Fortinet · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
20% of exam · 6 sample questions below
Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)
Use the GUI under System > Firmware.
Correct. The FortiGate GUI under System > Firmware is a valid method to upgrade firmware.
Use the command 'execute upgrade image tftp <ip> <filename>'.
Use the command 'execute backup config tftp'.
Use the command 'execute reboot'.
Use the command 'execute restore config tftp'.
A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?
Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.
An SD-WAN rule configured with an application match for the SaaS traffic and a preferred member set to the faster link is the correct approach because SD-WAN rules can steer traffic based on Layer 7 application signatures and dynamic link performance metrics. The preferred member acts as a tie-breaker, forcing the traffic to use the specified interface as long as it meets the SD-WAN health-check SLA (latency, jitter, packet loss), while still allowing automatic failover to the backup link if the preferred link degrades. This preserves redundancy and ensures the SaaS application consistently uses the best-performing path.
Remove the slower link from the SD-WAN interface.
Increase the bandwidth on the slower link.
Configure policy-based routing for the SaaS application.
A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?
Enable session synchronization between cluster members
Session sync shares session state between primary and secondary, maintaining sessions during failover.
Disable NAT inspection on the firewall policy
Configure gratuitous ARP on the virtual IP
Increase the heartbeat interval to 2 seconds
A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?
The default route is incorrectly configured
An implicit deny policy is blocking traffic from internal to external
No NAT policy is configured for internal users
If no NAT policy is configured for internal users' traffic, the FortiGate forwards packets with the original private source IP addresses (e.g., 10.0.0.0/8). The external server sends reply packets to that private address, which is not routable across the public internet, causing return traffic to be dropped or blackholed. The FortiGate's own ping works because it uses its interface's public IP as the source, so replies are routable. This mismatch—successful ping from the FortiGate but failures for internal users—is a classic symptom of missing source NAT.
External access profile is set to read-only
A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following: - Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53). - Outbound NAT (IP Pool) for internal users to 203.0.113.1. - Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services).
Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?
The firewall policy from internal to DMZ is blocking traffic
Hairpin NAT is not enabled on the FortiGate
The port forwarding rule maps the public IP to the DMZ server, not the internal server
The port forwarding rule, implemented as a Virtual IP (VIP), maps the public IP and port to 10.0.0.10, which is the DMZ server. When internal users attempt to access the internal server via the public IP, the FortiGate uses this VIP and translates the destination to the DMZ server's IP address. Consequently, the traffic never reaches the intended internal server, and the internal users cannot establish a connection to it. To resolve this, the VIP's mapped IP must be changed to the internal server's address, or a separate VIP must be created for the internal server.
The IP Pool for outbound NAT is misconfigured
An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?
Aggregate interface
Aggregate interfaces (LAG) provide increased bandwidth and redundancy.
Loopback interface
VLAN interface
Software switch interface
Want more System and Network Administration practice?
Practice this domain20% of exam · 6 sample questions below
A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?
The user is not a member of the FSSO group
The FSSO collector agent is not running
The user's IP address is not in the source address range of the policy
FSSO authenticates the user, but the policy's source address must match the user's IP.
The FortiGate is not polling the domain controller
A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?
NAT is disabled, so the server cannot send replies back.
The policy order is incorrect; a deny policy above is blocking traffic.
A security profile applied to the policy is blocking the HTTPS traffic.
A security profile (e.g., SSL inspection or application control) applied to the firewall policy can intercept HTTPS sessions and enforce actions like blocking based on certificate validation failure, URL category, or application signature. If the server presents an untrusted or expired certificate, the SSL inspection profile may block the HTTPS handshake while allowing other traffic, which matches the symptom of only HTTPS being affected.
The schedule is configured incorrectly and the policy is inactive during the current time.
A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?
The SD-WAN zone does not include the backup interface wan2.
The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.
With the SD-WAN strategy set to Manual, FortiGate uses the configured static routes and does not automatically re-evaluate link health to move traffic away from a failed interface. Automatic failover requires either an automatic strategy such as Lowest Cost or Best Quality combined with a performance SLA, or explicit link health monitoring to trigger a route update when wan1 goes down. Since neither is configured, the manual strategy explains why failover does not occur; this is the correct resolution.
The static routes have the same distance, so failover does not occur.
The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.
A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?
The security profile group
The default route
The last explicit deny policy in the policy list
The implicit deny rule
The implicit deny rule is a built-in, invisible final policy on every FortiGate firewall; any session that does not match an explicit allow or explicit deny policy is automatically dropped and logged. This rule cannot be deleted or disabled, ensuring that the firewall always enforces a default-deny posture for all unpermitted traffic. It is the true answer to the question because it is automatically applied, requiring no configuration, and it closes the gap that would otherwise allow traffic to pass unchecked.
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
The TCP handshake is incomplete; the SYN-ACK has not been received
State 01 is SYN_SENT, meaning the SYN has been sent but no SYN-ACK received yet.
The session is a UDP session
The session has been idle for 3600 seconds
The session is fully established and will expire in 3599 seconds
An admin is configuring a policy-based NAT rule (central NAT) to translate internal users' source IPs to the external IP of the FortiGate interface. However, users complain that some applications fail. The admin notices that the NAT rule is using 'dynamic IP pool' with overload. What is the MOST likely cause of the application failures?
The IP pool is exhausted and no more translations are available
The route to the destination is missing
The applications are sensitive to NAT and require a fixed port range
Several application-layer protocols, including SIP and FTP, embed IP addresses and TCP/UDP port numbers inside the payload. When overload NAT (PAT) dynamically assigns a different source port for each translation, the embedded port may no longer match the actual translated port, causing the peer to reject the session. A policy-based central NAT rule can be configured with a fixed port range or static port mapping, ensuring that the translated source port always matches what the application advertises. This is why application sensitivity is the correct reason for setting up such a NAT rule.
The firewall policy does not have NAT enabled
Want more Firewall Policies and NAT practice?
Practice this domain20% of exam · 6 sample questions below
An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?
The Phase 2 selectors (local and remote subnets) are mismatched.
Phase 2 requires matching proxy IDs.
The pre-shared keys do not match.
The firewall policies are not configured.
NAT traversal is disabled but both FortiGates are behind NAT.
Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
The 'set net-device disable' prevents the tunnel from being used for routing.
The phase2 configuration does not specify the local and remote subnets to protect.
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
The phase2 proposal does not match the phase1 proposal.
A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?
Phase 2 encryption or authentication algorithms do not match on both sides.
Phase 2 (Quick Mode) negotiates the IPsec SA parameters, including the encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-1, SHA-256) for the ESP/AH protocol. If the local and remote firewalls do not offer a common proposal for these algorithms and the Diffie-Hellman group, the Phase 2 negotiation will fail with an error such as 'no proposal chosen.' Since Phase 1 has already formed a secure IKE SA, the problem isolates specifically to a Phase 2 proposal mismatch, preventing the tunnel from establishing even though both gateways are reachable and authenticated.
The firewall policy allowing IPsec traffic is missing.
The remote gateway IP address is unreachable.
The pre-shared key is incorrect.
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
The session is fully established and has been active for 3600 seconds.
The session is in SYN_SENT state and might be stuck due to no response from the server.
State 01 explicitly maps to TCP SYN_SENT, which means the firewall sent a SYN packet and is waiting for a SYN-ACK from the destination server. A duration of 3600 seconds with no state transition indicates the server has not responded, so the session is likely stuck in the initiation phase and will eventually time out unless the missing SYN-ACK appears.
The session has been idle for 3599 seconds and will expire soon.
The session is in FIN_WAIT state and is being closed.
A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?
The users are not members of the FSSO group.
The firewall policy uses 'All Users' instead of a specific group.
The FSSO collector agent service is not running.
The FSSO collector agent is the critical component that gathers logon events from Active Directory (either through NetAPI polling or by reading Windows security event logs) and forwards them to the FortiGate. If the collector agent service is stopped or not running, the FortiGate has no source of domain user logon information, so it treats all traffic as unauthenticated and triggers local firewall authentication prompts. This is the most direct cause of the symptom described, because the entire FSSO identity pipeline is broken.
The FortiGate's LDAP server is unreachable.
An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?
The firewall policy for the VPN traffic is missing.
The Phase 2 proposals do not match between the FortiGate and the client.
In IKEv2, the CREATE_CHILD_SA exchange negotiates the IPsec SA parameters, including encryption, integrity, and DH group. If the FortiGate's configured Phase 2 proposal set does not include at least one transform that exactly matches what the client proposes, the negotiation fails and no Phase 2 SA is established. The Phase 1 IKE SA may still be up, but the tunnel remains down because the two peers cannot agree on a common traffic protection algorithm suite. This is the most direct cause of a failed Phase 2 while Phase 1 is successful.
The pre-shared key for Phase 2 is incorrect.
The remote user's client does not support IKEv2.
Want more Authentication and VPN practice?
Practice this domainAn administrator wants to inspect SSL traffic to a specific finance application that uses a custom port (9443) and a self-signed certificate. Which configuration is required?
Configure certificate inspection on the policy.
Disable SSL inspection for that application.
Use deep inspection and add the application's self-signed certificate to the FortiGate's trusted CA list.
Deep inspection decrypts and re-encrypts; trusted CA list allows self-signed certs.
Use flow-based inspection with certificate inspection.
Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)
Static URL filtering
Application control
FortiGuard category-based filtering
Blocks categories like 'Malicious'.
Web rating override
Allows overriding categories to block malicious sites.
DNS filter
A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?
Disable SSL inspection entirely to avoid certificate issues.
The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.
Use certificate inspection instead of deep inspection for all traffic.
Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.
Banking platforms frequently implement certificate pinning by hard-coding the expected public key or certificate fingerprint in the client or browser. When FortiGate performs deep inspection, it replaces the original server certificate with its own re-signed copy, causing the pin validation to fail and the connection to be blocked. The recommended fix is to add these banking domains to the SSL exemption list so the FortiGate passes the original certificate untouched, preserving deep inspection for all other domains.
A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?
Set the signature action to 'pass' and use an application control profile to bypass the server.
Disable the signature in the IPS sensor configuration.
Add the server's IP to the exempt list in the IPS sensor.
Create an IPS filter that excludes the server's source IP address from the signature.
An IPS filter allows you to create a conditional override for a specific signature based on attributes such as the source IP address. In Fortinet, you can set the signature's action to 'pass' or 'monitor' only when the source IP matches the trusted server, leaving the default (typically 'block') intact for all other sources. This gives exactly the required selectivity: the false positive is silently allowed, while the signature remains fully active for the rest of the network.
An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?
The IPS sensor is blocking the login page due to a false positive.
The firewall policy action is set to 'deny' but the exhibit shows 'accept'.
The HTTPS service is not correctly defined and blocking the traffic.
The application control profile is blocking the web application.
The application control profile is the only profile configured in the policy that can identify and block specific web applications by their signatures, even when the underlying HTTP/HTTPS service is valid. When a user attempts to access the login page, the FortiGate can classify the traffic as a known application and apply the profile's 'block' action, denying the request. This is a common cause of access failure when the base policy action is accept and HTTPS is correctly defined.
Which THREE of the following are valid methods to exclude certain HTTPS traffic from SSL inspection on a FortiGate?
Adding the domain to the 'SSL Exempt Domains' list in the SSL/SSH inspection profile.
Domain-based exemption is a supported method.
Setting the firewall policy action to 'accept' with no inspection.
Using a certificate category exemption (e.g., exempting 'Fortinet Trusted Certificate').
Certificate category exemption is a supported method.
Using a web filter category exemption.
Adding the destination IP address to the 'SSL Exempt IPs' list in the SSL/SSH inspection profile.
IP-based exemption is a supported method.
Want more Security Profiles practice?
Practice this domain20% of exam · 6 sample questions below
A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?
The performance SLA for jitter is not configured, only latency.
Correct; only configured SLA targets are measured for failover.
The SD-WAN rule has SLA match set to 'either' instead of 'all'.
The LTE link has a higher cost and is not considered for failover.
The fiber link has a higher interface weight.
An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?
Set the strategy to 'volume' and configure MPLS as preferred.
Set the manual strategy with MPLS as first member and enable SLA check.
Correct; manual strategy with SLA check will use the first member if SLA is met, otherwise the next.
Use 'load balancing' strategy and assign MPLS a higher weight.
Set the strategy to 'best quality' and set MPLS with highest priority.
An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?
The session has 3599 packets
The session has been alive for 3599 seconds
The session has 3599 bytes of data transferred
The session will timeout in 3599 seconds
Expire shows remaining time before the session is removed due to inactivity.
An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)
Using a data interface as the heartbeat interface
Data interfaces may have fluctuating link status, triggering failover.
An unstable network link for the heartbeat
Frequent link flaps cause repeated failovers.
Different firmware versions on cluster members
Mismatched HA passwords between cluster members
Mismatched HA priority values
A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)
Assign an IP address to the management interface
The IP must be configured on the interface for management access.
Enable 'set ha-mgmt-interface' on the management interface
Set the management interface to be part of the HA cluster management IP
Ensure the management interface is not configured as a heartbeat interface
If the management interface is also a heartbeat interface, it may be affected by HA failover.
Configure a dedicated management interface (e.g., port3)
A dedicated interface for management ensures it is not used for HA heartbeat or traffic.
An administrator runs 'diagnose debug flow' for a specific policy and sees the following output: id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet' What does this indicate?
The packet is being blocked by a firewall policy
The source interface is down
The destination IP address has no matching route in the routing table
The message clearly states no matching interface to route the packet.
The session table is full
Want more High Availability and Diagnostics practice?
Practice this domainThe NSE4 exam has 60 questions and must be completed in 105 minutes. The passing score is 650/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: System and Network Administration, Firewall Policies and NAT, Authentication and VPN, Security Profiles, High Availability and Diagnostics. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Fortinet NSE4 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.