Proper study guides for Replace Fortinet Fortinet Network Security Expert 4 Written Exam (400) certified begins with Fortinet fortinet nse4 dumps preparation products which designed to deliver the Simulation nse4 exam dump questions by making you pass the fortinet nse4 exam dumps test at your first time. Try the free fortinet nse4 exam dumps demo right now.


2026 New NSE4 Exam Dumps with PDF and VCE Free: https://www.2passeasy.com/dumps/NSE4/

Q1. - (Topic 14) 

Which of the following sequences describes the correct order of criteria used for the selection of a master unit within a FortiGate high availability (HA) cluster when override is disabled? 

A. 1. port monitor, 2. unit priority, 3. up time, 4. serial number. 

B. 1. port monitor, 2. up time, 3. unit priority, 4. serial number. 

C. 1. unit priority, 2. up time, 3. port monitor, 4. serial number. 

D. 1. up time, 2. unit priority, 3. port monitor, 4. serial number. 

Answer: B 

Q2. - (Topic 12) 

Which statements are correct regarding virtual domains (VDOMs)? (Choose two.) 

A. VDOMs divide a single FortiGate unit into two or more virtual units that each have dedicated memory and CPUs. 

B. A management VDOM handles SNMP, logging, alert email, and FDN-based updates. 

C. VDOMs share firmware versions, as well as antivirus and IPS databases. 

D. Different time zones can be configured in each VDOM. 

Answer: B,C 

Q3. - (Topic 12) 

A FortiGate is configured with three virtual domains (VDOMs). Which of the following statements is correct regarding multiple VDOMs? 

A. The FortiGate must be a model 1000 or above to support multiple VDOMs. 

B. A license has to be purchased and applied to the FortiGate before VDOM mode could be enabled. 

C. Changing the operational mode of a VDOM requires a reboot of the FortiGate. 

D. The FortiGate supports any combination of VDOMs in NAT/Route and transparent modes. 

Answer: D 

Q4. - (Topic 14) 

In a high availability cluster operating in active-active mode, which of the following correctly describes the path taken by the SYN packet of an HTTP session that is offloaded to a slave unit? 

A. Request: internal host; slave FortiGate; master FortiGate; Internet; web server. 

B. Request: internal host; slave FortiGate; Internet; web server. 

C. Request: internal host; slave FortiGate; master FortiGate; Internet; web server. 

D. Request: internal host; master FortiGate; slave FortiGate; Internet; web server. 

Answer: D 

Q5. - (Topic 14) 

What are the requirements for a HA cluster to maintain TCP connections after device or link failover? (Choose two.) 

A. Enable session pick-up. 

B. Enable override. 

C. Connections must be UDP or ICMP. 

D. Connections must not be handled by a proxy. 

Answer: A,D 

Q6. - (Topic 15) 

Review the IKE debug output for IPsec shown in the exhibit below. 

Which statements is correct regarding this output? 

A. The output is a phase 1 negotiation. 

B. The output is a phase 2 negotiation. 

C. The output captures the dead peer detection messages. 

D. The output captures the dead gateway detection packets. 

Answer: C 

Q7. - (Topic 12) 

A FortiGate is configured with multiple VDOMs. An administrative account on the device has been assigned a Scope value of VDOM:root. 

Which of the following settings will this administrator be able to configure? (Choose two.) 

A. Firewall addresses. 

B. DHCP servers. 

C. FortiGuard Distribution Network configuration. 

D. System hostname. 

Answer: A,B 

Q8. - (Topic 7) 

Which statement is correct regarding virus scanning on a FortiGate unit? 

A. Virus scanning is enabled by default. 

B. Fortinet customer support enables virus scanning remotely for you. 

C. Virus scanning must be enabled in a security profile, which must be applied to a firewall policy. 

D. Enabling virus scanning in a security profile enables virus protection for all traffic flowing through the FortiGate. 

Answer: C 

Q9. - (Topic 16) 

Examine the following log message for IPS: 

2012-07-01 09:54:28 oid=2 log_id=18433 type=ips subtype=anomaly pri=alert vd=root severity="critical" src="192.168.3.168" dst="192.168.3.170" src_int="port2" serial=0 status="detected" proto=1 service="icmp" count=1 attack_name="icmp_flood" icmp_id="0xa8a4" icmp_type="0x08" icmp_code="0x00" attack_id=16777316 sensor="1" ref="http://www.fortinet.com/ids/VID16777316" msg="anomaly: icmp_flood, 51 > threshold 50" 

Which statement is correct about the above log? (Choose two.) 

A. The target is 192.168.3.168. 

B. The target is 192.168.3.170. 

C. The attack was NOT blocked. 

D. The attack was blocked. 

Answer: B,C 

Q10. - (Topic 4) 

Which two statements are true regarding firewall policy disclaimers? (Choose two.) 

A. They cannot be used in combination with user authentication. 

B. They can only be applied to wireless interfaces. 

C. Users must accept the disclaimer to continue. 

D. The disclaimer page is customizable. 

Answer: C,D