27 August, 2020

Downloadable Fortinet NSE4 Prep Online

we provide Certified Fortinet NSE4 exam cost which are the best for clearing NSE4 test, and to get certified by Fortinet Fortinet Network Security Expert 4 Written Exam (400). The NSE4 Questions & Answers covers all the knowledge points of the real NSE4 exam. Crack your Fortinet NSE4 Exam with latest dumps, guaranteed!

Also have NSE4 free dumps questions for you:

Page: 1 / 25

Total 301 questions Full Exam Access

Question 1

Which statement is correct concerning creating a custom signature?

It must start with the name

It must indicate whether the traffic flow is from the client or the server.

It must specify the protoco

Otherwise, it could accidentally match lower-layer protocols.

It is not supported by Fortinet Technical Support.

Question 2

Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing security profile (UTM) inspection over all the user traffic.
What statements are true regarding the sessions that the master unit is offloading to the slave unit for inspection? (Choose two.)

They are offloaded to the NP6 in the master unit.

They are not offloaded to the NP6 in the master unit.

They are offloaded to the NP6 in the slave unit.

They are not offloaded to the NP6 in the slave unit.

Question 3

Which of the following statements are correct concerning the IPsec phase 1 and phase 2, shown in the exhibit? (choose two)
NSE4 dumps exhibit

The quick mode selector in the remote site must also be 0.0.0.0/0 for the source and destination addresses.

Only remote peers with the peer ID \'fortinet\' will be able to establish a VPN.

The FortiGate device will automatically add a static route to the source quick mode selector address received from each remote VPN peer.

The configuration will work only to establish FortiClient-to-FortiGate tunnel

A FortiGate tunnel requires a different configuration.

Question 4

Which portion of the configuration does an administrator specify the type of IPsec configuration (either policy-based or route-based)?

Under the IPsec VPN global settings.

Under the phase 2 settings.

Under the phase 1 settings.

Under the firewall policy settings.

Question 5

Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of diagnose sys session stat for the STUDENT device. Exhibit B shows the command output of diagnose sys session stat for the REMOTE device.
Exhibit A:
NSE4 dumps exhibit

Exhibit B:
NSE4 dumps exhibit

Given the information provided in the exhibits, which of the following statements are correct? (Choose two.)

STUDENT is likely to be the master device.

Session-pickup is likely to be enabled.

The cluster mode is active-passive.

There is not enough information to determine the cluster mode.

Question 6

Files reported as "suspicious" were subject to which Antivirus check"?

Grayware

Virus

Sandbox

Heuristic

Question 7

A client can create a secure connection to a FortiGate device using SSL VPN in web-only mode. Which one of the following statements is correct regarding the use of web-only mode SSL VPN?

Web-only mode supports SSL version 3 only.

A Fortinet-supplied plug-in is required on the web client to use web-only mode SSL VPN.

Web-only mode requires the user to have a web browser that supports 64-bit cipher length.

The JAVA run-time environment must be installed on the client to be able to connect to a web-only mode SSL VPN.

Question 8

The exhibit shows a part output of the diagnostic command 'diagnose debug application ike 255', taken during establishment of a VPN. Which of the following statement are correct concerning this output? (choose two)
NSE4 dumps exhibit

The quick mode selectors negotiated between both IPsec VPN peers is 0.0.0.0/32 for both source and destination addresses.

The output corresponds to a phase 2 negotiation

NAT-T enabled and there is third device in the path performing NAT of the traffic between both IPsec VPN peers.

The IP address of the remote IPsec VPN peer is 172.20.187.114

Question 9

Which action does the FortiGate take when link health monitor times out?

All routes to the destination subnet configured in the link health monitor are removed from the routing table.

The distance values of all routes using interface configured in the link health monitor are increased.

The priority values of all routes using configured in the link health monitor are increased.

All routes using the next-hop gateway configured in the link health monitor are removed from the routing table.

Question 10

Which two statements are true about IPsec VPNs and SSL VPNs? (Choose two.)

SSL VPN creates a HTTPS connectio

IPsec does not.

Both SSL VPNs and IPsec VPNs are standard protocols.

Either a SSL VPN or an IPsec VPN can be established between two FortiGate devices.

Either a SSL VPN or an IPsec VPN can be established between an end-user workstation and a FortiGate device.

Question 11

Which is an advantage of using SNMP v3 instead of SNMP v1/v2 when querying a FortiGate unit?

MIB-based report uploads.

SNMP access limited by access lists.

Packet encryption.

Running SNMP service on a non-standard port is possible.

Question 12

Which commands are appropriate for investigating high CPU? (Choose two.)

diag sys top

diag hardware sysinfo mem

diag debug flow

get system performance status

Question 13

Which of the following are possible actions for static URL filtering? (Choose three.)

Allow

Block

Exempt

Warning

Shape

Question 14

With FSSO DC-agent mode, a domain user could authenticate either against the domain controller running the collector agent and domain controller agent, or a domain controller running only the domain controller agent.
If you attempt to authenticate with a domain controller running only the domain controller agent, which statements are correct? (Choose two.)

The login event is sent to a collector agent.

The FortiGate receives the user information directly from the receiving domain controller agent of the secondary domain controller.

The domain collector agent may perform a DNS lookup for the authenticated client\'s IP address.

The user cannot be authenticated with the FortiGate in this manner because each domain controller agent requires a dedicated collector agent.

Question 15

A FortiGate is configured with three virtual domains (VDOMs). Which of the following statements is correct regarding multiple VDOMs?

The FortiGate must be a model 1000 or above to support multiple VDOMs.

A license has to be purchased and applied to the FortiGate before VDOM mode could be enabled.

Changing the operational mode of a VDOM requires a reboot of the FortiGate.

The FortiGate supports any combination of VDOMs in NAT/Route and transparent modes.

Question 16

Of the following information, what can be recorded by a Data Leak Prevention sensor configured to do a summary archiving? (Choose three.)

Visited URL (for the case of HTTP traffic)

Sender email address (for the case of SMTP traffic)

Recipient email address (for the case of SMTP traffic)

Attached file (for the case of SMTP traffic)

Email body (for the case of SMTP traffic)

Question 17

What is the maximum number of FortiAnalyzer/FortiManager devices a FortiGate unit can be configured to send logs to?

Question 18

Which of the following statements are true about the SSL Proxy certificate that must be used for SSL Content Inspection? (Choose two.)

It cannot be signed by a private CA

It must have either the field “CA=True” or the filed “Key Usage=KeyCertSign”

It must be installed in the FortiGate device

The subject filed must contain either the FQDN, or the IP address of the FortiGate device

Question 19

An Internet browser is using the WPAD DNS method to discover the PAC file’s URL. The DNS server replies to the browser’s request with the IP address 10.100.1.10. Which URL will the browser use to download the PAC file?

http://10.100.1.10/proxy.pac

https://10.100.1.10/

http://10.100.1.10/wpad.dat

https://10.100.1.10/proxy.pac

Question 20

Which of the following combinations of two FortiGate device configurations (side A and side B), can be used to successfully establish an IPsec VPN between them? (choose two)

Side A:main mode, remote gateway as static IP address, policy based VP

Side B: aggressive mode, remote Gateway as static IP address policy-based VPN.

Side A:main mode, remote gateway as static IP address, policy based VP

Side B: main mode, remote gateway as static IP address, route-based VPN

Side A:main mode, remote gateway as static IP address, policy based VP

Side B: main mode, remote gateway as dialup, route-based VPN.

Side A: main mode, remote gateway as dialup policy based VPN, Side B: main mode, remote gateway as dialup, policy based VPN.

Question 21

How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent?

Apply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a firewall policy.

Enable the shape option in a firewall policy with service set to BitTorrent.

Define a DLP rule to match against BitTorrent traffic and include the rule in a DLP sensor with traffic shaping enabled.

Apply a traffic shaper to a protocol options profile.

Question 22

Regarding the use of web-only mode SSL VPN, which statement is correct?

It support SSL version 3 only.

It requires a Fortinet-supplied plug-in on the web client.

It requires the user to have a web browser that suppports 64-bit cipher length.

The JAVA run-time environment must be installed on the client.

Question 23

Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.)

Fragmented packets.

Multicast packet.

SCTP packet.

GRE packet.

Question 24

Which statement is in advantage of using a hub and spoke IPsec VPN configuration instead of a fully-meshed set of IPsec tunnels?

Using a hub and spoke topology provides full redundancy.

Using a hub and spoke topology requires fewer tunnels.

Using a hub and spoke topology uses stronger encryption protocols.

Using a hub and spoke topology requires more routes.

Question 25

Which of the following actions can be used to back up the keys and digital certificates in a FortiGate device? (Choose two.)

Taking a full backup of the FortiGate configuration

Uploading a PKCS#10 file to a USB drive

Manually uploading the certificate information to a Certificate authority (CA)

Uploading a PKCS#12 file to a TFTP server

Question 26

When configuring LDAP on the FortiGate as a remote database for users, what is not a part of the configuration?

The name of the attribute that identifies each user (Common Name Identifier).

The user account or group element names (user DN).

The server secret to allow for remote queries (Primary server secret).

The credentials for an LDAP administrator (password).

Question 27

Which is one of the conditions that must be met for offloading the encryption and decryption of IPsec traffic to an NP6 processor?

no protection profile can be applied over the IPsec traffic.

Phase-2 anti-replay must be disabled.

Phase 2 must have an encryption algorithm supported by the NP6.

IPsec traffic must not be inspected by any FortiGate session helper.

Question 28

Which of the following statements are true regarding traffic accelerated by an NP processor? (Choose two.)

TCP SYN packets are always handled by the NP Processor

The initial packets go to the NP Processor, where a decision is taken on if the session can be offloaded or not.

Packets for a session termination are always handled by the CPU.

The initial packets go to the CPU, where a decision is taken on if the session can be offloaded or not.

Page: 1 / 25

Total 301 questions Full Exam Access