services. What CLI command must the administrator use to view the route?
20.
Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)
21.
Refer to the exhibit. The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode. The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the Internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem. Which two statements are true? (Choose two.)
22.
Refer to the exhibit. A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up. Based on the phase 2 configuration shown in the exhibit, what configuration change will bring phase 2 up?
23.
A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not. Which configuration option is the most effective way to support this request?
24.
Refer to the exhibit. The global settings on a FortiGate device must be changed to align with company security policies. What does the Administrator account need to access the FortiGate global settings?
25.
Which of the following SD-WAN load -balancing method use interface weight value to distribute traffic? (Choose two.)
26.
Which two statements are true about the FGCP protocol? (Choose two.)
27.
Refer to the exhibit. Which IP address will be used to source NAT the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
The exhibit contains a network diagram, central SNAT policy, and IP pool configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
A firewall policy is configured to allow to destinations from LAN (port3) to WAN (port1).
Central NAT is enabled, so NAT settings from matching Central SNAT policies will be applied.
28.
Which of the following statements about backing up logs from the CLI and downloading logs from the GUI are true? (Choose two.)
29.
Which three statements are true regarding session-based authentication? (Choose three.)
30.
When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?
31.
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
32.
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
33.
Refer to the exhibit. How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http:// www.fortinet.com? (Choose two.)
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
34.
Which scanning technique on FortiGate can be enabled only on the CLI?
35.
Which three CLI commands can you use to troubleshoot Layer 3 issues if the issue is in neither the physical layer nor the link layer? (Choose three.)
36.
Refer to the exhibit, which contains a session list output. Based on the information shown in the exhibit, which statement is true?
37.
Which two statements are true about the RPF check? (Choose two.)
38.
wo protocol options are available on the CLI but not on the GUI when configuring an SD-WAN Performance SLA? (Choose two.)
39.
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)
40.
Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?
41.
Refer to the exhibit. What should the administrator do next to troubleshoot the problem?
In the network shown in the exhibit, the web client cannot connect to the HTTP web server. The administrator runs the FortiGate built-in sniffer and gets the output as shown in the exhibit.
42.
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)
43.
Which of the following are valid actions for FortiGuard category based filter in a web filter profile UI proxy-based inspection mode? (Choose two.)
44.
Which engine handles application control traffic on the next-generation firewall (NGFW) FortiGate?
45.
What devices form the core of the security fabric?
46.
Refer to the exhibit, which contains a session diagnostic output. Which statement is true about the session diagnostic output?
47.
A team manager has decided that, while some members of the team need access to a particular website, the majority of the team does not Which configuration option is the most effective way to support this request?
48.
Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?
49.
Which feature in the Security Fabric takes one or more actions based on event triggers?
50.
If Internet Service is already selected as Source in a firewall policy, which other configuration objects can be added to the Source field of a firewall policy?
51.
Which two statements are correct about a software switch on FortiGate? (Choose two.)
52.
Which three authentication timeout types are availability for selection on FortiGate? (Choose three.)
53.
Which CLI command will display sessions both from client to the proxy and from the proxy to the servers?
54.
An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?
55.
Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct if option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
56.
Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?
57.
Refer to the exhibit. The exhibit shows the IPS sensor configuration. If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
58.
What are the two results of this configuration? (Choose two.)
An administrator has configured the following settings:
config system setting
set ses-denied-traffic enable
end
config system global
set block -session-timer 30
end
59.
Which of the following are purposes of NAT traversal in IPsec? (Choose two.)
60.
Refer to the exhibits. Based on the system performance output, which two statements are correct? (Choose two.)
Exhibit A shows system performance output. Exhibit B shows a FortiGate configured with the default configuration of high memory usage thresholds.
2 Comments
after submit ,need to show the correct answers
I took NSE4 few days before and Passed. Many question from this Quiz are in Exam. Recommend to take this practice test along with Guide. Quite helpful.
Thank You Practonet 🙂