Questions Ask for fortinet nse4 exam

Proper study guides for Up to the minute Fortinet Fortinet Network Security Expert 4 Written Exam (400) certified begins with Fortinet fortinet nse4 exam preparation products which designed to deliver the Certified fortinet nse4 exam questions by making you pass the fortinet nse4 dumps test at your first time. Try the free nse4 exam demo right now.


Free VCE & PDF File for Fortinet NSE4 Real Exam
(Full Version!)

Pass on Your First TRY 100% Money Back Guarantee Realistic Practice Exam Questions

Free Instant Download NEW NSE4 Exam Dumps (PDF & VCE):
Available on:

Q1. – (Topic 22) 

Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.) 

A. Fragmented packet. 

B. Multicast packet. 

C. SCTP packet. 

D. GRE packet. 

Answer: B,C 

Q2. – (Topic 14) 

In HA, the option Reserve Management Port for Cluster Member is selected as shown in the exhibit below. 

Which statements are correct regarding this setting? (Choose two.) 

A. Interface settings on port7 will not be synchronized with other cluster members. 

B. The IP address assigned to this interface must not overlap with the IP address subnet assigned to another interface. 

C. When connecting to port7 you always connect to the master device. 

D. A gateway address may be configured for port7. 

Answer: A,D 

Q3. – (Topic 15) 

Review the IPsec phase 2 configuration shown in the exhibit; then answer the question below. 

Which statements are correct regarding this configuration? (Choose two.). 

A. The Phase 2 will re-key even if there is no traffic. 

B. There will be a DH exchange for each re-key. 

C. The sequence number of ESP packets received from the peer will not be checked. 

D. Quick mode selectors will default to those used in the firewall policy. 

Answer: A,B 

Q4. – (Topic 10) 

How do you configure a FortiGate to apply traffic shaping to P2P traffic, such as BitTorrent? 

A. Apply a traffic shaper to a BitTorrent entry in an application control list, which is then applied to a firewall policy. 

B. Enable the shape option in a firewall policy with service set to BitTorrent. 

C. Define a DLP rule to match against BitTorrent traffic and include the rule in a DLP sensor with traffic shaping enabled. 

D. Apply a traffic shaper to a protocol options profile. 


Q5. – (Topic 3) 

Which firewall objects can be included in the Destination Address field of a firewall policy? (Choose three.) 

A. IP address pool. 

B. Virtual IP address. 

C. IP address. 

D. IP address group. 

E. MAC address. 

Answer: B,C,D 

Q6. – (Topic 14) 

Which of the following sequences describes the correct order of criteria used for the selection of a master unit within a FortiGate high availability (HA) cluster when override is disabled? 

A. 1. port monitor, 2. unit priority, 3. up time, 4. serial number. 

B. 1. port monitor, 2. up time, 3. unit priority, 4. serial number. 

C. 1. unit priority, 2. up time, 3. port monitor, 4. serial number. 

D. 1. up time, 2. unit priority, 3. port monitor, 4. serial number. 


Q7. – (Topic 9) 

Which two web filtering inspection modes inspect the full URL? (Choose two.) 

A. DNS-based. 

B. Proxy-based. 

C. Flow-based. 

D. URL-based. 

Answer: B,C 

Q8. – (Topic 15) 

Review the IPsec phase 1 configuration in the exhibit; then answer the question below. 

Which statements are correct regarding this configuration? (Choose two.) 

A. The remote gateway address on 

B. The local IPsec interface address is 

C. The local gateway IP is the address assigned to port1. 

D. The local gateway IP address is 

Answer: A,C 

Q9. – (Topic 4) 

Which two statements are true regarding firewall policy disclaimers? (Choose two.) 

A. They cannot be used in combination with user authentication. 

B. They can only be applied to wireless interfaces. 

C. Users must accept the disclaimer to continue. 

D. The disclaimer page is customizable. 

Answer: C,D 

Q10. – (Topic 11) 

Examine the exhibit below; then answer the question following it. 

In this scenario, the FortiGate unit in Ottawa has the following routing table: 

S* [10/0] via, port2 

C is directly connected, port1 

C is directly connected, port2 

Sniffer tests show that packets sent from the source IP address to the destination IP address are being dropped by the FortiGate located in Ottawa. Which of the following correctly describes the cause for the dropped packets? 

A. The forward policy check. 

B. The reverse path forwarding check. 

C. The subnet is NOT in the Ottawa FortiGate’s routing table. 

D. The destination workstation does NOT have the subnet in its routing table.