NSE4 Exam Questions and Answers

The routing table on the client is missing the internal network routes.

This is the correct explanation. With split tunneling enabled, the FortiGate sends a list of internal subnets to the client, which must be installed into the client's routing table. If those routes are missing or incomplete, traffic destined for internal resources will be sent out the physical interface to the local gateway instead of into the SSL VPN tunnel, causing the connection to the FortiGate to succeed while internal resources remain unreachable. The user's report confirms the tunnel is up, so the next most logical place to look is the client-side routing table.

The Phase 2 selectors (local and remote subnets) are mismatched.

Phase 2 selectors define which traffic is encrypted; mismatched local and remote subnet pairs cause the quick mode negotiation to fail even when Phase 1 succeeds, leaving the tunnel down. Identical Phase 1 parameters rule out authentication or encryption mismatches.

Enable Dead Peer Detection (DPD) on the Phase 1 interface.

DPD (Dead Peer Detection) sends periodic IKE keepalives to the remote gateway to confirm liveness. If no response is received, DPD marks the peer dead, tears down the stale IPsec SA, and triggers a fresh Phase 1/Phase 2 negotiation. This recovers quickly from transient routing or peer failures, which is exactly what your intermittent VPN drops suggest. Without DPD, the SA persists until its natural lifetime expires, causing a long blackout and requiring manual restart.

The SSL VPN IP pool has run out of addresses.

When the SSL VPN IP pool is exhausted, the FortiGate cannot assign an IP address to the connecting client after successful authentication, so the tunnel cannot be completed. This often manifests as the client connecting and authenticating but then being unable to establish the tunnel or receive a virtual IP. In FortiOS, this condition can be verified with 'get vpn ssl monitor' or by checking the configured IP pool's usage.

Check the firewall policies allowing traffic through the tunnel.

In Fortinet's policy-based VPN model, firewall policies are the gatekeepers that decide which traffic is allowed to traverse the tunnel interface. Even with Phase 1 and Phase 2 both up, packets are dropped unless there is an explicit policy permitting traffic between the local and remote zones (e.g., from 'internal' to 'tunnel'). This is a frequent point of failure because the tunnel status itself is independent of the policy configuration.

Check the routing table for routes pointing to the remote networks.

The routing table determines whether a packet destined for the remote network is sent to the IPsec tunnel interface at all. Without a static or dynamic route that points the remote subnet to the tunnel, the FortiGate will forward the packet via the default route or drop it, bypassing the tunnel entirely. This is distinct from a firewall policy issue; even with perfect policies, missing routes prevent the tunnel from being used.

Ensure the SSL VPN IP pool has enough addresses for concurrent users.

In tunnel-mode SSL VPN, each remote user must be leased a unique virtual IPv4 address from the configured SSL VPN IP pool. If the pool is smaller than the peak number of concurrent authenticated users, the FortiGate cannot allocate an address for additional sessions, so those users will fail to establish the tunnel even though authentication succeeds. Sizing the pool to the maximum simultaneous connections (not just the total number of registered users) is therefore a hard prerequisite for scalability.

Create firewall policies that allow traffic from the SSL VPN interface to internal networks.

Assigning an IP address and completing TLS authentication only creates a secure tunnel endpoint; the FortiGate still evaluates traffic with its firewall rules. You must create policies whose incoming interface is the SSL VPN (ssl.root) virtual interface and whose outgoing interface is the destination internal network, specifying the allowed destination addresses and services. Without such a policy, the FortiGate silently drops the decrypted VPN traffic, so the tunnel appears established but users cannot reach any internal resources.

Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.

A correct fix is to set the SD-WAN rule to use the broadband link as a secondary strategy when the primary MPLS link fails its performance SLA. In Fortinet, this is done by listing multiple link members in the rule and specifying a strategy such as 'best quality' or 'SLA' where the next available member is used as a backup. The rule then automatically moves voice traffic to broadband whenever the MPLS link violates the configured latency threshold.

The performance SLA for jitter is not configured, only latency.

The 'best quality' strategy only fails over when the configured SLA performance criteria are breached. If the performance SLA monitors latency alone, high jitter never triggers a member failure, so traffic stays on the fiber link despite exceeding the jitter threshold.

Virtual cluster ID

The virtual cluster ID is a mandatory HA parameter that must be the same on both units to ensure they belong to the same cluster and can synchronize correctly. This ID is used in heartbeat negotiation and for VDOM partitioning to separate multiple clusters on the same Layer 2 segment. If the virtual cluster IDs differ, the units will not form an HA cluster, even if all other settings are identical.

Heartbeat interfaces must be on the same subnet.

For HA heartbeat to work, the heartbeat interfaces on both FortiGates must be in the same subnet, typically via a direct crossover connection or through a switch on the same VLAN. This is because heartbeat packets are sent as Ethernet frames (often multicast) and require Layer 2 adjacency; without a shared broadcast domain, the units cannot detect each other or exchange session-synchronization data. If the heartbeat interfaces are on different subnets, the HA cluster will never form.

Heartbeat traffic is not encrypted by default.

By default, FortiGate HA heartbeat traffic, including session synchronization and device configuration sync, is transmitted in clear text. This means any attacker able to sniff the heartbeat link can intercept sensitive session information, so Fortinet recommends enabling encryption in the HA settings via the 'set encryption enable' command and configuring a shared secret. Encrypting heartbeat traffic increases CPU overhead but is essential for security, especially when heartbeat links pass over untrusted infrastructure.

SD-WAN rules are evaluated in order of priority.

SD-WAN rules are evaluated in order of priority, meaning the rule with the lowest priority number (highest precedence) is inspected first and the first matching rule is applied exclusively. FortiGate processes rules top-down, and once a match is found, no subsequent SD-WAN rule is considered for that session, making priority sequencing critical for deterministic traffic steering.

SD-WAN rules can match based on application, destination, or source.

SD-WAN rules support extensive match criteria including application (identified by FortiGuard's application control database), destination address, and source address. Additionally, criteria such as internet service, users, and port numbers can also be combined to create highly granular policies that steer specific traffic flows across the appropriate underlay links.

If no SD-WAN rule matches, the traffic is processed by the implicit rule.

When no explicit SD-WAN rule matches a session's characteristics, FortiGate falls back to the built-in implicit rule, which is always present with the lowest priority. This implicit rule uses the globally configured load balancing algorithm to select an SD-WAN member, ensuring that traffic is never dropped due to a missing match, while still allowing explicit rules to override behavior for specific flows.

The LAG configuration on the new FortiGate does not match the active cluster configuration.

In an HA cluster, all interface and link aggregation group (LAG) settings—including member ports, negotiation mode, and hashing algorithm—must be identical across both units. If the replacement FortiGate's LAG configuration differs from the active cluster configuration, the cluster members cannot synchronize interface states, resulting in link instability, frequent flapping, and interrupted traffic. Traffic drops occur because the secondary's mismatched LAG is unable to pass traffic in the same manner as the primary, violating HA consistency requirements. This matches the symptom, making it the correct root cause.

config system admin; edit admin; set trusthost 192.168.1.0 255.255.255.0; end

The 'trusthost' command under 'config system admin' defines an allowed source IP or subnet for administrative logins to that specific admin account. By setting '192.168.1.0 255.255.255.0', only clients originating from the 192.168.1.0/24 network can authenticate as 'admin' — all other source IPs are rejected at the management daemon level, regardless of credentials. This is the only provided option that actually restricts administrative access to a specific source address range.

A process such as the IPS engine is stuck in an infinite loop.

A stuck process like the IPS engine can enter an infinite loop or deadlock in user space, consuming an entire CPU core even when no traffic is passing through the device. This is a well-known software defect scenario; the process runs continuously, executing instructions without yielding, causing high CPU while traffic counters remain low. Administrators can confirm this with `diag sys top` to identify the process ID, then restart the engine or the FortiGate, and also check for crash logs to identify the underlying bug.

execute backup config tftp mybackup.conf 10.0.0.10

This is the correct FortiGate CLI command for backing up the configuration to a TFTP server. The command 'execute backup config' specifies the backup operation, 'tftp' selects the protocol, 'mybackup.conf' is the destination filename on the server, and '10.0.0.10' is the server IP. On FortiGate, this initiates a TFTP put from the unit, and it is the exact syntax required to meet the administrator's need.

Execute 'config system interface' and edit wan1, then set allowaccess ping https ssh snmp.

The FortiGate CLI command 'config system interface' followed by 'edit wan1' and 'set allowaccess ping https ssh snmp' explicitly appends snmp to the interface's list of permitted management access services. This is the mandatory per-interface gate: even after defining an SNMP community globally, the FortiGate will only respond to SNMP requests on interfaces whose allowaccess includes snmp. Adding snmp to wan1 therefore enables SNMP agents to serve queries and traps on that interface while preserving existing ping, https, and ssh management access.

Verify the interface status and link state.

Verifying the physical and logical interface state is the first step in any FortiGate connectivity troubleshooting. If the interface is administratively down or the link has no carrier (e.g., bad cable, remote device powered off), all traffic through that interface is dropped regardless of routes or policies. Use `get system interface physical` and `diagnose hardware deviceinfo nic` to confirm link status, speed, and duplex.

Check the ARP table to ensure the next-hop MAC is resolved.

For a FortiGate to forward a packet to a next-hop router, it must first resolve that router's IP address to a MAC address in its ARP cache. If the ARP entry is incomplete or missing—due to a misconfigured gateway, L2 isolation, VDOM issues, or an unresponsive peer—the FortiGate cannot construct the Layer 2 frame and silently drops the packet. Verify with `get system arp` or `diagnose ip arp list` to ensure the next-hop MAC is present and correct.

Examine the routing table for the destination network.

The FortiGate must have an active route in its routing table that matches the destination network to determine the outgoing interface and next-hop IP. If no such route exists—whether static, connected, or learned via dynamic routing—the FortiGate drops the traffic and often sends an ICMP destination unreachable message to the source. Use `get router info routing-table all` or `get route` to confirm a valid path; without a route, no policy can ever match the traffic because the route lookup happens first.

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.

An SD-WAN rule configured with an application match for the SaaS traffic and a preferred member set to the faster link is the correct approach because SD-WAN rules can steer traffic based on Layer 7 application signatures and dynamic link performance metrics. The preferred member acts as a tie-breaker, forcing the traffic to use the specified interface as long as it meets the SD-WAN health-check SLA (latency, jitter, packet loss), while still allowing automatic failover to the backup link if the preferred link degrades. This preserves redundancy and ensures the SaaS application consistently uses the best-performing path.

The LDAP server bind DN or password is incorrect

The bind DN (distinguished name) and password constitute the FortiGate's service account credentials for connecting to the LDAP directory. If either is incorrect, the LDAP server rejects the bind operation with an 'invalid credentials' error (LDAP result code 49). This prevents the FortiGate from performing any directory queries, so the authentication process fails immediately at the initial bind stage, which is exactly what the user would see as an authentication failure.

Policy: source internal, destination external, service SMTP, enable NAT

Enable NAT on the policy so the FortiGate performs source NAT (hide/PAT), translating the internal source IP (e.g., 10.0.0.10) to the interface's public IP address. This makes the SMTP connection appear to originate from a routable public address, and the stateful session table ensures replies from the external mail server are returned to the correct internal host. Without this translation, the outbound SYN would carry a private source address that ISPs drop.

The user's IP address is not in the source address range of the policy

FSSO authenticates the user and populates the group, but the firewall policy still matches on source address; if the workstation's IP falls outside that range, the policy never applies and traffic is denied. This satisfies the stem's symptom of successful login events yet blocked access.

Create a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface, then an allow policy for all other traffic

FortiGate firewall policies are evaluated top-down, and the first match is applied. Placing a deny policy that matches source 10.0.0.99, destination 'all', on the WAN interface above a permissive allow policy ensures the host's internet traffic is blocked while all other traffic falls through to the allow rule. This is correct because the deny rule's specificity combined with its higher position makes it effective, and the allow policy remains broad for remaining sources.

Authentication can be configured on a per-policy basis

Authentication settings are integrated directly into firewall policy configuration, allowing each individual policy to independently require user authentication. This per-policy toggle gives administrators flexibility to apply authentication only to specific source/destination pairs or services, while leaving other policies unauthenticated. It is accurate to state that authentication can be configured on a per-policy basis.

Authentication can be based on local, LDAP, or RADIUS databases

FortiGate supports multiple back-end authentication sources, including local accounts defined on the FortiGate itself, LDAP servers such as Active Directory, and RADIUS servers. When setting up policy authentication, an administrator selects which of these server types to use, and FortiGate validates user credentials against that defined database. This makes the statement about local, LDAP, or RADIUS databases correct.

The FortiGate must be able to communicate with the domain controller

FSSO relies on the FortiGate or Collector Agent receiving user login events from the domain controller. Without network connectivity to the DC, the FortiGate cannot learn which user logged in or which groups that user belongs to, so the policy cannot match the user. This communication is typically via LDAP or a proprietary FSSO polling/eventing protocol, and any firewall rule blocking it will break FSSO.

The user must be a member of a group that is referenced in the firewall policy

The FSSO policy references a specific AD group, and the user's membership in that group is what authorizes traffic. When the DC reports a login event, it includes the user's group memberships, and FortiOS compares those to the group configured in the policy. If the user is not a member of any referenced group, no FSSO policy matches, and the traffic is dropped or evaluated against other policies.

The FSSO collector agent must be running and properly configured

The Collector Agent is the component that listens to domain controller security logs or polls for logon events and then pushes the IP-to-user mapping to the FortiGate. If it is not running or misconfigured, the FortiGate receives no login information, so user-based policies cannot be enforced. The agent must have the correct domain credentials and be able to reach both the DC and the FortiGate.

Web Filtering

Web Filtering on FortiGate leverages the FortiGuard web filtering database to classify URLs into categories (e.g., social media, malware, phishing) and enforce per-policy allow, block, or warn actions based on those categories or a custom URL list. This directly controls which websites users can access, making it the correct feature for blocking specific sites. It can also be combined with local overrides and wildcard FQDN entries to fine-tune granular access control.

The web server uses a cipher that the FortiGate cannot re-encrypt.

When a FortiGate performs deep inspection, it terminates the client's TLS connection and then initiates a second TLS connection to the web server to re-encrypt traffic. If the web server negotiates a cipher suite, key exchange method, or TLS version that the FortiGate's SSL engine does not support or is not configured to allow, the outbound handshake fails. This manifests as a 'Cannot communicate securely' or certificate-related error for that specific server, while other sites that use supported ciphers continue to work. The administrator should review the SSL inspection profile's cipher list and ensure it aligns with the server's capabilities.

Full SSL Inspection (Deep Inspection)

Full SSL inspection (also called deep inspection) terminates the SSL/TLS connection, decrypts the traffic, applies the full security feature set (IPS, antivirus, web filtering, application control) to the plaintext, and then re-encrypts it for the destination. This gives complete visibility and control over encrypted sessions. It requires installing the FortiGate CA certificate on managed endpoints so the client trusts the re-encrypted connection.

The CA certificate is not added to the browser's trusted root store.

When SSL inspection is enabled on the FortiGate, it terminates the client's TLS connection and re-signs a new certificate for the requested website using its own local Certificate Authority. The browser will only trust this dynamically generated certificate if the FortiGate's CA certificate has been installed in the client's trusted root certificate store. If that CA is missing or untrusted, the browser warns that the certificate was not issued by a trusted authority, which is exactly the warning the user sees — this is the correct cause of the issue.

A firewall policy that has SSL inspection enabled.

The correct prerequisite is that the firewall policy permitting the HTTPS traffic must have SSL inspection enabled, meaning an SSL/SSH inspection profile is applied to that policy. This profile instructs the FortiGate to decrypt the traffic, apply security controls, and re-encrypt it, which is the essence of deep inspection. Without this profile attached, the policy merely forwards the encrypted traffic without any visibility.

The website is new and not yet categorized by FortiGuard.

FortiGuard classifies websites by continuously crawling and categorizing the public internet, but a brand-new domain or newly launched website may not yet have an entry in the FortiGuard rating database. When FortiGate receives a request for such a site, it returns a rating of 'Unrated', and the security policy's handling of the Unrated category determines whether the URL is allowed or blocked. Since no category has been assigned, the site is blocked not because it is malicious or inappropriate, but simply because it has not yet been reviewed — this is the well-known false-positive scenario for newly registered domains.