Fortinet NSE4 Online Practice Questions and Exam Preparation

Fortinet NSE4 Online Questions & Answers

• Question 171:

  On your FortiGate 60D, you've configured firewall policies. They port forward traffic to your Linux Apache web server. Select the best way to protect your web server by using the IPS engine.

  A. Enable IPS signatures for Linux servers with HTTP, TCP and SSL protocols and Apache applications. Configured DLP to block HTTP GET request with credit card numbers.
  B. Enable IPS signatures for Linux servers with HTTP, TCP and SSL protocols and Apache applications. Configure DLP to block HTTP GET with credit card numbers. Also configure a DoS policy to prevent TCP SYn floods and port scans.
  C. None. FortiGate 60D is a desktop model, which does not support IPS.
  D. Enable IPS signatures for Linux and windows servers with FTP, HTTP, TCP, and SSL protocols and Apache and PHP applications.
  D. Enable IPS signatures for Linux and windows servers with FTP, HTTP, TCP, and SSL protocols and Apache and PHP applications.

• Question 172:

  Which of the following statements best describes what a Public Certificate Authority (CA) is?

  A. A service that provides a digital certificate each time a user is authenticating
  B. An entity that certifies that the information contained in a digital certificate is valid and true.
  C. The FortiGate process in charge of generating digital certificates on the fly for SSL inspection purposes
  D. A service that validates digital certificates for certificate-based authentication purposes
  D. A service that validates digital certificates for certificate-based authentication purposes

• Question 173:

  What are valid options for handling DNS requests sent directly to a FortiGate's interface IP? (Choose three.)

  A. Conditional-forward.
  B. Forward-only.
  C. Non-recursive.
  D. Iterative.
  E. Recursive.
  B. Forward-only.
  C. Non-recursive.
  E. Recursive.

• Question 174:

  The exhibit shows a FortiGate routing table.

  

  Which of the following statements are correct?(Choose two)

  A. There is only one active default route.
  B. The distance values for the route to 192.168.1.0/24 is 200
  C. An IP address in the subnet 172.16.78.0/24 has been assigned to the dmz interface.
  D. The FortiGate will route the traffic to 172.17.1.2 to next hop with the IP address 192.168.11.254
  A. There is only one active default route.
  D. The FortiGate will route the traffic to 172.17.1.2 to next hop with the IP address 192.168.11.254

• Question 175:

  Which of the following statements is true regarding a FortiGate device operating in transparent mode? (Choose three.)

  A. It acts as a layer 2 bridge
  B. It acts as a layer 3 router
  C. It forwards frames using the destination MAC address.
  D. It forwards packets using the destination IP address.
  E. It can perform content inspection (antivirus, web filtering, etc)
  A. It acts as a layer 2 bridge
  C. It forwards frames using the destination MAC address.
  E. It can perform content inspection (antivirus, web filtering, etc)

• Question 176:

  Which best describe the mechanism of a TCP SYN flood?

  A. The attacker keeps open many connections with slow data transmission so that other clients cannot start new connections.
  B. The attacker sends a packet designed to "sync" with the FortiGate.
  C. The attacker sends a specially crafted malformed packet, intended to crash the target by exploiting its parser.
  D. The attacker starts many connections, but never acknowledges to fully form them.
  D. The attacker starts many connections, but never acknowledges to fully form them.

• Question 177:

  Which statement concerning IPS is false?

  A. IPS packages contain an engine and signatures used by both IPS and other flow-based scans.
  B. One-arm topology with sniffer mode improves performance of IPS blocking.
  C. IPS can detect zero-day attacks.
  D. The status of the last service update attempt from FortiGuard IPS is shown on System>Config>FortiGuard and in output from 'diag autoupdate version'
  D. The status of the last service update attempt from FortiGuard IPS is shown on System>Config>FortiGuard and in output from 'diag autoupdate version'

• Question 178:

  Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit below.

  

  Which statements are correct regarding this output (Choose two.)

  A. The connecting client has been allocated address 172.20.1.1.
  B. In the Phase 1 settings, dead peer detection is enabled.
  C. The tunnel is idle.
  D. The connecting client has been allocated address 10.200.3.1.
  A. The connecting client has been allocated address 172.20.1.1.
  B. In the Phase 1 settings, dead peer detection is enabled.

• Question 179:

  Which of the following actions that can be taken by the Data Leak Prevention scanning? (Choose three.)

  A. Block
  B. Reject
  C. Tag
  D. Log only
  E. Quarantine IP address
  A. Block
  D. Log only
  E. Quarantine IP address

• Question 180:

  In which process states is it impossible to interrupt/kill a process? (Choose two.)

  A. S-Sleep
  B. R-Running
  C. D-Uninterruptable Sleep
  D. Z-Zombie
  C. D-Uninterruptable Sleep
  D. Z-Zombie