Fortinet Network Security Expert 4 Written Exam (400) (NSE4) Free Practice Test

Question 1

If you have lost your password for the "admin" account on your FortiGate, how should you reset it?

A. Reboot the FortiGate. Via the local console, during the boot loader, use the menu to log in as "maintainer" and enter the CLI commands to set the password for the "admin" account.

B. Reboot the FortiGate. Via the local console, during the boot loader, use the menu to format the flash disk and reinstall the firmware. Then you can log in with the default password.

C. Log in with another administrator account that has "super_admin" profile permissions, then reset the password for the "admin" account.

D. Power off the FortiGate. After several seconds, restart it. Via the local console, within 30 seconds after booting has completed, log in as "maintainer" and enter the CLI commands to set the password for the "admin" account.

Correct Answer: D

Question 2

Which of the following items is NOT a packet characteristic matched by a firewall service object?

A. ICMP type and code

B. TCP/UDP source and destination ports

C. IP protocol number

D. TCP sequence number

Correct Answer: D

Question 3

In an IPSec gateway-to-gateway configuration, two FortiGate units create a VPN tunnel between two separate private networks. Which of the following configuration steps must be performed on both FortiGate units to support this configuration?

A. Create firewall policies to control traffic between the IP source and destination address.

B. Configure the appropriate user groups on the FortiGate units to allow users access to the IPSec VPN connection.

C. Define the Phase 2 parameters that the FortiGate unit needs to create a VPN tunnel with the remote peer.

D. Set the operating mode of the FortiGate unit to IPSec VPN mode.

E. Define the Phase 1 parameters that the FortiGate unit needs to authenticate the remote peers.

Correct Answer: A,C,E

Question 4

What functions can the IPv6 Neighbor Discovery Protocol accomplish? (Choose two.)

A. Autoconfigure addresses and prefixes.

B. Negotiate the encryption parameters to use.

C. Determine other nodes reachability.

D. Auto-adjust the MTU setting.

Correct Answer: A,C

Question 5

Which is true about incoming and outgoing interfaces in firewall policies?

A. A zone may not be used.

B. Source and destination interfaces are mandatory.

C. Multiple interfaces may not be used for both incoming and outgoing.

D. A physical interface may not be used.

Correct Answer: B

Question 6

You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using routebased mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route.
Which two configuration steps are required to achieve these objectives? (Choose two.)

A. Create two firewall policies.

B. Add a route to the remote subnet.

C. Add two IPsec phases 2.

D. Create one firewall policy.

Correct Answer: A,B

Question 7

Which statements are true regarding traffic shaping that is applied in an application sensor, and associated with the firewall policy? (Choose two.)

A. Only traffic matching the application control signature is shaped.

B. Per-IP traffic shaping cannot be used.

C. Shared traffic shaping cannot be used.

D. Can limit the bandwidth usage of heavy traffic applications.

Correct Answer: A,D

Question 8

A FortiGate unit has multiple VDOMs in NAT/route mode with multiple VLAN interfaces in each VDOM. Which of the following statements is correct regarding the IP addresses assigned to each VLAN interface?

A. Different VLANs can share the same IP address as long as they are in different physical interface.

B. Different VLANs can share the same IP address as long as they are in different VDOMs.

C. Different VLANs can share the same IP address as long as they have different VLAN
IDs.

D. Different VLANs can never share the same IP addresses.

Correct Answer: B

Question 9

Which of the following actions that can be taken by the Data Leak Prevention scanning?
(Choose three.)

A. Tag

B. Reject

C. Log only

D. Quarantine IP address

E. Block

Correct Answer: C,D,E

Question 10

Which of the following web filtering modes can inspect the full URL? (Choose two.)

A. Policy based

B. DNS based

C. Flow based

D. Proxy based

Correct Answer: C,D

Question 11

Which TCP states does the global setting 'tcp-half-open-timer' applies to? (Choose two.)

A. SYN SENT

B. FIN WAIT

C. TIME WAIT

D. SYN & SYN/ACK

Correct Answer: A,C

Question 12

Which of the following statements are true regarding the web filtering modes? (Choose two.)

A. Proxy based mode requires more resources than flow-based.

B. Flow based mode offers more settings under the advanced configuration section of the
GUI.

C. Proxy based mode allows for customizable block pages to display when sites are prevented.

D. Proxy based mode offers higher throughput than flow-based mode.

Correct Answer: A,C

Question 13

A static route is configured for a FortiGate unit from the CLI using the following commands:
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions are required for this static default route to be displayed in the FortiGate unit's routing table? (Choose two.)

A. The administrative status of the wan1 interface is displayed as down.

B. The wan1 interface address and gateway address are on the same subnet.

C. The link status of the wan1 interface is displayed as up.

D. All other default routers should have a lower distance.

Correct Answer: B,C

Question 14

In a FSSO agent mode solution, how does the FSSO collector agent learn each IP address?

A. The collector agent does not know, and does not need, each user IP address. Only workstation names are known by the collector agent.

B. The DC agents get each user IP address from the event logs and forward that information to the collector agent

C. The collector agent frequently polls the AD domain controllers to get each user IP address.

D. The DC agent learns the workstation name from the event logs and DNS is then used to translate those names to the respective IP addresses.

Correct Answer: D

Question 15

Which of the following statements best describe the main requirements for a traffic session to be offload eligible to an NP6 processor? (Choose three.)

A. Session packets do NOT have an 802.1Q VLAN tag.

B. It does NOT require flow-based inspection.

C. It is NOT multicast traffic.

D. It does NOT require proxy-based inspection.

E. Layer 4 protocol must be UDP, TCP, SCTP or ICMP.

Correct Answer: B,D,E

Welcome to TestSimulate

Fortinet Network Security Expert 4 Written Exam (400) (NSE4) Free Practice Test