NSE4 Practice Test 15 — 15 Questions

Question 1

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The HA heartbeat interface is not configured or is down.. In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Answer

The passive unit has a different firmware version.

Answer

The HA mode is set to active-active instead of active-passive.

Answer

The administrator must manually trigger a sync from the active unit.

Question 2

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

Accepted Answer

Set the administrative access to HTTPS on the internal interface. Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Answer

Enable HTTPS on the system global settings

Answer

Create a firewall policy allowing inbound HTTPS from internal to the FortiGate

Answer

Configure a static route for the management subnet

Question 3

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

Accepted Answer

Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1. SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Answer

Disable wan2 in the SD-WAN zone

Answer

Use policy routing with a higher priority for wan1

Answer

Configure a static route with a higher distance for wan2

Question 4

A company is implementing SSL/TLS inspection on a FortiGate to monitor encrypted traffic. They want to ensure that traffic to high-risk categories is blocked, while traffic to financial sites is inspected but not blocked. The administrator creates an SSL inspection profile that deep-inspects all traffic except traffic to financial sites. However, users report that they cannot access financial websites. What is the most likely cause?

Accepted Answer

The web filter profile is configured to block financial websites, overriding the SSL inspection exemption.. The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

Answer

The SSL inspection profile should be set to certificate-inspection instead of deep-inspection for financial sites.

Answer

The SSL inspection profile must be applied after the web filter profile in the firewall policy.

Answer

The SSL inspection profile should have deep-inspection disabled for all categories except financial.

Question 5

An administrator configures a Central SNAT policy to translate traffic from the internal network (10.0.0.0/8) to the internet using the IP pool 'pool1'. The administrator also has a firewall policy that uses policy-based NAT with an IP pool 'pool2'. Both policies match the same traffic. Which NAT will be applied?

Accepted Answer

Central SNAT using pool1. Central SNAT policies have higher priority than policy-based NAT when both match the same traffic. In FortiOS, Central SNAT is evaluated before firewall policies, and if a match is found, the policy-based NAT within the firewall policy is ignored. Therefore, pool1 is applied.

Answer

Both NAT rules are applied in sequence

Answer

The traffic is dropped due to conflicting NAT configurations

Answer

Policy-based NAT using pool2

Question 6

An administrator wants to integrate FortiSandbox with a FortiGate to analyze suspicious files. Which security profile must be configured to send files to FortiSandbox?

Accepted Answer

Antivirus profile with FortiSandbox enabled. FortiSandbox integration with FortiGate requires the Antivirus profile to be configured with FortiSandbox enabled. This is because FortiSandbox is designed to analyze suspicious files that are typically detected by the antivirus engine, and the Antivirus profile is the only security profile that can forward files to FortiSandbox for advanced threat detection. The Antivirus profile uses the 'fortisandbox' option under 'scan-mode' to send files that cannot be conclusively determined as clean or malicious.

Answer

Application Control profile with FortiSandbox enabled

Answer

IPS profile with FortiSandbox enabled

Answer

Web Filter profile with FortiSandbox enabled

Question 7

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. In NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 8

Drag and drop the steps to troubleshoot a user unable to access the internet through FortiGate into the correct order.

Accepted Answer

Check firewall policies, then check NAT rules, then check routing, then perform packet capture, then review logs. Troubleshooting follows a logical flow: policy, NAT, routing, packet capture, then logs.

Answer

Check routing, then check NAT rules, then check firewall policies, then review logs, then perform packet capture

Answer

Review logs, then check firewall policies, then check NAT rules, then check routing, then perform packet capture

Answer

Check NAT rules, then perform packet capture, then check firewall policies, then check routing, then review logs

Question 9

An admin runs the command 'diagnose firewall iprope list 100000' and sees the following output:
id=2000000000 action=deny flag=0x0 src-interface=any dst-interface=any proto=0 src-addr=0.0.0.0-255.255.255.255 dst-addr=0.0.0.0-255.255.255.255
What does this entry represent?

Accepted Answer

The implicit deny policy at the end of the policy list. The output shows an entry with id=2000000000, action=deny, and source/destination addresses covering all possible IPs (0.0.0.0-255.255.255.255). In FortiGate, the implicit deny policy is automatically inserted at the end of the policy list with a high ID (typically 2000000000) and matches any traffic that hasn't been permitted by earlier policies. This is not a user-created policy but the built-in default deny rule.

Answer

A loopback interface policy

Answer

A user-created deny policy that blocks all traffic

Answer

A NAT policy that translates all addresses

Question 10

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 11

A FortiGate administrator needs to allow SSH management access from a specific IP address 10.0.0.100. Which configuration is required?

Accepted Answer

Set the trusted host for the admin account to 10.0.0.100. FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.

Answer

Enable SSH on the WAN interface and allow all IPs

Answer

Configure an access list on the upstream router

Answer

Create a firewall policy allowing SSH from 10.0.0.100 to the FortiGate

Question 12

An administrator needs to configure a FortiGate to allow web traffic from the internal network to the Internet. The internal network is 192.168.1.0/24 and the WAN interface is port1 with IP 203.0.113.1. Which firewall policy is correct?

Accepted Answer

Source: internal, Destination: port1, Service: HTTP/HTTPS, Action: ACCEPT. The firewall policy must match traffic originating from the internal network (source: internal) destined for the Internet via the WAN interface (destination: port1), and the service must be restricted to HTTP/HTTPS to allow web traffic only. The action ACCEPT permits the traffic. This aligns with the standard stateful inspection flow where source and destination interfaces are defined based on traffic direction.

Answer

Source: port1, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: external, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: internal, Destination: port1, Service: ALL, Action: ACCEPT

Question 13

A FortiGate administrator receives reports that some users are receiving spam emails despite an email filter profile being applied to the SMTP traffic. The email filter profile has 'spam' action set to 'discard'. What is the most likely reason spam is still reaching users?

Accepted Answer

The internal email server receives email directly from the internet without passing through the FortiGate. If the internal email server receives email directly from the internet without passing through the FortiGate, the email filter profile applied to SMTP traffic on the FortiGate will never inspect those messages. The FortiGate can only filter traffic that actually traverses it; any email routed around the FortiGate bypasses all security profiles entirely.

Answer

The spam dictionary is not updated with latest spam signatures

Answer

The email filter profile is not configured to scan outbound emails

Answer

The email filter profile is applied to the wrong policy direction (inbound vs outbound)

Question 14

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 15

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to cloud storage services like Google Drive over HTTPS, an application control profile is required because it can identify and control specific application actions (e.g., file uploads) within encrypted traffic. Deep inspection must be enabled to decrypt the HTTPS traffic, allowing the FortiGate to inspect the application-layer payload and enforce the upload blocking rule.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive