Fortinet NSE 4 - FortiGate Network Security Professional — Questions and Answers

Question 1: What security mechanism prevents wireless clients from connecting to rogue authentication servers impersonating legitimate ones in WPA2-Enterprise deployments?

SSID cloaking on the corporate access points
RF power management to limit signal propagation
Server certificate validation through a trusted PKI chain (Correct answer)
MAC address filtering on the RADIUS server

Correct answer: Server certificate validation through a trusted PKI chain

Validating the authentication server's certificate against a trusted CA ensures clients only connect to legitimate servers, preventing man-in-the-middle attacks with rogue RADIUS servers.

Question 2: Which assessment method provides the MOST reliable data for NSE professionals making critical decisions?

Social media reviews
Standardized tools combined with professional observation (Correct answer)
Informal verbal feedback alone
Single-source data from one stakeholder

Correct answer: Standardized tools combined with professional observation

Combining standardized tools with professional observation provides the most comprehensive data.

Question 3: A security analyst notices beaconing traffic from an internal host to an external IP at perfectly regular 60-second intervals. This most likely indicates:

A compromised host checking in with a C2 server (Correct answer)
Routine SNMP polling
Normal NTP synchronization
Scheduled backup replication

Correct answer: A compromised host checking in with a C2 server

Regular, periodic outbound connections from an internal host to an external IP are a hallmark of C2 beaconing, where malware checks for instructions at predictable intervals.

Question 4: Which technique do attackers use to bypass firewall rules by encapsulating malicious traffic inside an allowed protocol?

DNS zone transfer
MAC flooding
Tunneling (Correct answer)
ARP poisoning

Correct answer: Tunneling

Tunneling encapsulates one protocol inside another (e.g., HTTP or DNS) to bypass firewall port restrictions and carry unauthorized traffic.

Question 5: Which firewall type inspects packets at the application layer and can understand specific protocols like HTTP or FTP?

Application-layer (proxy) firewall (Correct answer)
Circuit-level gateway
Stateful inspection firewall
Packet-filtering firewall

Correct answer: Application-layer (proxy) firewall

Application-layer proxy firewalls operate at OSI Layer 7, understanding application protocols and inspecting payload content for policy enforcement.

Question 6: Which protocol is commonly used for secure file transfer?

SMTP
SFTP (Correct answer)
FTP
SNMP

Correct answer: SFTP

SFTP (SSH File Transfer Protocol) is a secure version of the File Transfer Protocol (FTP) that operates over an SSH (Secure Shell) connection. It provides encrypted file transfer capabilities, protecting data confidentiality and integrity during transmission. Unlike standard FTP, SFTP encrypts both commands and data, making it the preferred choice for transferring sensitive files securely.

Question 7: What is the primary security risk mitigated by enabling BPDU Guard on an access switch port?

Rogue switches causing spanning tree topology changes (Correct answer)
VLAN hopping via double tagging
MAC flooding attacks
ARP spoofing on the local segment

Correct answer: Rogue switches causing spanning tree topology changes

BPDU Guard shuts down an access port if it receives a BPDU frame, preventing rogue switches or tools from manipulating the STP topology.

Question 8: An organization experiences a supply chain compromise where a trusted software vendor's update was trojanized. Which IR phase would include revoking trust in all software from that vendor?

Post-Incident Activity
Detection and Analysis
Preparation
Eradication (Correct answer)

Correct answer: Eradication

Eradication involves removing all components of the threat, including revoking trust in compromised software sources to prevent reinfection.

Question 9: What is the purpose of a Cloud Security Posture Management (CSPM) tool?

To continuously monitor cloud environments for misconfigurations and compliance violations (Correct answer)
To replace cloud provider IAM services
To manage physical access to cloud data centers
To encrypt all data stored in the cloud automatically

Correct answer: To continuously monitor cloud environments for misconfigurations and compliance violations

CSPM tools continuously assess cloud resource configurations against security best practices and compliance frameworks, alerting on drift and misconfigurations.

Question 10: In cloud identity security, what is the risk posed by long-lived, unused IAM access keys that are never rotated?

They provide a persistent backdoor if stolen, as they never expire and may not be monitored (Correct answer)
They increase billing costs for the cloud account
They automatically gain additional permissions over time
They prevent MFA enforcement on the account

Correct answer: They provide a persistent backdoor if stolen, as they never expire and may not be monitored

Stale, unrotated IAM access keys that are stolen give attackers indefinite access since there is no expiration, and low usage may mean the compromise goes undetected.

Question 11: What is the purpose of egress filtering on a perimeter firewall?

To restrict unauthorized outbound traffic leaving the internal network (Correct answer)
To perform NAT on inbound connections
To inspect traffic between VLANs internally
To block inbound attacks from external networks

Correct answer: To restrict unauthorized outbound traffic leaving the internal network

Egress filtering prevents compromised internal hosts from exfiltrating data or communicating with command-and-control servers on the internet.

Question 12: Which component of the Cyber Kill Chain represents the attacker establishing a foothold after successful exploitation?

Delivery
Installation (Correct answer)
Weaponization
Actions on Objectives

Correct answer: Installation

The Installation phase occurs when the attacker installs a backdoor or remote access tool to maintain persistence after exploitation.

Question 13: Which type of DNS attack poisons a resolver's cache with forged responses to redirect users to malicious IP addresses?

NXDOMAIN hijacking
DNS cache poisoning (Kaminsky attack) (Correct answer)
DNS amplification
DNS tunneling

Correct answer: DNS cache poisoning (Kaminsky attack)

The Kaminsky attack exploits the DNS transaction ID space to inject forged responses into a resolver's cache before the legitimate reply arrives.

Question 14: What is the PRIMARY purpose of obtaining NSE certification in Network Security Expert?

To satisfy a personal achievement goal
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 15: Which enterprise technology automatically detects when a mobile device leaves a trusted corporate network and enforces VPN connectivity?

Wi-Fi Passpoint (Hotspot 2.0)
WPA3-Enterprise authentication
Trusted Network Detection (TND) (Correct answer)
Per-App VPN tunneling

Correct answer: Trusted Network Detection (TND)

Trusted Network Detection (TND) monitors network characteristics to determine if the device is on a trusted corporate network and automatically triggers VPN connection when it detects an untrusted environment.

Question 16: An attacker registers a domain visually similar to a target company's domain to deceive employees. This technique is called:

ARP spoofing
BGP hijacking
Typosquatting (Correct answer)
DNS poisoning

Correct answer: Typosquatting

Typosquatting involves registering domains with slight misspellings or visual similarity to legitimate domains to trick users into visiting malicious sites.

Question 17: What is post-incident analysis?

Root cause identification (Correct answer)
User survey
Disabling security
Legal compliance

Correct answer: Root cause identification

Post-incident analysis, also known as the 'lessons learned' phase, is a crucial step after an incident is resolved. Its primary purpose is to thoroughly investigate what happened, identify the root cause of the incident, and determine how to prevent similar incidents in the future. This analysis helps improve an organization's overall security posture.

Question 18: What does a captive portal in a wireless network primarily provide?

Stronger AES encryption for all wireless traffic
Real-time RF signal strength monitoring and reporting
A web-based authentication or terms-acceptance page before granting network access (Correct answer)
Automatic IP address and DNS assignment to wireless clients

Correct answer: A web-based authentication or terms-acceptance page before granting network access

A captive portal intercepts HTTP/HTTPS traffic and redirects unauthenticated users to a web page for credential entry or acceptance of terms before network access is granted.

Question 19: Which security framework is specifically designed to address adversary tactics and techniques targeting cloud environments?

OWASP Top 10
NIST SP 800-53
ISO 27001
MITRE ATT&CK for Cloud (Correct answer)

Correct answer: MITRE ATT&CK for Cloud

MITRE ATT&CK for Cloud maps specific adversary tactics and techniques observed against cloud platforms like AWS, Azure, and GCP to help defenders detect and respond.

Question 20: What is the primary goal of threat intelligence sharing communities such as ISACs?

Providing penetration testing services to members
Replacing national CERTs in incident response
Enabling sector-specific organizations to share threat data to improve collective defenses (Correct answer)
Selling vulnerability data to government agencies

Correct answer: Enabling sector-specific organizations to share threat data to improve collective defenses

Information Sharing and Analysis Centers (ISACs) allow organizations within the same industry sector to share threat intelligence, enabling faster collective response to emerging threats.

Question 21: An IRP (Incident Response Plan) defines a 'critical' incident as one affecting more than 30% of production systems. During an active ransomware event affecting 35% of systems, the IR team lead is unavailable. What should happen next?

Downgrade the incident classification to avoid escalation
The next person in the defined escalation chain assumes command (Correct answer)
Wait for the IR team lead to become available before escalating
The most senior technical person present makes all decisions independently

Correct answer: The next person in the defined escalation chain assumes command

A well-defined IRP includes an escalation chain so incident command transfers seamlessly when primary responders are unavailable.

Question 22: How does the NSE body of knowledge relate to daily professional practice?

It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is theoretical with limited application
It only applies during exams

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 23: What is the BEST strategy for resource allocation in Network Security Expert management?

Keep significant reserves without deployment
Focus resources only on largest tasks
Allocate all resources equally
Match resources to priorities based on needs, risks, and strategic goals (Correct answer)

Correct answer: Match resources to priorities based on needs, risks, and strategic goals

Effective resource allocation matches resources to priorities based on assessment of needs.

Question 24: What is the PRIMARY benefit of data-driven decision making in Network Security Expert?

It eliminates need for professional judgment
It guarantees positive results
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It simplifies decisions to one approach

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decisions provide objective evidence that reduces bias and enables outcome tracking.

Question 25: Which practice reduces the chance of exploitation?

Allowing user admin access
Regular patching and updates (Correct answer)
Delaying updates
Disabling firewalls

Correct answer: Regular patching and updates

Regular patching and updates are critical for reducing the chance of exploitation because they address known vulnerabilities in software and systems. Vendors release patches to fix security flaws as they are discovered, and applying these updates promptly closes potential entry points for attackers. This proactive approach significantly strengthens a system's security posture against known threats.

Question 26: Why are backups important in recovery?

They help restore lost or corrupted data (Correct answer)
They prevent phishing attacks.
They encrypt all data.
They increase system performance.

Correct answer: They help restore lost or corrupted data

Backups are essential for recovery in incident response because they provide copies of data that can be used to restore systems to a previous, uncompromised state. In the event of a data breach, ransomware attack, or system failure, backups minimize data loss and downtime. They are a critical component of any disaster recovery strategy.

Question 27: What vulnerability does a TLS downgrade attack such as POODLE exploit?

Fallback to older, weaker protocol versions like SSLv3 (Correct answer)
Certificate chain misconfiguration
HMAC collision in SHA-1
Weak RSA key generation

Correct answer: Fallback to older, weaker protocol versions like SSLv3

POODLE exploits servers and clients that fall back to SSLv3, which has a CBC padding oracle vulnerability allowing decryption of ciphertext.

Question 28: A penetration test reveals that a company's VPN allows split tunneling. What is the primary security concern?

Increased VPN connection latency
Corporate traffic bypasses security controls when routed through the internet (Correct answer)
Users may lose access to local printers
Certificate validation failures occur more frequently

Correct answer: Corporate traffic bypasses security controls when routed through the internet

With split tunneling, traffic destined for non-corporate sites bypasses the corporate firewall, potentially introducing threats into the environment.

Question 29: What is the primary purpose of a vulnerability scanner in an NSE environment?

Block active exploits in real time
Identify and report known weaknesses in systems and applications (Correct answer)
Decrypt encrypted malware payloads
Replace the need for penetration testing

Correct answer: Identify and report known weaknesses in systems and applications

Vulnerability scanners enumerate hosts and compare their configurations and software versions against known vulnerability databases to report weaknesses.

Question 30: Which protocol is used for sending email?

IMAP
SMTP (Correct answer)
POP3
HTTPS

Correct answer: SMTP

SMTP (Simple Mail Transfer Protocol) is the standard protocol used for sending and receiving email messages between mail servers. It handles the transfer of outgoing email from a client to a server, and between servers. While other protocols like POP3 and IMAP are used for retrieving email, SMTP is specifically for sending it across networks.

Question 31: Which architecture model isolates each application in its own container?

Virtual Machine Model
Container-based architecture (Correct answer)
Single-tier architecture
Client-server model

Correct answer: Container-based architecture

Container-based architecture, utilizing technologies like Docker, isolates each application and its dependencies within its own lightweight, portable container. This provides a consistent environment for applications, enhances security by isolating processes, and simplifies deployment and scaling. Unlike virtual machines, containers share the host OS kernel, making them more efficient.

Question 32: Which protocol provides network access control by authenticating devices before granting LAN or WLAN access?

RADIUS
Kerberos
TACACS+
802.1X (Correct answer)

Correct answer: 802.1X

IEEE 802.1X is a port-based NAC standard that requires authentication before a device can access the network.

Question 33: What is the security risk associated with allowing 'any-to-any' rules in a firewall policy?

It increases firewall CPU usage only
It disables NAT functionality
It eliminates all traffic restrictions, maximizing the attack surface across the network (Correct answer)
It forces traffic to be re-routed through a proxy

Correct answer: It eliminates all traffic restrictions, maximizing the attack surface across the network

Any-to-any rules permit all traffic between zones, effectively disabling the firewall's protective function and exposing all services to potential attack.

Question 34: Which WPA3 feature provides forward secrecy and replaces the PSK handshake?

CCMP (Counter Mode CBC-MAC Protocol)
WPS (Wi-Fi Protected Setup)
SAE (Simultaneous Authentication of Equals) (Correct answer)
TKIP (Temporal Key Integrity Protocol)

Correct answer: SAE (Simultaneous Authentication of Equals)

SAE replaces the WPA2 PSK handshake in WPA3, generating unique session keys per connection and providing forward secrecy so past sessions cannot be decrypted if keys are compromised.

Question 35: How should a NSE professional manager address underperformance?

Ignore it until formal reviews
Address publicly in team meetings
Immediately reassign the individual
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 36: Which statement BEST describes the relationship between Network Security Expert certification and industry evolution?

Changes only occur when government mandates them
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Certification requirements never change
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 37: What does a transparent (or bridged) firewall do differently from a routed firewall?

It decrypts all VPN tunnels automatically
It only filters broadcast traffic
It inspects traffic without changing IP addresses or requiring routing changes to the network (Correct answer)
It operates only on wireless networks

Correct answer: It inspects traffic without changing IP addresses or requiring routing changes to the network

A transparent firewall operates at Layer 2, inserting itself inline between segments without needing IP addresses on its interfaces or network topology changes.

Question 38: Which attack specifically targets the firewall's connection state table to exhaust its resources?

Phishing
Pass-the-hash attack
SYN flood attack (Correct answer)
SQL injection

Correct answer: SYN flood attack

A SYN flood sends large numbers of half-open TCP connection requests to fill the stateful firewall's connection table, causing denial of service.

Question 39: In a DMZ architecture, which statement BEST describes the purpose of placing a web server in the DMZ?

To grant the web server unrestricted access to the internal LAN
To expose the web server to the internet while shielding the internal network (Correct answer)
To eliminate the need for firewalls between zones
To allow the web server to bypass stateful inspection

Correct answer: To expose the web server to the internet while shielding the internal network

A DMZ isolates publicly accessible servers so that a compromise does not provide direct access to the trusted internal network.

Question 40: What is the PRIMARY purpose of obtaining NSE certification in Network Security Expert?

To bypass educational requirements
To guarantee employment
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 41: How should a NSE professional manager address underperformance?

Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Ignore it until formal reviews
Immediately reassign the individual
Address publicly in team meetings

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 42: What is the primary security advantage of using certificate pinning in mobile applications?

It enables perfect forward secrecy
It reduces TLS handshake latency
It encrypts all traffic with a stronger cipher
It prevents the app from trusting rogue CA-signed certificates (Correct answer)

Correct answer: It prevents the app from trusting rogue CA-signed certificates

Certificate pinning hardcodes the expected certificate or public key, so the app rejects connections even if a trusted CA issues a fraudulent cert.

Question 43: Which protocol is used by FortiGate to dynamically learn and enforce role-based access policies based on user identity from an Active Directory domain controller?

LDAP polling
FSSO (Fortinet Single Sign-On) (Correct answer)
SAML federation
Kerberos ticketing

Correct answer: FSSO (Fortinet Single Sign-On)

FSSO monitors domain controller login events and maps user-to-IP associations so FortiGate can apply identity-based security policies.

Question 44: A threat intelligence report indicates an APT group uses a specific registry key for persistence. During an IR engagement, which Windows command-line tool can quickly query all systems for this registry key's presence?

ipconfig /all
sfc /scannow
netstat -b
reg query HKLM\...\<key> executed via PsExec or a SIEM remote query (Correct answer)

Correct answer: reg query HKLM\...\<key> executed via PsExec or a SIEM remote query

Using 'reg query' remotely via PsExec or SIEM-orchestrated scripts allows rapid hunting for specific registry keys across the enterprise.

Question 45: During a network security assessment, an architect discovers that inter-VLAN traffic is routed through a Layer 3 switch without firewall inspection. What is the key risk?

Lateral movement between segments is uninspected (Correct answer)
Increased latency between VLANs
BGP routing instability
DHCP conflicts between VLANs

Correct answer: Lateral movement between segments is uninspected

Without firewall inspection on inter-VLAN traffic, an attacker who compromises one VLAN can move laterally to others undetected.

Question 46: How frequently should ongoing assessments be conducted in Network Security Expert practice?

Once annually regardless of circumstances
Only when required by external auditors
Only when problems are reported
At regular intervals and as conditions change (Correct answer)

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 47: What is the role of a Web Application Firewall (WAF) compared to a network perimeter firewall?

A WAF replaces the need for a perimeter firewall
A WAF operates exclusively at Layer 3
A WAF filters only DNS traffic
A WAF specifically inspects HTTP/HTTPS traffic to protect web applications from Layer 7 attacks (Correct answer)

Correct answer: A WAF specifically inspects HTTP/HTTPS traffic to protect web applications from Layer 7 attacks

A WAF operates at the application layer to detect and block web-specific attacks such as SQL injection, XSS, and CSRF targeting web applications.

Question 48: Which modern attack technique allows WPA2 PSK cracking without capturing a full 4-way handshake from a connected client?

DNS spoofing attack
ARP poisoning attack
PMKID attack (Correct answer)
Bluejacking attack

Correct answer: PMKID attack

The PMKID attack extracts the PMKID value directly from the AP's EAPOL frame, enabling offline PSK cracking without needing a connected client or capturing the full handshake.

Question 49: FortiGuard's threat intelligence service provides which type of data to FortiGate firewalls?

User behavior analytics baselines
SSL certificate revocation lists only
SIEM correlation rules
Malicious IP/domain reputation, IPS signatures, and antivirus updates (Correct answer)

Correct answer: Malicious IP/domain reputation, IPS signatures, and antivirus updates

FortiGuard delivers continuously updated threat intelligence including IP/domain reputation, IPS signatures, antivirus definitions, and web filtering categories to FortiGate devices.

Question 50: When analyzing a suspicious email attachment, an analyst submits it to a sandbox. The sandbox shows the sample sleeping for 5 minutes before executing. This behavior is an example of:

Living-off-the-land technique
Buffer overflow exploitation
Polymorphic code
Sandbox evasion through timing delay (Correct answer)

Correct answer: Sandbox evasion through timing delay

Malware uses timing delays to evade sandboxes, which often have short analysis windows and will report the sample as benign if no malicious behavior is observed quickly.

Question 51: Which technology is used to allow remote users to securely traverse a perimeter firewall and access internal resources?

VLAN trunking
VPN (Virtual Private Network) (Correct answer)
STP (Spanning Tree Protocol)
OSPF routing

Correct answer: VPN (Virtual Private Network)

VPNs create an encrypted tunnel through the perimeter firewall, allowing authenticated remote users to securely access internal network resources.

Question 52: Which wireless denial-of-service attack exploits unauthenticated 802.11 management frames to disconnect clients from their AP?

Deauthentication flood attack (Correct answer)
Fragmentation attack
KRACK attack
Karma attack

Correct answer: Deauthentication flood attack

A deauthentication flood attack sends spoofed, unauthenticated 802.11 deauth frames to clients or APs, continuously disconnecting users since management frames lack authentication in WPA2.

Question 53: What is the PRIMARY purpose of obtaining NSE certification in Network Security Expert?

To guarantee employment
To bypass educational requirements
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 54: In an enterprise wireless deployment, what is the primary role of a RADIUS server?

To manage wireless channel and power allocation
To provide DHCP addresses to wireless clients
To authenticate wireless users and authorize network access (Correct answer)
To encrypt wireless traffic using AES encryption

Correct answer: To authenticate wireless users and authorize network access

A RADIUS server centralizes Authentication, Authorization, and Accounting (AAA) for 802.1X wireless deployments, validating credentials and enforcing access policies.

Question 55: In NSE exam context, what does 'fail-open' mean for a perimeter security device?

The device requires manual restart after failure
The device blocks all traffic upon hardware failure
The device sends alerts but continues blocking
If the device fails, traffic continues to flow without inspection (Correct answer)

Correct answer: If the device fails, traffic continues to flow without inspection

A fail-open device allows traffic to pass unfiltered upon failure, prioritizing availability over security — the opposite of fail-closed.

Question 56: During a tabletop exercise simulating a data breach, participants realize the IR plan does not specify who is authorized to communicate with law enforcement. What is the PRIMARY risk of this gap?

Forensic evidence may be collected incorrectly
The recovery timeline will exceed the RTO
Unauthorized disclosures could compromise the investigation or violate legal obligations (Correct answer)
Employees may not be notified promptly

Correct answer: Unauthorized disclosures could compromise the investigation or violate legal obligations

Unauthorized or improper law enforcement communication can prejudice investigations, create legal liability, or result in premature disclosure of sensitive breach details.

Question 57: What is the primary advantage of a stateful firewall over a simple packet-filtering firewall?

It operates exclusively at Layer 2
It tracks the state of active connections to validate return traffic (Correct answer)
It requires no rule configuration
It decrypts all SSL/TLS traffic by default

Correct answer: It tracks the state of active connections to validate return traffic

Stateful firewalls maintain a connection table, allowing them to permit only legitimate return packets and block unsolicited inbound traffic.

Question 58: In firewall policy, what does the term 'rule shadowing' mean?

Duplicating rules for redundancy
Hiding rules from unauthorized administrators
Applying rules only during off-hours
A rule that can never be matched because a preceding rule already matches that traffic (Correct answer)

Correct answer: A rule that can never be matched because a preceding rule already matches that traffic

Rule shadowing occurs when a broader rule earlier in the policy matches all traffic intended for a more specific rule, making the specific rule unreachable.

Question 59: A security team discovers a publicly disclosed vulnerability with no vendor patch available. This is best described as a:

Known exploited vulnerability
Zero-day vulnerability (Correct answer)
Residual risk
Latent threat

Correct answer: Zero-day vulnerability

A zero-day is a vulnerability that is publicly known (or actively exploited) but has no official vendor patch available.

Question 60: Which recovery metric describes the maximum tolerable amount of data loss measured in time, and is a key input when designing backup strategies?

Recovery Time Objective (RTO)
Recovery Point Objective (RPO) (Correct answer)
Mean Time to Recovery (MTTR)
Mean Time Between Failures (MTBF)

Correct answer: Recovery Point Objective (RPO)

RPO defines the maximum acceptable data loss window, directly determining backup frequency requirements.

Fortinet NSE 4 - FortiGate Network Security Professional

This exam certifies the ability to configure, install, and monitor the FortiGate device to support specific network security policies.

Questions

120 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds