NSE4 Practice Test 10 — 10 Questions

Question 1

An admin wants to block all traffic from a specific geographic region. Which address object type should be used in the firewall policy source?

Accepted Answer

Geography. FortiGate firewalls include a built-in Geography address object type that allows policies to match traffic based on the source or destination IP address's registered country or region. This object uses GeoIP databases to classify IP addresses, enabling administrators to block or allow traffic from entire geographic areas without needing to manually list individual subnets or ranges.

Answer

FQDN

Answer

Subnet

Answer

IP range

Question 2

An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?

Accepted Answer

Data Leak Prevention (DLP) with a credit card number sensor. Data Leak Prevention (DLP) with a credit card number sensor is the most appropriate feature because it uses pattern matching (e.g., Luhn algorithm) to detect and block sensitive credit card numbers in HTTP POST requests, preventing data exfiltration via web forms. Unlike other security profiles, DLP is specifically designed to inspect content for sensitive data patterns and enforce policy actions such as blocking or logging.

Answer

Antivirus with FortiSandbox integration

Answer

Web Filter to block all upload sites

Answer

Application Control to block web forms

Question 3

Match each Fortinet security feature to its primary function.

Accepted Answer

Antivirus: Scans files and traffic for known malware signatures.. The correct matches are: Antivirus scans for malware, IPS detects network attacks, Application Control identifies applications, Web Filtering blocks websites. Common confusions include mixing antivirus with anti-spam and IPS with antivirus.

Answer

Antivirus: Filters unwanted email messages.

Answer

IPS: Scans files for malware.

Question 4

Which statement best describes the implicit deny policy at the end of a FortiGate policy list?

Accepted Answer

It is always present and denies any traffic that does not match an explicit allow policy. The implicit deny policy is a built-in, last-resort rule at the bottom of the FortiGate policy list that silently drops any traffic not matching an explicit allow policy. It cannot be moved, disabled, or deleted because it is a fundamental security mechanism ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It denies all traffic that does not match any explicit policy, and it logs the denied traffic

Answer

It can be moved to a different position in the policy list

Answer

It can be disabled or deleted by the admin

Question 5

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. When both FortiGuard category blocking and a URL filter are configured in the same web filter profile, the FortiGuard category action (e.g., 'block') is evaluated first and takes precedence over any URL filter allow rule. This is because FortiGate processes web filter rules in a specific order: FortiGuard category blocking is applied before URL filter entries. Therefore, even if a URL filter explicitly allows example.com, the FortiGuard category block will prevent access.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated

Question 6

A network administrator creates a firewall policy allowing HTTP traffic from the internal network to a web server in the DMZ. Users report that they cannot access the web server. The administrator runs 'diagnose firewall iprope list' and sees the policy is present. What is the MOST likely cause of the issue?

Accepted Answer

A deny policy with a lower policy ID is matching the traffic before the allow policy. The 'diagnose firewall iprope list' command confirms the allow policy exists in the FortiGate's kernel policy list, meaning it is present and enabled. However, FortiGate evaluates policies in sequential order based on policy ID (lowest first), so a deny policy with a lower ID that matches the same traffic (e.g., from internal to DMZ) will be hit first, blocking the HTTP request before the allow policy can be evaluated. This is the most likely cause because the policy is present but not being matched due to ordering.

Answer

The firewall policy has an incorrect source interface

Answer

The policy is disabled

Answer

The web server is not responding to HTTP requests

Question 7

A FortiGate administrator is configuring ZTNA to secure access to an internal application. The administrator creates a ZTNA access proxy and a ZTNA rule. However, users connecting from the internet receive a 403 Forbidden error. The administrator verifies that the users are authenticated and the application is reachable. What is the MOST likely cause?

Accepted Answer

The ZTNA rule requires a specific client posture tag that the users' devices do not have. The 403 Forbidden error in ZTNA typically indicates that the client device does not meet the required security posture. Even though users are authenticated and the application is reachable, the ZTNA rule enforces a specific client posture tag (e.g., antivirus enabled, OS patch level) via FortiClient telemetry. If the device lacks the required tag, FortiGate denies access with a 403, as the ZTNA access proxy validates both identity and device compliance before proxying traffic.

Answer

The firewall policy allowing traffic to the application is placed after a deny-all policy

Answer

The application's IP address is not included in the ZTNA access proxy's destination

Answer

The ZTNA access proxy does not have a valid SSL certificate

Question 8

An admin is configuring a policy-based NAT (central SNAT) to translate internal users to a pool of public IPs using overload. The admin wants to ensure that specific applications using non-standard ports are not affected by NAT. Which THREE steps should the admin consider?

Accepted Answer

Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'. Adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation, ensuring that applications using non-standard ports are not affected by the overload behavior. Option B is correct because configuring a separate IP pool dedicated to those applications allows you to control the NAT behavior independently, such as using a pool without PAT or with a fixed port range, thereby avoiding port remapping issues. Option C is correct because using a fixed port range in the IP pool confines source port allocation to a specified range, accommodating applications that expect particular ports. Option D is incorrect because a VIP is for destination NAT, not source NAT, and does not address source port modification. Option E is incorrect because enabling NAT on the policy would translate all traffic, not protect specific applications.

Answer

Use central SNAT with a VIP for source NAT

Answer

Enable 'set nat enable' on the policy

Question 9

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 10

A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?

Accepted Answer

A security profile applied to the policy is blocking the HTTPS traffic.. Security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.

Answer

NAT is disabled, so the server cannot send replies back.

Answer

The policy order is incorrect; a deny policy above is blocking traffic.

Answer

The schedule is configured incorrectly and the policy is inactive during the current time.