Refresh NSE4 Exam Study Guides With New Update Exam Questions

Q1. - (Topic 6) 

Which IPsec configuration mode can be used for implementing GRE-over-IPsec VPNs?. 

A. Policy-based only. 

B. Route-based only. 

C. Either policy-based or route-based VPN. 

D. GRE-based only. 

View Answer

Q2. - (Topic 6) 

You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route-based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route. 

Which two configuration steps are required to achieve these objectives? (Choose two.) 

A. Create one firewall policy. 

B. Create two firewall policies. 

C. Add a route to the remote subnet. 

D. Add two IPsec phases 2. 

View Answer

Q3. - (Topic 9) 

Which web filtering inspection mode inspects DNS traffic? 

A. DNS-based. 

B. FQDN-based. 

C. Flow-based. 

D. URL-based. 

View Answer

Q4. - (Topic 15) 

Review the IPsec phase 1 configuration in the exhibit; then answer the question below. 

Which statements are correct regarding this configuration? (Choose two.) 

A. The remote gateway address on 10.200.3.1. 

B. The local IPsec interface address is 10.200.3.1. 

C. The local gateway IP is the address assigned to port1. 

D. The local gateway IP address is 10.200.3.1. 

View Answer

Q5. - (Topic 9) 

Which of the following regular expression patterns make the terms "confidential data" case insensitive? 

A. [confidential data] 

B. /confidential data/i 

C. i/confidential data/ 

D. "confidential data" 

View Answer

Q6. - (Topic 3) 

The order of the firewall policies is important. Policies can be re-ordered from either the GUI or the CLI. Which CLI command is used to perform this function? 

A. set order 

B. edit policy 

C. reorder 

D. move 

View Answer

Q7. - (Topic 14) 

Two devices are in an HA cluster, the device hostnames are STUDENT and REMOTE. Exhibit A shows the command output of diagnose sys session stat for the STUDENT device. Exhibit B shows the command output of diagnose sys session stat for the REMOTE device. 

Exhibit A: 

Exhibit B: 

Given the information provided in the exhibits, which of the following statements are correct? (Choose two.) 

A. STUDENT is likely to be the master device. 

B. Session-pickup is likely to be enabled. 

C. The cluster mode is active-passive. 

D. There is not enough information to determine the cluster mode. 

View Answer

Q8. - (Topic 22) 

Which IP packets can be hardware-accelerated by a NP6 processor? (Choose two.) 

A. Fragmented packet. 

B. Multicast packet. 

C. SCTP packet. 

D. GRE packet. 

View Answer

Q9. - (Topic 15) 

Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit below. 

Which statements are correct regarding this output? (Choose two.) 

A. The connecting client has been allocated address 172.20.1.1. 

B. In the Phase 1 settings, dead peer detection is enabled. 

C. The tunnel is idle. 

D. The connecting client has been allocated address 10.200.3.1. 

View Answer

Q10. - (Topic 17) 

With FSSO, a domain user could authenticate either against the domain controller running the collector agent and domain controller agent, or a domain controller running only the domain controller agent. 

If you attempt to authenticate with a domain controller running only the domain controller agent, which statements are correct? (Choose two.) 

A. The login event is sent to the collector agent. 

B. The FortiGate receives the user information directly from the receiving domain controller agent of the secondary domain controller. 

C. The domain collector agent may perform a DNS lookup for the authenticated client's IP address. 

D. The user cannot be authenticated with the FortiGate in this manner because each domain controller agent requires a dedicated collector agent. 

View Answer