Fortinet NSE4 Online Practice Questions and Exam Preparation

Fortinet NSE4 Online Questions & Answers

• Question 161:

  Regarding the use of web-only mode SSL VPN, which statement is correct?

  A. It support SSL version 3 only.
  B. It requires a Fortinet-supplied plug-in on the web client.
  C. It requires the user to have a web browser that suppports 64-bit cipher length.
  D. The JAVA run-time environment must be installed on the client.
  C. It requires the user to have a web browser that suppports 64-bit cipher length.

• Question 162:

  Which of the following statements is true regarding the differences between route-based and policy-based IPsec VPNs? (Choose two.)

  A. The firewall policies for policy-based are bidirectional. The firewall policies for route- based are unidirectional.
  B. In policy-based VPNs the traffic crossing the tunnel must be routed to the virtual IPsec interface. In route-based, it does not.
  C. The action for firewall policies for route-based VPNs may be Accept or Deny, for policy- based VPNs it is Encrypt.
  D. Policy-based VPN uses an IPsec interface, route-based does not.
  A. The firewall policies for policy-based are bidirectional. The firewall policies for route- based are unidirectional.
  C. The action for firewall policies for route-based VPNs may be Accept or Deny, for policy- based VPNs it is Encrypt.

• Question 163:

  Which statement is in advantage of using a hub and spoke IPsec VPN configuration instead of a fully-meshed set of IPsec tunnels?

  A. Using a hub and spoke topology provides full redundancy.
  B. Using a hub and spoke topology requires fewer tunnels.
  C. Using a hub and spoke topology uses stronger encryption protocols.
  D. Using a hub and spoke topology requires more routes.
  B. Using a hub and spoke topology requires fewer tunnels.

• Question 164:

  Which user group types does FortiGate support for firewall authentication? (Choose three.)

  A. RSSO
  B. Firewall
  C. LDAP
  D. NTLM
  E. FSSO
  A. RSSO
  B. Firewall
  E. FSSO

• Question 165:

  Which commands are appropriate for investigating high CPU? (Choose two.)

  A. diag sys top
  B. diag hardware sysinfo mem
  C. diag debug flow
  D. get system performance status
  A. diag sys top
  D. get system performance status

• Question 166:

  The FortiGate port1 is connected to the Internet. The FortiGate port2 is connected to the internal network. Examine the firewall configuration shown in the exhibit; then answer the question below.

  

  Based on the firewall configuration illustrated in the exhibit, which statement is correct?

  A. A user that has not authenticated can access the Internet using any protocol that does not trigger an authentication challenge.
  B. A user that has not authenticated can access the Internet using any protocol except HTTP, HTTPS, Telnet, and FTP.
  C. A user must authenticate using the HTTP, HTTPS, SSH, FTP, or Telnet protocol before they can access all Internet services.
  D. DNS Internet access is always allowed, even for users that have not authenticated.
  D. DNS Internet access is always allowed, even for users that have not authenticated.

• Question 167:

  Which of the following protocols are defined in the IPsec Standard? (Choose two)

  A. AH
  B. GRE
  C. SSL/TLS
  D. ESP
  A. AH
  D. ESP

• Question 168:

  Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing security profile (UTM) inspection over all the user traffic. What statements are true regarding the sessions that the master unit is offloading to the slave unit for inspection? (Choose two.)

  A. They are offloaded to the NP6 in the master unit.
  B. They are not offloaded to the NP6 in the master unit.
  C. They are offloaded to the NP6 in the slave unit.
  D. They are not offloaded to the NP6 in the slave unit.
  B. They are not offloaded to the NP6 in the master unit.
  C. They are offloaded to the NP6 in the slave unit.

• Question 169:

  A FortiGate is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root.

  Which of the following settings will this administrator be able to configure? (Choose two.)

  A. Firewall addresses
  B. DHCP servers
  C. FortiGuard Distribution Network configuration.
  D. System hostname.
  A. Firewall addresses
  B. DHCP servers

• Question 170:

  Which of the following options best defines what Diffie-Hellman is?

  A. A symmetric encryption algorithm.
  B. A "key-agreement" protocol.
  C. A "Security-association-agreement" protocol.
  D. An authentication algorithm.
  B. A "key-agreement" protocol.