NSE4 Practice Test 13 — 15 Questions

Question 1

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal authentication on a FortiGate requires a firewall policy that matches the unauthenticated traffic (source interface 'guest', destination 'any') with action 'ACCEPT' and the 'Authentication' setting set to 'Captive Portal'. This policy triggers the FortiGate to intercept HTTP/HTTPS traffic from unauthenticated users and redirect them to the captive portal login page, enforcing authentication before allowing further access.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.

Question 2

An administrator wants to use Fortinet Single Sign-On (FSSO) with Active Directory to transparently authenticate users. Which component is responsible for polling Active Directory for user logon events?

Accepted Answer

FSSO Collector Agent. The FSSO Collector Agent is the component that polls Active Directory domain controllers for security event logs (specifically event ID 4624 for logon events). It then maps these events to user IP addresses and forwards the authentication information to the FortiGate, enabling transparent user identification without requiring client-side software.

Answer

Active Directory Domain Controller

Answer

FortiGate directly with NTLM authentication

Answer

FortiAuthenticator

Question 3

What is the primary purpose of configuring split tunneling on an SSL VPN?

Accepted Answer

To allow the remote client to access both the corporate network and the Internet simultaneously without routing all traffic through the VPN. Split tunneling on an SSL VPN allows the remote client to have simultaneous access to the corporate network (via the encrypted VPN tunnel) and the public Internet (directly, without going through the VPN). This reduces bandwidth load on the VPN gateway and improves user experience by not routing non-corporate traffic through the encrypted tunnel. Option D correctly describes this behavior.

Answer

To provide two-factor authentication for the VPN connection

Answer

To encrypt all traffic from the remote client, including Internet traffic

Answer

To enable the use of client certificates for authentication

Question 4

A FortiGate administrator wants to authenticate VPN users against an existing Active Directory server. The administrator creates a user group referencing a remote LDAP server and configures the firewall policy to authenticate using that group. However, users report authentication failures. What is the FIRST step to troubleshoot?

Accepted Answer

Run 'diag test authserver ldap '. The `diag test authserver ldap` command directly tests LDAP authentication against the specified server, username, and password, isolating whether the FortiGate can successfully bind and authenticate the user. This is the fastest way to determine if the issue lies with the LDAP server connectivity, credentials, or configuration, rather than with the user group or policy. Since the administrator has already created the group and policy, the first logical step is to verify the fundamental authentication path before examining higher-level configurations.

Answer

Verify the user group configuration

Answer

Restart the FortiGate

Answer

Check the LDAP server's firewall rules

Question 5

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

Accepted Answer

Create a local-in policy to allow management access only from the trusted host. A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Answer

Change the admin port to a non-standard port

Answer

Enable HTTPS and restrict admin access via admin host

Answer

Use a firewall policy with source address restriction

Question 6

A FortiGate is configured with SSL deep inspection using a self-signed CA certificate. Users report that they see a certificate warning in their browser when accessing HTTPS sites. The admin wants to eliminate these warnings. What should the admin do?

Accepted Answer

Install the FortiGate's CA certificate on each client device's trusted root certificate store. When FortiGate performs SSL deep inspection, it decrypts HTTPS traffic by acting as a man-in-the-middle, using its own CA certificate to re-encrypt the connection. If the FortiGate's self-signed CA certificate is not trusted by the client, the browser will display a certificate warning because the issuer is not in the client's trusted root store. Installing the FortiGate's CA certificate on each client device's trusted root certificate store establishes trust, eliminating the warnings.

Answer

Disable SSL deep inspection and rely on flow-based antivirus

Answer

Change the SSL inspection mode to certificate inspection only

Answer

Configure an SSL certificate exemption for all HTTPS traffic

Question 7

You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?

Accepted Answer

There is no firewall policy allowing traffic from ssl.root to the internal network. The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.

Answer

Client certificate authentication is required but not provided

Answer

Split tunneling is disabled

Answer

The SSL VPN realm is not configured correctly

Question 8

A FortiGate administrator has configured a route-based IPsec VPN. After Phase 2 is up, traffic is not passing. The administrator verifies that the firewall policy allows traffic and the routes are correct. What should the administrator check next?

Accepted Answer

The static route uses the VPN interface as the outgoing interface. In a route-based IPsec VPN, traffic is routed to the VPN tunnel interface (e.g., 'to_remote'). Even if firewall policies and static routes exist, the static route must explicitly use the VPN interface as the outgoing interface. If the static route points to a different interface or a next-hop IP instead of the tunnel interface, the kernel will not forward traffic into the IPsec tunnel, causing Phase 2 to be up but no traffic to pass. This is a common misconfiguration that breaks the route-based VPN model.

Answer

The remote gateway's IP address is reachable

Answer

The pre-shared key is correct

Answer

The Phase 2 proposal includes the correct local and remote subnets

Question 9

A network admin configures an IPsec VPN between two FortiGates using IKEv2. Phase 1 completes successfully, but Phase 2 fails to establish. The admin runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match. The error 'proposal mismatch' in the 'diagnose vpn ike log' output specifically indicates that the Phase 2 parameters (encryption, authentication, or DH group) do not match between the two FortiGate peers. Since Phase 1 completed successfully, the IKE version (IKEv2) and pre-shared keys are already validated, leaving only the Phase 2 proposal as the cause. Option C correctly identifies that the encryption and authentication algorithms are mismatched, which is the most common reason for this error.

Answer

The IKE version is not compatible

Answer

The Phase 2 selectors (local and remote subnets) are misconfigured

Answer

The pre-shared keys do not match

Question 10

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

Accepted Answer

The implicit deny rule. The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Answer

The security profile group

Answer

The default route

Answer

The last explicit deny policy in the policy list

Question 11

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

Accepted Answer

The management IP is not in the same subnet as the management network.. In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Answer

Transparent mode does not support management access; only NAT/Route mode does.

Answer

The FortiGate's firewall policy blocks management traffic even in transparent mode.

Answer

The administrator must configure a management VLAN interface to access the FortiGate.

Question 12

A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?

Accepted Answer

Web filtering profile. Web filtering profile. FortiGate's web filtering profile uses URL rating and category-based filtering to block access to known malicious websites by leveraging FortiGuard's real-time threat intelligence. This is the specific security profile designed to control web access based on URL reputation, including blocking malicious URLs.

Answer

Antivirus profile

Answer

Application control profile

Answer

IPS profile

Question 13

An administrator wants to configure SSL VPN web mode to allow remote users to access a specific internal web application without installing any client software. Which authentication method is required?

Accepted Answer

Any supported authentication method (local, LDAP, RADIUS, certificates). SSL VPN web mode on FortiGate allows remote users to access internal web applications through a browser without client software. FortiGate supports multiple authentication methods for web mode, including local users, LDAP, RADIUS, and certificate-based authentication, so any supported method can be used. There is no requirement for a specific authentication type, making option D correct.

Answer

Certificate-based authentication only

Answer

No authentication is required for web mode

Answer

Two-factor authentication with FortiToken is mandatory

Question 14

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Accepted Answer

Enable 'add-route' on the hub Phase 2. In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 15

An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?

Accepted Answer

LDAP. To authenticate VPN users against an external LDAP server, the user group for the SSL VPN portal must be configured with the LDAP authentication method. This directs FortiGate to bind directly to the LDAP server (e.g., Active Directory or OpenLDAP) using the configured LDAP server object, performing a simple bind or SASL bind to verify user credentials. Other methods like RADIUS, FSSO, or Local would not leverage the LDAP server directly.

Answer

RADIUS

Answer

FSSO

Answer

Local