NSE4 Practice Test 14 — 15 Questions

Question 1

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

Accepted Answer

Transparent mode. Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Answer

HA mode

Answer

VDOM mode

Answer

NAT/Route mode

Question 2

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based IPsec VPN, even when Phase 1 and Phase 2 are up and a static route exists via the virtual tunnel interface, traffic will still be dropped unless a firewall policy explicitly permits it. FortiGate uses a stateful firewall, so a policy must allow traffic from the local interface to the tunnel interface (or vice versa) to forward packets. Without this policy, the FortiGate will not forward traffic between the subnets, even though the tunnel is established.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 3

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. If the internal email server receives email directly from the internet without passing through the FortiGate, the email filter profile applied to SMTP traffic on the FortiGate will never inspect those messages. The FortiGate can only filter traffic that actually traverses it; any email routed around the FortiGate bypasses all security profiles entirely.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 4

An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?

Accepted Answer

Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access. The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Answer

Set the administrative access profile to allow SSH from any IP

Answer

Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate

Answer

Create a local-in policy to allow SSH from 10.0.1.0/24

Question 5

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 has built-in support for NAT traversal and MOBIKE. IKEv2 offers built-in NAT traversal (NAT-T) and MOBIKE (RFC 4555) as core features, not optional extensions. This eliminates the need for separate RFC 3947 NAT-T configuration and allows seamless IP address changes during a VPN session, making it far more robust for mobile users and dynamic environments compared to IKEv1.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires aggressive mode

Answer

IKEv2 is only for route-based VPN

Question 6

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

Accepted Answer

The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.. The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.

Answer

The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

Answer

Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

Answer

The IPS sensor is not enabled on any firewall policy.

Question 7

An administrator configures a policy route to send all traffic from subnet 172.16.1.0/24 to a specific next-hop 10.0.0.2. However, the traffic is still using the default route. What could be the reason?

Accepted Answer

The policy route has a lower priority than the default route.. Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Answer

The policy route does not have a destination interface set.

Answer

The policy route must be configured before the default route.

Answer

The source subnet is not correctly defined in the policy route.

Question 8

A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)

Accepted Answer

Diffie-Hellman group mismatch (e.g., group 2 vs group 14). The 'No proposal chosen' error indicates that the IKE SA parameters proposed by the initiator do not match any configured proposal on the responder. Since the error occurs during Phase 1, mismatches in mandatory parameters like Diffie-Hellman group, authentication method (hash algorithm), and encryption algorithm will directly cause this failure, as these are negotiated as part of the SA payload.

Answer

Pre-shared key mismatch

Answer

Lifetime mismatch (e.g., 86400 vs 3600)

Question 9

An admin needs to translate the source IP of traffic from multiple internal hosts to a single public IP when accessing the internet, while keeping track of each session. Which NAT method should be used?

Accepted Answer

Overload NAT (Port Address Translation). Overload NAT, also known as Port Address Translation (PAT), allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is the correct method for translating source IPs from multiple internal hosts to one public IP while maintaining session tracking, as it uses the transport-layer port number to differentiate between concurrent connections.

Answer

Fixed port range NAT

Answer

One-to-one NAT

Answer

Central SNAT without overload

Question 10

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

Accepted Answer

Verify the load-balancing algorithm for the aggregate interface. The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Answer

Check the LACP mode (active vs passive)

Answer

Increase the MTU on the aggregate interface

Answer

Ensure the physical ports are in the same VDOM

Question 11

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Accepted Answer

Assign an IP address to the management interface. To have a dedicated management IP that does not fail over, the administrator should configure a dedicated management interface (separate from HA heartbeat), assign an IP to it, and ensure the management access is configured on that interface. The management interface can be in a separate VDOM if desired.

Answer

Enable 'set ha-mgmt-interface' on the management interface

Answer

Set the management interface to be part of the HA cluster management IP

Question 12

An administrator configures a firewall policy with a schedule that allows traffic only during business hours (Monday to Friday, 09:00-18:00). At 17:55 on a Friday, a user establishes an SSH session that is still active at 18:05. What happens to the session when the schedule ends?

Accepted Answer

The session continues until it ends naturally. FortiGate firewall policies control the establishment of new sessions based on the schedule. Once a session is established, it is tracked in the session table and continues to be forwarded even if the schedule ends, until the session naturally terminates or times out. This behavior ensures that ongoing traffic is not abruptly disrupted when a schedule expires.

Answer

The session is immediately terminated at 18:00

Answer

The session is allowed but new sessions are blocked

Answer

The session is terminated after a 60-second grace period

Question 13

A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?

Accepted Answer

Local and remote identifiers (local ID / remote ID). In IKEv1 main mode, the Phase 1 negotiation includes an exchange of identity (ID) payloads after the Diffie-Hellman exchange. If the local or remote identifiers (local ID / remote ID) do not match what is expected on the peer, the FortiGate will reject the proposal with a 'no proposal chosen' error, even if all other Phase 1 parameters (encryption, authentication, DH group, IKE version) are identical. The pre-shared key is verified later in Phase 1 (during authentication), so a mismatch there would cause a different error (e.g., 'authentication failed'), not 'no proposal chosen'.

Answer

Pre-shared key

Answer

IKE version (IKEv2)

Answer

Phase 2 encryption algorithm

Question 14

A FortiGate administrator configures an email filter profile to block spam. Users report that some legitimate emails are being blocked. The administrator wants to reduce false positives while still blocking spam. What should the administrator do?

Accepted Answer

Increase the spam threshold score. Increasing the spam threshold score raises the bar for what is classified as spam, so only emails with a higher spam score (indicating stronger spam characteristics) are blocked. This reduces false positives because legitimate emails with lower scores will no longer be blocked, while still blocking high-scoring spam.

Answer

Disable the email filter profile

Answer

Decrease the spam threshold score

Answer

Enable the FortiGuard spam filter only

Question 15

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. When a FortiGate uses flow-based inspection, sessions that are offloaded to the Network Processor Unit (NPU) are not inspected by the IPS engine. The 'state=bypass' in the 'diagnose ips session list' output indicates that these sessions are being hardware-accelerated and bypassing the IPS inspection, which is normal behavior for traffic that meets offload criteria.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions