NSE4 Practice Test 3 — 10 Questions

Question 1

A large enterprise is deploying a FortiGate 600F as the perimeter firewall. The security team requires that all administrative access (SSH, HTTPS, and Ping) to the FortiGate must be restricted to a dedicated management network (10.10.10.0/24). Additionally, any failed login attempt from outside the management network should be logged and the source IP should be blocked for 30 minutes. The administrator has configured a local-in policy to deny all administrative access from non-management networks and enabled logging. However, the administrator wants to automatically block the offending IPs. The FortiGate is not connected to any FortiAnalyzer or FortiManager. What should the administrator do to achieve this?

Accepted Answer

Create an automation stitch that triggers on local-in policy logging and adds the source IP to a blocked list via CLI script.. Option A is correct because an automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

Answer

Use a FortiAnalyzer to generate alerts and send to SIEM.

Answer

Configure a firewall policy to block the offending IPs manually based on logs.

Answer

Enable 'set block-session-ttl' on the local-in policy.

Question 2

Which TWO actions can cause SSL inspection to fail with certificate errors on client browsers? (Choose two.)

Accepted Answer

The FortiGate's CA certificate has expired.. Option A is correct because the FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Answer

The firewall policy allows the traffic.

Answer

The web server's certificate is signed by a public CA.

Answer

The client browser has the FortiGate CA certificate installed.

Question 3

An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?

Accepted Answer

The application control profile is blocking the web application.. The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Answer

The IPS sensor is blocking the login page due to a false positive.

Answer

The firewall policy action is set to 'deny' but the exhibit shows 'accept'.

Answer

The HTTPS service is not correctly defined and blocking the traffic.

Question 4

Which TWO statements about IPS in FortiGate are true?

Accepted Answer

IPS can be applied to individual firewall policies via IPS sensors.. Option A is correct because IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

Answer

An IPS sensor can only be applied to one firewall policy.

Answer

IPS is not supported in transparent mode.

Answer

IPS only works in flow-based inspection mode.

Question 5

Which THREE factors should be considered when tuning IPS to reduce false positives?

Accepted Answer

Excluding trusted source IP addresses from certain signatures.. Option A is correct because excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

Answer

Enabling hardware acceleration for IPS processing.

Answer

Increasing the sensitivity of signatures to catch more attacks.

Question 6

Which command is used to display the current FortiGate firmware version?

Accepted Answer

get system status. The 'get system status' command is the correct way to display the current FortiGate firmware version. This command outputs a comprehensive summary of the system state, including the firmware version (e.g., FortiOS v7.4.0), the system uptime, serial number, and HA status. It is the standard CLI command for verifying the exact build and patch level of the FortiGate.

Answer

get system statistics

Answer

get hardware status

Answer

get system performance status

Question 7

Match each Fortinet HA mode to its description.

Question 8

Match each FortiGate NAT type to its description.

Question 9

Match each FortiGate security profile component to its purpose.

Question 10

Match each FortiGate firewall policy action to its result.