NSE4 Practice Test 13 — 15 Questions

Question 1

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

Accepted Answer

A layer 2 firewall policy. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Answer

A policy-based NAT rule

Answer

A firewall policy using zone-based security

Answer

A VIP policy to map the web server's public IP

Question 2

You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?

Accepted Answer

The HA heartbeat interface is not configured correctly or is down. The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings. The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.

Answer

The secondary unit has a lower priority, so it never takes over

Answer

The password for HA synchronization is incorrect

Answer

The session pickup feature is disabled

Question 3

An administrator notices that a specific application (e.g., Skype) is not being detected by the application control profile. The profile includes the 'Skype' application signature but traffic is passing through without being logged as Skype. What is the most likely reason?

Accepted Answer

SSL deep inspection is not enabled on the firewall policy. The most likely reason is that SSL deep inspection is not enabled on the firewall policy. When Skype traffic is encrypted (which is common for modern Skype versions), the FortiGate cannot inspect the payload to match the application signature. Without SSL deep inspection, the firewall sees only encrypted packets and cannot identify the application as Skype, even if the signature is present in the profile.

Answer

The application control profile is set to 'Monitor' mode

Answer

The traffic is using a non-standard port

Answer

The application signature is outdated

Question 4

An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?

Accepted Answer

The application control profile is blocking the web application.. The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Answer

The IPS sensor is blocking the login page due to a false positive.

Answer

The firewall policy action is set to 'deny' but the exhibit shows 'accept'.

Answer

The HTTPS service is not correctly defined and blocking the traffic.

Question 5

An admin is configuring a policy-based NAT rule (central NAT) to translate internal users' source IPs to the external IP of the FortiGate interface. However, users complain that some applications fail. The admin notices that the NAT rule is using 'dynamic IP pool' with overload. What is the MOST likely cause of the application failures?

Accepted Answer

The applications are sensitive to NAT and require a fixed port range. Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.

Answer

The IP pool is exhausted and no more translations are available

Answer

The route to the destination is missing

Answer

The firewall policy does not have NAT enabled

Question 6

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is not configured or is down.. In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Answer

The passive unit has a different firmware version.

Answer

The HA mode is set to active-active instead of active-passive.

Answer

The administrator must manually trigger a sync from the active unit.

Question 7

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

Accepted Answer

Set the administrative access to HTTPS on the internal interface. Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Answer

Enable HTTPS on the system global settings

Answer

Create a firewall policy allowing inbound HTTPS from internal to the FortiGate

Answer

Configure a static route for the management subnet

Question 8

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

Accepted Answer

Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1. SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Answer

Disable wan2 in the SD-WAN zone

Answer

Use policy routing with a higher priority for wan1

Answer

Configure a static route with a higher distance for wan2

Question 9

A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?

Accepted Answer

The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.. The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

Answer

The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.

Answer

The SSL inspection profile must be applied after the web filter profile in the firewall policy.

Answer

The SSL inspection profile should have deep-inspection disabled for all categories except financial.

Question 10

An administrator configures a Central SNAT policy to translate traffic from the internal network (10.0.0.0/8) to the internet using the IP pool 'pool1'. The administrator also has a firewall policy that uses policy-based NAT with an IP pool 'pool2'. Both policies match the same traffic. Which NAT will be applied?

Accepted Answer

Central SNAT using pool1. Central SNAT policies have higher priority than policy-based NAT when both match the same traffic. In FortiOS, Central SNAT is evaluated before firewall policies, and if a match is found, the policy-based NAT within the firewall policy is ignored. Therefore, pool1 is applied.

Answer

Both NAT rules are applied in sequence

Answer

The traffic is dropped due to conflicting NAT configurations

Answer

Policy-based NAT using pool2

Question 11

What is the purpose of the DNS filter security profile on a FortiGate?

Accepted Answer

To block DNS queries to known malicious domains. The DNS filter security profile on a FortiGate is designed to block DNS queries to known malicious domains by comparing the domain names in DNS requests against a regularly updated database of malicious or categorized domains. This prevents users from resolving domains associated with malware, phishing, or command-and-control servers, thereby stopping threats before an IP connection is even established.

Answer

To inspect DNS traffic for virus signatures

Answer

To filter spam emails based on DNS blacklists

Answer

To prevent DNS tunneling attacks

Question 12

A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53). A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.

Answer

Enable SSL deep inspection on the policy

Answer

Configure FortiGuard DNS filtering service on the FortiGate

Answer

Set the inspection mode to proxy-based

Question 13

A FortiGate administrator needs to configure NTP to ensure accurate time on the device. Which two steps are required? (Choose two.)

Accepted Answer

Specify at least one NTP server address. To configure NTP on a FortiGate, you must enable the NTP service under System > Settings (option C) and specify at least one NTP server address (option B) so the device can synchronize its clock. Without enabling the service, the NTP client process does not run, and without a server address, there is no source to query. Option A (Sync on Save) is unrelated to NTP; it refers to configuration changes. Option D (firewall policy) is not required because the FortiGate's NTP client uses the management interface and bypasses regular firewall policies. Option E (set time zone) is not a required step for NTP synchronization, though it may be configured separately.

Answer

Enable the 'Sync on Save' option

Answer

Configure a firewall policy to allow NTP traffic (UDP 123)

Answer

Set the time zone to the local time zone

Question 14

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

Accepted Answer

Central SNAT overrides policy-based NAT. Central SNAT (Source NAT) is a centralized NAT policy that takes precedence over policy-based NAT rules when both are configured for the same traffic. In FortiGate, Central SNAT is evaluated before policy-based NAT, and if a matching Central SNAT rule exists, it will override any policy-based NAT configuration. This is by design to provide a more predictable and manageable NAT architecture.

Answer

Both NAT methods are applied, causing double NAT

Answer

The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict

Answer

Policy-based NAT always overrides Central SNAT

Question 15

A FortiGate administrator is setting up a new FortiGate and needs to integrate it with FortiAnalyzer and FortiManager. Which THREE statements are correct regarding this integration?

Accepted Answer

FortiAnalyzer can generate reports based on the logs received from FortiGate.. FortiAnalyzer is designed to receive logs from FortiGate devices and use them to generate comprehensive reports. The FortiGate sends logs via syslog or the FGFM protocol, and FortiAnalyzer stores them in its SQL database, allowing administrators to create scheduled or on-demand reports for compliance, traffic analysis, and security events.

Answer

FortiAnalyzer can push configuration changes to the FortiGate.

Answer

FortiGate uses the FGFM protocol to communicate with FortiAnalyzer.