NSE4 Practice Test 12 — 15 Questions

Question 1

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'add-route' on the hub Phase 2. In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 2

An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?

Accepted Answer

LDAP. To authenticate VPN users against an external LDAP server, the user group for the SSL VPN portal must be configured with the LDAP authentication method. This directs FortiGate to bind directly to the LDAP server (e.g., Active Directory or OpenLDAP) using the configured LDAP server object, performing a simple bind or SASL bind to verify user credentials. Other methods like RADIUS, FSSO, or Local would not leverage the LDAP server directly.

Answer

RADIUS

Answer

FSSO

Answer

Local

Question 3

A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?

Accepted Answer

Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic. When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.

Answer

The FortiGate is using a proxy server that caches different results for different users

Answer

The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent

Answer

The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing

Question 4

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Accepted Answer

Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook. The troubleshooting should focus on three main areas: (A) SSL inspection exemption – if users access Facebook via HTTPS and the SSL inspection profile exempts Facebook traffic, it bypasses the web filter; (C) SSL VPN bypass – traffic through an SSL VPN tunnel may not match the policy if the tunnel interface is not covered; (D) policy application and order – the web filtering profile must be applied to the correct policy and the policy order must be such that this policy is enforced before any conflicting policy. Option E is a valid check, but since the category is already set to 'Block' in the profile, the issue is more likely related to the other three.

Answer

Ensure that the antivirus profile is enabled on the policy

Answer

Confirm that the 'Social Networking' category is not set to 'Monitor' instead of 'Block'

Question 5

You run the command 'diagnose vpn ike log filter name vpn1' and then 'diagnose vpn ike log filter type phase1'. The log shows: 'IKEv1 exchange:f4470f07:00000000: responder: main mode: received IKE_SA_INIT (aggressive mode not allowed)'. What is the problem?

Accepted Answer

The responder is configured for main mode only, but the initiator is sending aggressive mode. The log message 'aggressive mode not allowed' indicates the responder (FortiGate) is configured to accept only main mode IKE phase1 negotiations, but the initiator sent an aggressive mode request. This mismatch causes the responder to reject the IKE_SA_INIT message, as aggressive mode is disabled by default or explicitly set to main mode only in the phase1 configuration.

Answer

The initiator is using IKEv2 while the responder uses IKEv1

Answer

The pre-shared key is wrong

Answer

The phase1 proposal is incompatible

Question 6

What is the purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To create a logical interface that remains up regardless of physical link status. A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Answer

To provide a virtual IP address for NAT

Answer

To connect to a VLAN

Answer

To aggregate multiple physical interfaces for increased bandwidth

Question 7

A network administrator notices that an IPS sensor is generating excessive false positives for a specific signature. The administrator wants to exclude traffic from a trusted internal server (IP 10.1.1.100) from inspection for that signature only, while keeping other signatures active. Which configuration change should the administrator apply?

Accepted Answer

Create an IPS filter that excludes the server's source IP address from the signature.. An IPS filter allows the administrator to define a rule that excludes traffic from a specific source IP address (10.1.1.100) from inspection for a particular signature, while leaving all other signatures active. This granular approach ensures that false positives for that signature are reduced without disabling the signature entirely or affecting other traffic.

Answer

Set the signature action to 'pass' and use an application control profile to bypass the server.

Answer

Disable the signature in the IPS sensor configuration.

Answer

Add the server's IP to the exempt list in the IPS sensor.

Question 8

A network admin configures a site-to-site IPsec VPN between two FortiGates using IKEv1 main mode. The tunnel establishes successfully, but no traffic passes. What is the MOST likely cause?

Accepted Answer

There is no firewall policy allowing traffic through the VPN tunnel. The tunnel establishes successfully, meaning IKE phase 1 and phase 2 negotiations completed correctly, which rules out mismatched proposals or incorrect pre-shared keys. However, even with a functional IPsec tunnel, traffic cannot flow unless a firewall policy explicitly permits it between the source and destination zones using the VPN interface. In FortiGate, the VPN tunnel is treated as an interface, and without a policy allowing traffic from the internal network to the VPN interface (or vice versa), packets are dropped by the firewall engine.

Answer

Aggressive mode should be used instead of main mode

Answer

The pre-shared key is incorrect

Answer

The phase2 proposal does not match between peers

Question 9

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

Accepted Answer

No NAT policy is configured for internal users. The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Answer

The default route is incorrectly configured

Answer

An implicit deny policy is blocking traffic from internal to external

Answer

External access profile is set to read-only

Question 10

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is in SYN_SENT state and might be stuck due to no response from the server.. The output shows `proto_state=01`, which in Fortinet's session table corresponds to the TCP SYN_SENT state (the session is waiting for a SYN-ACK from the server). The `duration=3600` indicates the session has existed for 3600 seconds, but the `expire=3599` shows it has not yet been confirmed as established. This combination indicates the session is stuck in the SYN_SENT state, likely because the server is not responding, making option B correct.

Answer

The session is fully established and has been active for 3600 seconds.

Answer

The session has been idle for 3599 seconds and will expire soon.

Answer

The session is in FIN_WAIT state and is being closed.

Question 11

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Accepted Answer

The Phase 2 proposals do not match between the FortiGate and the client.. In IKEv2 VPNs, Phase 1 establishes the secure control channel (ISAKMP SA) and shows 'up' even if Phase 2 fails. Phase 2 creates the IPsec SA for actual data traffic; if it remains 'down', the most common cause is a mismatch in Phase 2 proposals (encryption, authentication, or PFS settings) between the FortiGate and the remote client. Since the client can connect but traffic is not routed, the tunnel is not fully established for data, pointing directly to a Phase 2 proposal mismatch.

Answer

The firewall policy for the VPN traffic is missing.

Answer

The pre-shared key for Phase 2 is incorrect.

Answer

The remote user's client does not support IKEv2.

Question 12

A FortiGate administrator configures an IPS sensor with a signature that has a 'pass' action. The sensor is applied to a firewall policy. When traffic matches this signature, what will happen?

Accepted Answer

The traffic is allowed but a log message is generated.. When an IPS signature with a 'pass' action is matched, the firewall allows the traffic to proceed normally, but a log message is generated to record the event. This is because the 'pass' action explicitly permits the traffic while still enabling logging if the signature is configured with logging enabled. In FortiGate, the 'pass' action overrides the default block behavior of IPS, ensuring the session continues without interruption.

Answer

The traffic is allowed without any logging.

Answer

The traffic is reset and a log is generated.

Answer

The traffic is blocked and logged.

Question 13

A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?

Accepted Answer

Central SNAT with a dynamic IP pool using overload. Central SNAT with a dynamic IP pool using overload (PAT) is the correct method to translate all traffic from the 192.168.1.0/24 network to a single public IP address. The 'overload' option enables port address translation (PAT), allowing multiple internal hosts to share one public IP by using unique source port numbers, which is exactly what the administrator needs for internet-bound traffic.

Answer

Policy-based NAT with a fixed port range

Answer

One-to-one NAT IP Pool

Answer

Virtual IP (VIP) with port forwarding

Question 14

Which inspection mode in the antivirus profile processes traffic by buffering the entire file before scanning, allowing more thorough detection but potentially increasing latency?

Accepted Answer

Proxy-based inspection. Proxy-based inspection in the antivirus profile buffers the entire file in memory before scanning, enabling thorough detection of threats like polymorphic malware or embedded exploits. This mode reassembles the full data stream, allowing the FortiGate to perform deep content analysis, but it introduces higher latency due to the buffering and reassembly process.

Answer

Deep inspection

Answer

DNS inspection

Answer

Flow-based inspection

Question 15

A company with 500 employees uses FortiGate as their internet gateway. They recently enabled SSL deep inspection using the built-in CA certificate. After deployment, many users report that they cannot access their online banking websites. The error message in the browser says 'The certificate is not trusted'. The administrator has already pushed the FortiGate CA certificate to all domain-joined computers via Group Policy. However, the problem persists for banking sites. The administrator also notices that banking sites load fine on mobile devices that do not have the CA certificate installed. What is the most likely cause and solution?

Accepted Answer

Banking websites use certificate pinning. Exempt them from deep inspection using an SSL inspection exemption list.. Banking websites often use HTTP Public Key Pinning (HPKP) or certificate pinning, where the browser expects a specific certificate or public key from the server. When FortiGate performs SSL deep inspection, it re-signs the server's certificate with its own CA, breaking the pinning validation. This causes the 'certificate not trusted' error even when the FortiGate CA is trusted, because the browser detects that the presented certificate does not match the pinned certificate. The correct solution is to exempt banking sites from deep inspection using an SSL inspection exemption list, allowing the original server certificate to pass through.

Answer

Disable SSL inspection entirely to avoid certificate issues.

Answer

The CA certificate is not properly installed on all computers. Re-deploy via Group Policy.

Answer

Use certificate inspection instead of deep inspection for all traffic.