Certification Provider: Fortinet
Exam: NSE 4
Exam Code: NSE4 v7.0
Total Question: 131
Question per Quiz: 60
Updated On: 21 March 2023
Note: In order to practice all the Q/A's, you have to practice multiple time. Question's and Answer's will be presented randomly and will help you get hands-on for real exam.
1.
Which feature in the Security Fabric takes one or more actions based on event triggers?
2.
Refer to the exhibit to view the firewall policy. Which statement is correct if well-known viruses are not being blocked?
3.
Which two VDOMs are the default VDOMs created when FortiGate is set up in split VDOM mode? (Choose two.)
4.
An administrator has configured a strict RPF check on FortiGate. Which statement is true about the strict RPF check?
5.
In which two ways can RPF checking be disabled? (Choose two.)
6.
Which two policies must be configured to allow traffic on a policy-based next-generation firewall (NGFW) FortiGate? (Choose two.)
7.
Refer to the exhibit. Review the Intrusion Prevention System (IPS) profile signature settings. Which statement is correct in adding the FTP.Login.Failed signature to the IPS sensor profile?
8.
Which statement regarding the firewall policy authentication timeout is true?
9.
Which scanning technique on FortiGate can be enabled only on the CLI?
10.
Which two statements are correct about NGFW Policy-based mode? (Choose two.)
11.
Refer to the exhibit. Given the interfaces shown in the exhibit, which two statements are true? (Choose two.)
12.
Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)
13.
Which two key configuration changes are needed on FortiGate to meet the design requirements? (Choose two.)
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
✑ All traffic must be routed through the primary tunnel when both tunnels are up.
✑ The secondary tunnel must be used only if the primary tunnel goes down.
✑ In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
14.
How do you format the FortiGate flash disk?
15.
An administrator observes that the port1 interface cannot be configured with an IP address. What can be the reasons for that? (Choose three.)
16.
Which two statements about SSL VPN between two FortiGate devices are true? (Choose two.)
17.
What are the two results of this configuration? (Choose two.)
An administrator has configured the following settings:
config system setting
set ses-denied-traffic enable
end
config system global
set block -session-timer 30
end
18.
Which of the following statements is true regarding SSL VPN settings for an SSL VPN portal?
19.
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel. Which DPD mode on FortiGate will meet the above requirement?
20.
Refer to the exhibit. The Root and To_Internet VDOMs are configured in NAT mode. The DMZ and Local VDOMs are configured in transparent mode. The Root VDOM is the management VDOM. The To_Internet VDOM allows LAN users to access the Internet. The To_Internet VDOM is the only VDOM with internet access and is directly connected to ISP modem. Which two statements are true? (Choose two.)
21.
Refer to the exhibit showing a debug flow output. Which two statements about the debug flow output are correct? (Choose two.)
22.
Which three statements about a flow-based antivirus profile are correct? (Choose three.)
23.
You have enabled logging on your FortiGate device for Event logs and all Security logs, and you have set up logging to use the FortiGate local disk. What is the default behavior when the local disk is full?
24.
Which three criteria can a FortiGate use to look for a matching firewall policy to process traffic? (Choose three.)
25.
In consolidated firewall policies, IPv4 and IPv6 policies are combined in a single consolidated policy. Instead of separate policies. Which three statements are true about consolidated IPv4 and IPv6 policy configuration? (Choose three.)
26.
Which two statements are true when FortiGate is in transparent mode? (Choose two.)
27.
Which two statements are true about the FGCP protocol? (Choose two.)
28.
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
29.
Which Security rating scorecard helps identify configuration weakness and best practice violations in your network?
30.
Refer to the exhibit. The SSL VPN connection fails when a user attempts to connect to it. What should the user do to successfully connect to SSL VPN?
31.
Refer to the exhibit. How will FortiGate process the traffic when the HTTP request comes from a machine with the source IP 10.0.1.10 to the destination http:// www.fortinet.com? (Choose two.)
The exhibit shows proxy policies and proxy addresses, the authentication rule and authentication scheme, users, and firewall address.
An explicit web proxy is configured for subnet range 10.0.1.0/24 with three explicit web proxy policies.
The authentication rule is configured to authenticate HTTP requests for subnet range 10.0.1.0/24 with a form-based authentication scheme for the FortiGate local user database. Users will be prompted for authentication.
32.
Which downstream FortiGate VDOM is used to join the Security Fabric when split-task VDOM is enabled on all FortiGate devices?
33.
What devices form the core of the security fabric?
34.
Which two statements about IPsec authentication on FortiGate are correct? (Choose two.)
35.
Which statements about the firmware upgrade process on an active-active HA cluster are true? (Choose two.)
36.
Refer to the exhibits to view the firewall policy and the antivirus profile. Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?
37.
When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?
38.
What types of traffic and attacks can be blocked by a web application firewall (WAF) profile? (Choose three.)
39.
Refer to the exhibit. The exhibit shows the IPS sensor configuration. If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
40.
Why does FortiGate keep TCP sessions in the session table for several seconds, even after both sides (client and server) have terminated the session?
41.
Which two protocols are used to enable administrator access of a FortiGate device? (Choose two.)
42.
Refer to the exhibit, which contains a Performance SLA configuration. An administrator has configured a performance SLA on FortiGate, which failed to generate any traffic. Why is FortiGate not generating any traffic for the performance SLA?
43.
An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?
44.
What two changes can the administrator make to resolve the issue without affecting services running through FortiGate? (Choose two.)
Consider the topology:
Application on a Windows machine FGT--> Telnet to Linux server.
An administrator is investigating a problem where an application establishes a Telnet session to a Linux server over the SSL VPN through FortiGate and the idle session times out after about 90 minutes. The administrator would like to increase or disable this timeout.
The administrator has already verified that the issue is not caused by the application or Linux server. This issue does not happen when the application establishes a Telnet connection to the Linux server directly on the LAN.
45.
Refer to the exhibit. Given the security fabric topology shown in the exhibit, which two statements are true? (Choose two.)
46.
Refer to the exhibit. The exhibit contains a network interface configuration, firewall policies, and a CLI console configuration. How will FortiGate handle user authentication for traffic that arrives on the LAN interface?
47.
Refer to the exhibit. The exhibit displays the output of the CLI command: diagnose sys ha dump-by vcluster. Which two statements are true? (Choose two.)
48.
Which two statements are true about the Security Fabric rating?
49.
Refer to the exhibit. Examine the intrusion prevention system (IPS) diagnostic command. Which statement is correct if option 5 was used with the IPS diagnostic command and the outcome was a decrease in the CPU usage?
50.
Which two inspection modes can you use to configure a firewall policy on a profile-based next-generation firewall (NGFW)? (Choose two.)
51.
Refer to the exhibit. Which IP address will be used to source NAT the internet traffic coming from a workstation with the IP address 10.0.1.10?
The exhibit contains a network diagram, virtual IP, IP pool, and firewall policies configuration.
The WAN (port1) interface has the IP address 10.200.1.1/24.
The LAN (port3) interface has the IP address 10.0.1.254/24.
The first firewall policy has NAT enabled using IP Pool.
The second firewall policy is configured with a VIP as the destination address.
52.
Based on the raw logs shown in the exhibit, which statement is correct?
53.
An administrator wants to configure timeouts for users. Regardless of the user’s behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should be configured on FortiGate?
54.
Examine the two static routes shown in the exhibit, then answer the following question. Which of the following is the expected FortiGate behavior regarding these two routes to the same destination?
55.
If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?
56.
Refer to the exhibit. An administrator is running a sniffer command as shown in the exhibit. Which three pieces of information are included in the sniffer output? (Choose three.)
57.
An administrator needs to increase network bandwidth and provide redundancy. What interface type must the administrator select to bind multiple FortiGate interfaces?
58.
IPS Engine is used by which three security features? (Choose three.)
59.
What is the primary FortiGate election process when the HA override setting is disabled?
60.
FortiGate is configured as a policy-based next-generation firewall (NGFW) and is applying web filtering and application control directly on the security policy. Which two other security profiles can you apply to the security policy? (Choose two.)
