NSE4 Practice Test 1 — 10 Questions

Question 1

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The PBR rule's source address does not match the traffic correctly.. Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Answer

The default route has a lower administrative distance than the PBR rule.

Answer

PBR is not supported on FortiGate.

Answer

The PBR rule has a higher priority than the default route.

Question 2

A company uses deep SSL inspection to filter traffic. Users report that some HTTPS sites are not loading. The administrator checks the FortiGate and sees that the certificate for the sites is not trusted on the client machines. What is the most likely cause?

Accepted Answer

The FortiGate's CA certificate is not installed in the Trusted Root Certification Authorities store on the clients.. When deep SSL inspection is enabled, the FortiGate acts as a man-in-the-middle by decrypting HTTPS traffic using a local CA certificate. For clients to trust the decrypted connections, the FortiGate's CA certificate must be installed in the Trusted Root Certification Authorities store on each client machine. If it is missing, the browser will display a certificate trust error and may block the site, causing the reported loading failures.

Answer

The FortiGate is using a self-signed certificate for the SSL inspection policy.

Answer

The SSL inspection policy is set to 'no-inspection' for the affected sites.

Answer

The FortiGate's web filter profile is blocking the certificate.

Question 3

An administrator notices that traffic to a particular subnet is being load-balanced across two WAN links, but they want all traffic to that subnet to use a single link. Which feature should be configured?

Accepted Answer

Policy routing. Policy routing (also called PBR) allows you to override the routing table based on criteria such as source/destination IP, protocol, or port. By configuring a policy route that matches traffic to the specific subnet and sets the output interface to a single WAN link, you can force all that traffic to use one link instead of being load-balanced.

Answer

ECMP routing

Answer

Static route with higher distance

Answer

Route summarization

Question 4

An administrator wants to upgrade the FortiGate firmware from version 6.4.9 to 7.0.1. What is the most important consideration before proceeding?

Accepted Answer

Verify the upgrade path and check for any required intermediate versions. FortiGate firmware upgrades must follow a validated upgrade path to avoid configuration incompatibilities or boot failures. Version 6.4.9 to 7.0.1 requires an intermediate upgrade to 7.0.0 first, as direct jumps across major versions or skipping required intermediate releases can corrupt the firmware image or render the device unbootable. Fortinet publishes explicit upgrade paths in the release notes, and ignoring them is the most common cause of failed upgrades.

Answer

Upgrade to the latest 7.0.x directly without intermediate steps

Answer

Disable all firewall policies before upgrading

Answer

Ensure the configuration is backed up

Question 5

An administrator configures a FortiGate in transparent mode. Which of the following is correct regarding transparent mode operation?

Accepted Answer

The FortiGate is invisible to end devices and does not modify IP addresses.. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any IP-level modifications. This means it does not perform NAT, and end devices are unaware of its presence, making option D correct.

Answer

The FortiGate performs NAT between its interfaces.

Answer

The FortiGate interfaces can be on different subnets.

Answer

The FortiGate requires a management IP on each interface.

Question 6

An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?

Accepted Answer

The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN. The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.

Answer

The web filter profile has an incorrect action configured

Answer

The web filter is set to 'monitor all' which causes all requests to timeout

Answer

The FortiGuard web filtering license has expired

Question 7

During an IPsec VPN troubleshooting, you run 'diagnose vpn ike config' and see the output includes 'peer-id: any'. What does this mean?

Accepted Answer

The FortiGate will accept any peer identity during IKE authentication.. The 'peer-id: any' output in 'diagnose vpn ike config' indicates that the FortiGate is configured to accept any peer identity during IKE authentication. This means the FortiGate will not validate the identity presented by the remote peer (e.g., IP address, FQDN, or user ID) against a specific value in the Phase 1 configuration. This is common when using pre-shared keys and not requiring strict peer identity validation.

Answer

The FortiGate will accept connections from any remote IP address.

Answer

The FortiGate will use aggressive mode for IKE negotiation.

Answer

The Phase 2 selectors are configured for any protocol.

Question 8

A FortiGate administrator configures an email filter profile to block spam. Users report that some legitimate emails are being blocked. The administrator wants to reduce false positives while still blocking spam. What should the administrator do?

Accepted Answer

Increase the spam threshold score. Increasing the spam threshold score raises the bar for what is classified as spam, so only emails with a higher spam score (indicating stronger spam characteristics) are blocked. This reduces false positives because legitimate emails with lower scores will no longer be blocked, while still blocking high-scoring spam.

Answer

Disable the email filter profile

Answer

Decrease the spam threshold score

Answer

Enable the FortiGuard spam filter only

Question 9

An administrator is configuring a loopback interface on a FortiGate for management purposes. Which three statements are true about loopback interfaces? (Choose three.)

Accepted Answer

Multiple loopback interfaces can be created.. FortiGate allows the creation of multiple loopback interfaces (up to 16, depending on the model) for various purposes such as management, routing, or VPN termination. Each loopback interface is a virtual interface that does not depend on any physical port, providing flexibility in network design.

Answer

Loopback interfaces support VLAN tagging.

Answer

A loopback interface requires a physical port to be associated.

Question 10

What is the primary purpose of the captive portal feature on a FortiGate?

Accepted Answer

To provide a web-based authentication interface for users connecting through a firewall policy. The captive portal feature on a FortiGate provides a web-based authentication interface that intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a login page. Once the user successfully authenticates (e.g., via local database, LDAP, or RADIUS), the FortiGate dynamically creates a firewall authentication entry, allowing the user's traffic to pass according to the configured firewall policy. This is the primary purpose: to enforce user-based access control through a browser-based authentication mechanism.

Answer

To monitor bandwidth usage per user

Answer

To block all traffic from unknown IP addresses

Answer

To enable SSL VPN connections