We provide real nse4 fortinet exam questions and answers braindumps in two formats. Download PDF & Practice Tests. Pass Fortinet fortinet nse4 exam Exam quickly & easily. The fortinet nse4 dumps PDF type is available for reading and printing. You can print more and practice many times. With the help of our Fortinet nse4 dumps dumps pdf and vce product and material, you can easily pass the nse4 exam dump exam.


2024 New NSE4 Exam Dumps with PDF and VCE Free: https://www.2passeasy.com/dumps/NSE4/

Q1. - (Topic 16) 

Which statement correctly describes the output of the command diagnose ips anomaly list? 

A. Lists the configured DoS policy. 

B. List the real-time counters for the configured DoS policy. 

C. Lists the errors captured when compiling the DoS policy. 

D. Lists the IPS signature matches. 

Answer: B 

Q2. - (Topic 22) 

Which statements are true about offloading antivirus inspection to a Security Processor (SP)? (Choose two.) 

A. Both proxy-based and flow-based inspection are supported. 

B. A replacement message cannot be presented to users when a virus has been detected. 

C. It saves CPU resources. 

D. The ingress and egress interfaces can be in different SPs. 

Answer: B,C 

Q3. - (Topic 15) 

Review the IPsec diagnostics output of the command diagnose vpn tunnel list shown in the exhibit. 

Which statements is correct regarding this output? (Select one answer). 

A. One tunnel is rekeying. 

B. Two tunnels are rekeying. 

C. Two tunnels are up. 

D. One tunnel is up. 

Answer: C 

Q4. - (Topic 4) 

What methods can be used to deliver the token code to a user that is configured to use two-factor authentication? (Choose three.) 

A. Browser pop-up window. 

B. FortiToken. 

C. Email. 

D. Code books. 

E. SMS phone message. 

Answer: B,C,E 

Q5. - (Topic 21) 

What functions can the IPv6 Neighbor Discovery protocol accomplish? (Choose two.) 

A. Negotiate the encryption parameters to use. 

B. Auto-adjust the MTU setting. 

C. Autoconfigure addresses and prefixes. 

D. Determine other nodes reachability. 

Answer: C,D 

Q6. - (Topic 4) 

Which statement regarding the firewall policy authentication timeout is true? 

A. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source IP. 

B. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source IP address after this timer has expired. 

C. It is an idle timeout. The FortiGate considers a user to be “idle” if it does not see any packets coming from the user’s source MAC. 

D. It is a hard timeout. The FortiGate removes the temporary policy for a user’s source MAC address after this timer has expired. 

Answer: A 

Q7. - (Topic 5) 

Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.) 

A. Split tunneling is supported. 

B. It requires the installation of a VPN client. 

C. It requires the use of an Internet browser. 

D. It does not support traffic from third-party network applications. 

E. An SSL VPN IP address is dynamically assigned to the client by the FortiGate unit. 

Answer: A,B,E 

Q8. - (Topic 18) 

Which tasks fall under the responsibility of the SSL proxy in a typical HTTPS connection? (Choose two.) 

A. The web client SSL handshake. 

B. The web server SSL handshake. 

C. File buffering. 

D. Communication with the URL filter process. 

Answer: A,B 

Q9. - (Topic 1) 

What capabilities can a FortiGate provide? (Choose three.) 

A. Mail relay. 

B. Email filtering. 

C. Firewall. 

D. VPN gateway. 

E. Mail server. 

Answer: B,C,D 

Q10. - (Topic 11) 

Examine the exhibit; then answer the question below. 

The Vancouver FortiGate initially had the following information in its routing table: S 172.20.0.0/16 [10/0] via 172.21.1.2, port2 

C 172.21.0.0/16 is directly connected, port2 C 172.11.11.0/24 is directly connected, port1 Afterwards, the following static route was added: config router static edit 6 set dst 172.20.1.0 255.255.255.0 set pririoty 0 set device port1 set gateway 172.11.12.1 next end Since this change, the new static route is NOT showing up in the routing table. Given the 

information provided, which of the following describes the cause of this problem? 

A. The subnet 172.20.1.0/24 is overlapped with the subnet of one static route that is already in the routing table (172.20.0.0/16), so, we need to enable allow-subnet-overlap first. 

B. The 'gateway' IP address is NOT in the same subnet as the IP address of port1. 

C. The priority is 0, which means that the route will remain inactive. 

D. The static route configuration is missing the distance setting. 

Answer: B