Fortinet Network Security Expert 4 Written Exam (400) Sample Questions:

1. Examine the exhibit; then answer the question below.

The Vancouver FortiGate initially had the following information in its routing table:
S 172.20.0.0/16 [10/0] via 172.21.1.2, port2
C 172.21.0.0/16 is directly connected, port2
C 172.11.11.0/24 is directly connected, port1
Afterwards, the following static route was added:
config router static
edit 6
set dst 172.20.1.0 255.255.255.0
set priority 0
set device port1
set gateway 172.11.12.1
next
Since this change, the new static route is NOT showing up in the routing table. Given the information provided, which of the following describes the cause of this problem?

A) The static route configuration is missing the distance setting.
B) The priority is 0, which means that the route will remain inactive.
C) The 'gateway' IP address is NOT in the same subnet as the IP address of port1.
D) The subnet 172.20.1.0/24 is overlapped with the subnet of one static route that is already in the routing table (172.20.0.0/16), so, we need to enable allow-subnet-overlap first.

2. Which of the following statements are true about PKI users created in a FortiGate device?
(Choose two.)

A) Can be used for token-based authentication
B) Cannot be members of user groups
C) Can be used for two-factor authentication
D) Are used for certificate-based authentication

3. A FortiGate administrator with the super_admin profile configures a virtual domain (VDOM) for a new customer. After creating the VDOM, the administrator is unable to reassign the dmz interface to the new VDOM as the option is greyed out in the GUI in the management
VDOM.
What would be a possible cause for this problem?

A) The dmz interface is referenced in the configuration of another VDOM.
B) The administrator does not have the proper permissions the dmz interface.
C) Non-management VDOMs cannot reference physical interfaces
D) The dmz interface is in PPPoE or DHCP mode.

4. Two FortiGate units with NP6 processors form an active-active cluster. The cluster is doing security profile (UTM) inspection over all the user traffic.
What statements are true regarding the sessions that the master unit is offloading to the slave unit for inspection? (Choose two.)

A) They are offloaded to the NP6 in the master unit.
B) They are offloaded to the NP6 in the slave unit.
C) They are not offloaded to the NP6 in the slave unit.
D) They are not offloaded to the NP6 in the master unit.

5. For FortiGate devices equipped with Network Processor (NP) chips, which are true?
(Choose three.)

A) The kernel does not need to program the NPU. When the NPU sees the traffic, it determines by itself whether it can process the traffic
B) Once offloaded, unless there are errors, the NP forwards all subsequent packets. The
CPU does not process them.
C) When the last packet is sent or received, such as a TCP FIN or TCP RST signal, the NP returns this session to the CPU for tear down.
D) Sessions for policies that have a security profile enabled can be NP offloaded.
E) For each new IP session, the first packet always goes to the CPU.

Solutions: