NSE4 Practice Test 10 — 10 Questions

Question 1

An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP. When a firewall policy has NAT enabled (typically 'Enable NAT' or 'Use Outgoing Interface Address'), the FortiGate performs source NAT (SNAT) on the traffic, replacing the original client source IP with the IP of its egress interface (the internal interface in this scenario). This is standard behavior for source NAT, which hides the original client IP from the internal server, causing the server logs to show the FortiGate's internal interface IP instead of the actual client IP.

Answer

The VIP is configured with port forwarding and the server is expecting a different port

Answer

The VIP is using a different public IP than expected

Answer

The server's routing is misconfigured and traffic is returning via a different path

Question 2

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The debug command 'diagnose vpn ike log' shows: 'no suitable proposal found'. What is the most likely cause?

Accepted Answer

Phase 2 encryption or authentication algorithms do not match on both sides.. The 'no suitable proposal found' error in Phase 2 of an IPsec VPN tunnel indicates that the Phase 2 parameters (encryption algorithm, authentication algorithm, or PFS settings) do not match between the two FortiGate peers. Since Phase 1 is up, the IKE SA is established, meaning pre-shared keys, remote gateway reachability, and basic firewall policies for IKE traffic are correct. The mismatch specifically occurs in the Phase 2 proposal negotiation, where each side sends its supported transforms and the responder cannot find a common set.

Answer

The firewall policy allowing IPsec traffic is missing.

Answer

The remote gateway IP address is unreachable.

Answer

The pre-shared key is incorrect.

Question 3

A FortiGate is configured with FSSO using a DC agent. Users authenticate to the domain, but the firewall policy using FSSO groups is not matching traffic. The admin runs 'diagnose debug authd fsso list' and sees user entries. However, the traffic is being denied by the default deny policy. What is the most likely issue?

Accepted Answer

The session was established before the user logged in and is not updated with the user identity. When a user logs in after a session is already established, the FortiGate does not automatically update that session with the user's identity. The 'diagnose debug authd fsso list' shows the user is authenticated, but the existing session still lacks the FSSO group information, causing it to match the default deny policy instead of the FSSO-based policy.

Answer

The FSSO session timeout is too short

Answer

The firewall policy has the wrong schedule applied

Answer

The user is not a member of the correct FSSO group in Active Directory

Question 4

A network administrator configures an IPsec VPN between two FortiGate devices. Phase 1 completes successfully, but Phase 2 fails to establish. The administrator runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the MOST likely cause?

Accepted Answer

The Phase 2 local and remote subnets do not match on both ends. The error 'proposal mismatch' in the Phase 2 IKE log indicates that the IPsec security associations (SAs) proposed by one FortiGate do not match the configured Phase 2 parameters on the other. Since Phase 1 completed successfully, the IKE version and pre-shared key are already validated. The mismatch specifically refers to the local and remote subnet definitions, encryption algorithms, or authentication methods in the Phase 2 selectors. Therefore, the most likely cause is that the Phase 2 local and remote subnets are not correctly mirrored on both ends.

Answer

The IKE version is mismatched (IKEv1 vs IKEv2)

Answer

The pre-shared key is incorrect

Answer

The firewall policies are blocking IKE traffic on UDP port 500

Question 5

An admin wants to block all traffic from the internet to a specific internal server except for the IP address 203.0.113.50. Which firewall policy configuration achieves this using the principle of least privilege?

Accepted Answer

Create a deny policy from internet to server with any source, then an allow policy from source 203.0.113.50 to the server above it. It follows the principle of least privilege by explicitly denying all traffic from the internet to the internal server (with a deny policy using any source), then placing an explicit allow policy above it for source 203.0.113.50. In FortiGate firewall policy processing, policies are evaluated top-down, so the more specific allow rule for the trusted source is matched first, while the broader deny rule below it blocks all other internet traffic. This ensures only the permitted IP address can reach the server, and all other traffic is explicitly blocked.

Answer

Configure a VIP with restricted source

Answer

Use a local-in policy to block the server IP

Answer

Create a single allow policy from source 203.0.113.50 to the server and rely on implicit deny for all other traffic

Question 6

An administrator runs the following CLI command and sees the output: 'diagnose sys session list | grep -A 5 10.1.1.100' and finds a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session has been active for 3600 seconds. The 'duration' field in Fortinet session output indicates the actual time the session has been alive (session age), while 'expire' indicates the remaining time before timeout. Here, duration=3600 means the session has been active for 3600 seconds (1 hour). expire=3599 is just slightly less than the duration, but the key is that duration is the age. Therefore, option C is correct.

Answer

The session is about to expire

Answer

The session has been active for approximately 1 second

Answer

The session is using UDP protocol

Question 7

An administrator needs to allow outbound DNS traffic (UDP port 53) from multiple internal subnets to the internet. Which object type should be used to group the subnets into a single source in the firewall policy?

Accepted Answer

Address group. An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.

Answer

VIP group

Answer

Schedule group

Answer

Service group

Question 8

A FortiGate in flow-based mode is configured with an antivirus profile to block infected files. A user downloads a .zip file containing a known virus, but the download is allowed and the file is not quarantined. What is the MOST likely reason?

Accepted Answer

Flow-based inspection does not decompress archives by default. In flow-based inspection mode, FortiGate does not decompress archive files (such as .zip) by default. This means the antivirus engine cannot inspect the contents of the compressed file, so even if a known virus is inside, it will not be detected or blocked. To inspect archives in flow-based mode, you must enable 'deep archive inspection' in the antivirus profile.

Answer

The antivirus profile is not set to 'block' for virus outbreaks

Answer

The virus definition database is outdated

Answer

Flow-based inspection does not support antivirus for .zip archives

Question 9

An administrator runs 'diagnose ips anomaly list' and sees the following output:
List of anomaly events:
 ID: 1, Type: tcp_syn_flood, Status: triggered, Count: 1500, Threshold: 1000
What does this indicate?

Accepted Answer

The FortiGate is experiencing a TCP SYN flood attack and has triggered rate-based detection.. The output from 'diagnose ips anomaly list' shows a tcp_syn_flood anomaly with a count of 1500 exceeding the threshold of 1000, and the status is 'triggered'. This indicates that the FortiGate's IPS anomaly sensor has detected a rate-based anomaly — specifically, the number of TCP SYN packets received per second has surpassed the configured threshold, which is a classic sign of a TCP SYN flood attack. The FortiGate has triggered its rate-based detection mechanism, which can then take configured actions such as alerting or blocking, confirming option C as correct.

Answer

The IPS anomaly sensor is configured to block all TCP traffic.

Answer

The FortiGate has detected a single TCP SYN packet and is logging it.

Answer

The FortiGate is performing a TCP SYN flood attack.

Question 10

A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?

Accepted Answer

The traffic is in a different VDOM than the policy. In a multi-VDOM FortiGate, each VDOM operates as an independent virtual firewall with its own routing table, policies, and interfaces. A firewall policy created in the root VDOM only applies to traffic that enters and exits interfaces assigned to that root VDOM. If the traffic originates from or is destined to an interface belonging to a different VDOM, it will never match the root VDOM policy, causing the traffic to be dropped or handled by the correct VDOM's policies.

Answer

The internet-facing interface is not part of any VDOM

Answer

The subnet object is defined in the wrong address group

Answer

The policy is placed at the bottom of the list