Fortinet NSE 4 - FortiOS 7.0 (NSE4_FGT-7.0) is a nse 4-level Fortinet certification exam. The blueprint splits the exam across 6 domains, starting with FortiGate Security, FortiGate Infrastructure, Firewall policies. On exam day you face around 60 questions in 105 minutes, in formats such as multiple choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. Treat the set as a diagnostic: anything you get wrong points at a topic worth revising before you book the real exam. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 66+ question PDF.
20 free questions
105 min
$200 official fee
blueprint v7.0
Every free question shows the correct answer
Questions follow the official 6-domain blueprint
No account or email required
66+ questions in the full PDF
Looking for more? Click here to get the full PDF with 66+ practice questions for $10 for offline study and deeper preparation.
Question 1
Which two statements are correct regarding FortiGate HA cluster virtual IP addresses? (Choose two.)
A. change in the virtual IP address happens when a FortiGate device joins or leaves the cluster
B. Virtual IP addresses are used to distinguish between cluster members
C. Heartbeat interfaces have virtual IP addresses that are manually assigned
D. The primary device in the cluster is always assigned IP address 169.254.0.1.
Show Answer
Correct Answer:
A. change in the virtual IP address happens when a FortiGate device joins or leaves the cluster
B. Virtual IP addresses are used to distinguish between cluster members
Question 2
An administrator has a requirement to keep an application session from timing out on port 80. What two changes can the administrator make to resolve the issue without affecting any existing services running through FortiGate? (Choose two.)
A. Set the TTL value to never under config system-ttl
B. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy
C. Create a new service object for HTTP service and set the session TTL to never
D. Set the session TTL on the HTTP policy to maximum
Show Answer
Correct Answer:
B. Create a new firewall policy with the new HTTP service and place it above the existing HTTP policy
C. Create a new service object for HTTP service and set the session TTL to never
Question 3
Which two configuration settings are synchronized when FortiGate devices are in an active-active HA cluster? (Choose two.)
A. NTP
B. DNS
C. FortiGate hostname
D. FortiGuard web filter cache
Show Answer
Correct Answer:
A. NTP
B. DNS
Question 4
Which type of logs on FortiGate record information about traffic directly to and from the FortiGate management IP addresses?
A. System event logs
B. Security logs
C. Forward traffic logs
D. Local traffic logs
Show Answer
Correct Answer:
D. Local traffic logs
Question 5
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
A. The subject field in the server certificate
B. The subject alternative name (SAN) field in the server certificate
C. The serial number in the server certificate
D. The server name indication (SNI) extension in the client hello message
E. The host field in the HTTP header
Show Answer
Correct Answer:
A. The subject field in the server certificate
B. The subject alternative name (SAN) field in the server certificate
D. The server name indication (SNI) extension in the client hello message
Question 6
An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel. Which DPD mode on FortiGate will meet the above requirement?
A. On Demand
B. Disabled
C. On Idle
D. Enabled
Show Answer
Correct Answer:
C. On Idle
Question 7
What devices form the core of the security fabric?
A. Two FortiGate devices and one FortiAnalyzer device
B. One FortiGate device and one FortiManager device
C. One FortiGate device and one FortiAnalyzer device
D. Two FortiGate devices and one FortiManager device
Show Answer
Correct Answer:
A. Two FortiGate devices and one FortiAnalyzer device
Question 8
A network administrator is configuring a new IPsec VPN tunnel on FortiGate. The remote peer IP address is dynamic. In addition, the remote peer does not support a dynamic DNS update service. What type of remote gateway should the administrator configure on FortiGate for the new IPsec VPN tunnel to work?
A. Dialup User
B. Static IP Address
C. Pre-shared Key
D. Dynamic DNS
Show Answer
Correct Answer:
A. Dialup User
Question 9
A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and the file can be downloaded. What is the reason for the failed virus detection by FortiGate?
A. Antivirus definitions are not up to date
B. SSL/SSH Inspection profile is incorrect
C. Antivirus profile configuration is incorrect
D. Application control is not enabled
Show Answer
Correct Answer:
B. SSL/SSH Inspection profile is incorrect
Question 10
Which two statements are true about collector agent advanced mode? (Choose two.)
A. Security profiles can be applied only to user groups, not individual users
B. FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate
C. Advanced mode supports nested or inherited groups
D. Advanced mode uses Windows convention "" NetBios: Domain\Username
Show Answer
Correct Answer:
B. FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate
C. Advanced mode supports nested or inherited groups
Question 11
An organization's employee needs to connect to the office through a high-latency internet connection. Which SSL VPN setting should the administrator adjust to prevent the SSL VPN negotiation failure?
A. Change the session-ttl
B. Change the udp-idle-timer
C. Change the idle-timeout
D. Change the login-timeout
Show Answer
Correct Answer:
D. Change the login-timeout
Question 12
Which two statements are true about the Security Fabric rating? (Choose two.)
A. The Security Fabric rating is a free service that comes bundled with all FortiGate devices
B. Many of the security issues can be fixed immediately by clicking Apply where available
C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric
D. It provides executive summaries of the four largest areas of security focus
Show Answer
Correct Answer:
B. Many of the security issues can be fixed immediately by clicking Apply where available
C. The Security Fabric rating must be run on the root FortiGate device in the Security Fabric
Question 13
Which two types of traffic are managed only by the management VDOM? (Choose two.)
A. PKI
B. FortiGuard web filter queries
C. DNS
D. Traffic shaping
Show Answer
Correct Answer:
B. FortiGuard web filter queries
C. DNS
Question 14
Which three methods are used by the collector agent for AD polling? (Choose three.)
A. WMI
B. Novell API
C. WinSecLog
D. NetAPI
E. FortiGate polling
Show Answer
Correct Answer:
A. WMI
C. WinSecLog
D. NetAPI
Question 15
When a firewall policy is created, which attribute is added to the policy to support recording logs to a FortiAnalyzer or a FortiManager and improves functionality when a FortiGate is integrated with these devices?
A. Policy ID
B. Log ID
C. Universally Unique Identifier
D. Sequence ID
Show Answer
Correct Answer:
C. Universally Unique Identifier
Question 16
Which three options are the remote log storage options you can configure on FortiGate? (Choose three.)
A. FortiSandbox
B. FortiCloud
C. FortiSIEM
D. FortiCache
E. FortiAnalyzer
Show Answer
Correct Answer:
B. FortiCloud
C. FortiSIEM
E. FortiAnalyzer
Question 17
Which feature in the Security Fabric takes one or more actions based on event triggers?
A. Fabric Connectors
B. Security Rating
C. Logical Topology
D. Automation Stitches
Show Answer
Correct Answer:
D. Automation Stitches
Question 18
Which security feature does FortiGate provide to protect servers located in the internal networks from attacks such as SQL injections?
A. Denial of Service
B. Web application firewall
C. Antivirus
D. Application control
Show Answer
Correct Answer:
B. Web application firewall
Question 19
By default, FortiGate is configured to use HTTPS when performing live web filtering with FortiGuard servers. Which CLI command will cause FortiGate to use an unreliable protocol to communicate with FortiGuard servers for live web filtering?
A. set fortiguard-anycast disable
B. set webfilter-force-off disable
C. set webfilter-cache disable
D. set protocol tcp
Show Answer
Correct Answer:
A. set fortiguard-anycast disable
Question 20
What is the limitation of using a URL list and application control on the same firewall policy, in NGFW policy-based mode?
A. It limits the scanning of application traffic to use parent signatures only
B. It limits the scanning of application traffic to the browser-based technology category only
C. It limits the scanning of application traffic to the DNS protocol only
D. It limits the scanning of application traffic to the application category only
Show Answer
Correct Answer:
B. It limits the scanning of application traffic to the browser-based technology category only
NSE4_FGT-7.0 sample questions FAQ
Are these NSE4_FGT-7.0 sample questions from the real exam?
No. They are original practice questions written to match the format and topic mix of the Fortinet NSE 4 - FortiOS 7.0 exam, which contains around 60 questions. Treat them as representative practice, not leaked exam content.
How many free NSE4_FGT-7.0 sample questions do I get?
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 66+ questions.
Do the sample questions include the correct answers?
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Is 20 sample questions enough to pass the NSE4_FGT-7.0?
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 66+ question set under timed conditions before booking the exam.
Aced these? Get the Full Exam
Download the complete NSE4_FGT-7.0 study bundle with 66+ questions in a single printable PDF.