Fortinet NSE 4 FortiOS 7.0 Practice Set (Legacy)

NSE4 practice test: what's covered

• Firewall Policies & NAT
• Security Profiles
• SSL Inspection
• IPsec/SSL VPN
• Routing
• SD-WAN
• HA
• Security Fabric

Free NSE4 sample questions

1. A FortiGate policy uses proxy-based antivirus. A user downloads a 4 MB PDF that is under the oversize threshold. Which two statements describe that inspection? (Choose two.)

   • A. The FortiGate buffers the file and scans it before releasing the file to the client.
   • B. The oversize threshold still matters: a larger file follows the configured oversize action instead of a full buffer scan.
   • C. Proxy-based antivirus always streams the unscanned file to the client while the scan is still running.
   • D. Flow-based inspection must be enabled before proxy-based antivirus can run.
   Show answer

   Correct: A and B. Proxy-based antivirus stores the file (up to the oversize limit), scans it, then forwards it. It does not stream the body to the client during the scan. Flow-based inspection is a different mode, not a prerequisite. Files past the oversize limit follow the allow or block action configured for oversized files.

2. FortiGuard rates an entire training site as Bandwidth Consuming, but a school must allow only https://learn.school.test/start and keep the rest of that rating blocked. Which two configuration steps do this? (Choose two.)

   • A. Create a web rating override that maps that exact URL to a custom category the school allows.
   • B. Keep the web filter profile on the firewall policy so the override category is what the policy evaluates.
   • C. Add a static route for the site so FortiGuard category checks are skipped.
   • D. Disable FortiGuard web filtering on the LAN interface.
   Show answer

   Correct: A and B. A web rating override changes the category of one URL or host. The web filter profile then allows or blocks that new category. A static route does not change FortiGuard ratings, and disabling web filtering on the interface would allow the whole category.

3. An administrator is configuring an IPsec VPN between site A and site B. The Remote Gateway setting on both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.168.1.0/24 and the remote quick mode selector is 192.168.2.0/24. Which subnet must the administrator configure for the local quick mode selector for site B?

   • A. 192.168.1.0/24
   • B. 192.168.0.0/24
   • C. 192.168.2.0/24
   • D. 192.168.3.0/24
   Show answer

   Correct: C. Quick mode (phase 2) selectors must mirror each other on the two peers. Site A's remote selector (192.168.2.0/24) is the network behind site B, so site B's local selector must be 192.168.2.0/24 and its remote selector must be 192.168.1.0/24. Mismatched selectors cause phase 2 to fail.

4. Which CLI command allows administrators to troubleshoot Layer 2 issues, such as an IP address conflict?

   • A. get system status
   • B. get system performance status
   • C. diagnose sys top
   • D. get system arp
   Show answer

   Correct: D. The ARP table maps IP addresses to MAC addresses, so 'get system arp' reveals duplicate IPs or an IP bound to the wrong device — a Layer 2 problem. 'get system status' shows firmware/serial, 'get system performance status' shows CPU/memory, and 'diagnose sys top' shows running processes; none expose ARP conflicts.

5. Refer to the exhibit. The exhibit shows the IPS sensor configuration. If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)

   • A. The sensor will allow attackers matching the NTP.Spoofed.KoD.DoS signature.
   • B. The sensor will block all attacks aimed at Windows servers.
   • C. The sensor will reset all connections that match these signatures.
   • D. The sensor will gather a packet log for all matched traffic.
   Show answer

   Correct: A and B. In the sensor, the NTP.Spoofed.KoD.DoS signature has Action = Monitor, which passes (allows) the traffic while logging it, so matching attacks are allowed. The Windows OS filter has Action = Block, so attacks targeting Windows servers are blocked. No filter uses Reset, and packet logging is enabled only on the NTP entry (disabled on the Windows filter), so it is not gathered for all matched traffic.

Last updated: 2026-10-19

NSE4 practice test FAQ

Related practice tests

• FortiGate FCP_FGT_AD-7.4 practice test
• Fortinet FCSS_EFW_AD-7.6 practice test
• Fortinet NSE 5 practice test
• Fortinet NSE7-EFW practice test
• Fortinet NSE 8 practice test