NSE4 Exam Questions

When the SSL proxy inspects the server certificate for Web Filtering only in SSL Handshake mode, which certificate field is being used to determine the site rating?

Which of the following describes the best custom signature for detecting the use of the word "Fortinet" in chat applications?

When configuring a server load balanced virtual IP, which of the following is the best distribution algorithm to be used in applications where the same physical destination server...

Which of the following Session TTL values will take precedence?

If Routing Information Protocol (RIP) version 1 or version 2 has already been configured on a FortiGate unit, which of the following statements is correct if the routes learned thr...

In the Tunnel Mode widget of the web portal, the administrator has configured an IP Pool and enabled split tunneling. Which of the following statements is true about the IP address...

The Host Check feature can be enabled on the FortiGate unit for SSL VPN connections. When this feature is enabled, the FortiGate unit probes the remote host computer to verify that...

Which of the following report templates must be used when scheduling report generation?

Which of the following statements is not correct regarding virtual domains (VDOMs)?

Which of the following must be configured on a FortiGate unit to redirect content requests to remote web cache servers?

Which of the following statements is correct based on the firewall configuration illustrated in the exhibit?

Which of the following statements is correct regarding the NAC Quarantine feature?

What advantages are there in using a fully Meshed IPSec VPN configuration instead of a hub and spoke set of IPSec tunnels?

An administrator wishes to generate a report showing Top Traffic by service type, but wants to exclude SMTP traffic from the report. Which of the following statements best describe...

An organization wishes to protect its SIP Server from call flooding attacks. Which of the following configuration changes can be performed on the FortiGate unit to fulfill this req...

In a High Availability configuration operating in Active-Active mode, which of the following correctly describes the path taken by a load-balanced HTTP session?

An administrator is examining the attack logs and notices the following entry: device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime...

The following diagnostic output is displayed in the CLI: diag firewall auth list policy iD. 9, srC. 192.168.3.168, action: accept, timeout: 13427 user: forticlient_chk_only, group:...

An administrator is configuring a DLP rule for FTP traffic. When adding the rule to a DLP sensor, the administrator notes that the Ban Sender action is not available (greyed-out),...

Which of the following statements are correct regarding URL Filtering on the FortiGate unit? (Select all that apply.)

An administrator sets up a new FTP server on TCP port 2121. A FortiGate unit is located between the FTP clients and the server. The administrator has created a policy for TCP port...

Which of the following statements is correct about configuring web filtering overrides?

A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 int...

Which of the following features could be used by an administrator to block FTP uploads while still allowing FTP downloads?

A portion of the device listing for a FortiAnalyzer unit is displayed in the exhibit. Which of the following statements best describes the reason why the FortiGate 60B unit is unab...

When viewing the Banned User monitor in Web Config, the administrator notes the entry illustrated in the exhibit. Which of the following statements is correct regarding this entry?

The transfer of encrypted files or the use of encrypted protocols between users and servers on the internet can frustrate the efforts of administrators attempting to monitor traffi...

Which of the following DLP actions will override any other action?

A FortiClient fails to establish a VPN tunnel with a FortiGate unit. The following information is displayed in the FortiGate unit logs: msg="Initiator: sent 192.168.11.101 main mod...

Which of the following statements correctly describes the deepscan option for HTTPS?

An intermittent connectivity issue is noticed between two devices located behind the FortiGate dmz and internal interfaces. A continuous sniffer trace is run on the FortiGate unit...

The following ban list entry is displayed through the CLI. get user ban list id cause src-ip-addr dst-ip-addr expires created 531 protect_client 10.177.0.21 207.1.17.1 indefinite W...

A network administrator needs to implement dynamic route redundancy between a FortiGate unit located in a remote office and a FortiGate unit located in the central office. The remo...

When performing a log search on a FortiAnalyzer, it is generally recommended to use the Quick Search option. What is a valid reason for using the Full Search option, instead?

The diag sys session list command is executed in the CLI. The output of this command is shown in the exhibit. Based on the output from this command, which of the following statemen...

What protocol cannot be used with the active authentication type?

Review the exhibit of an explicit proxy policy configuration. If there is a proxy connection attempt coming from the IP address 10.0.1.5, and from a user that has not authenticated...

Which of the following statements are true regarding DLP File Type Filtering? (Choose two.)

Which of the following settings can be configured per VDOM? (Choose three)

Which protocols can you use for secure administrative access to a FortiGate? (Choose two)

What are examples of correct syntax for the session table diagnostics command? (Choose two.)

A FortiGate interface is configured with the following commands: What statements about the configuration are correct? (Choose two.)

Which of the following Fortinet hardware accelerators can be used to offload flow-based antivirus inspection? (Choose two.)

Under what circumstance would you enable LEARN as the Action on a firewall policy?

What methods can be used to deliver the token code to a user who is configured to use two- factor authentication? (Choose three.)

You are tasked to architect a new IPsec deployment with the following criteria: - There are two HQ sites that all satellite offices must connect to. - The satellite offices do not...

View the exhibit. Which of the following statements are correct? (Choose two.)

Which statements about DNS filter profiles are true? (Choose two.)

An administrator needs to offload logging to FortiAnalyzer from a FortiGate with an internal hard drive. Which statements are true? (Choose two.)

Which of the following statements describe WMI polling mode for FSSO collector agent? (Choose two.)