NSE4 Practice Test 15 — 15 Questions

Question 1

A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions. When a FortiGate performs destination NAT (DNAT) via a VIP for inbound traffic, it automatically creates a session entry that includes the reverse NAT mapping. For return traffic from the internal server, the FortiGate uses this session to perform source NAT (SNAT) back to the original public IP (203.0.113.10). This is called 'implicit reverse NAT' and requires no additional configuration; the session state ensures the reply packets are correctly translated and forwarded to the external client.

Answer

Create a second VIP for the return traffic

Answer

Add a policy from DMZ to WAN allowing the internal server to reply

Answer

Configure static routing on the internal server to route through the FortiGate

Question 2

An administrator needs to allow traffic from a guest network (192.168.100.0/24) to the internet only during business hours (Mon-Fri, 08:00-18:00). The administrator creates a schedule object and applies it to the firewall policy. However, guests can still access the internet outside of the schedule. What is the most likely cause?

Accepted Answer

The schedule is not selected in the firewall policy. If the schedule is not actually selected in the firewall policy configuration, the policy will apply without any time restriction, allowing traffic at all times. The administrator may have created the schedule object but forgotten to assign it to the policy's schedule field, which is a common oversight.

Answer

The guest network is also allowed by another policy without a schedule

Answer

The schedule object is configured as a group but not applied

Answer

The FortiGate clock is not synchronized with an NTP server

Question 3

An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?

Accepted Answer

One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.. In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.

Answer

The cluster IP address is assigned to both units simultaneously.

Answer

Both units can forward traffic simultaneously.

Answer

Heartbeat interfaces are optional.

Question 4

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. DLP (Data Loss Prevention) profiles are specifically designed to inspect content such as credit card numbers in outbound emails and block them to prevent data leakage. While other profiles handle spam, web access, or malware, only DLP can perform pattern-based content inspection on email bodies and attachments.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 5

An administrator configures a firewall policy with a schedule object that is set to 'Available: Mon-Fri 09:00-17:00'. At 10:00 AM on Saturday, users report they cannot access the resource. The administrator checks the policy list and sees the policy is enabled. What is the MOST likely reason?

Accepted Answer

The schedule object only allows traffic on weekdays, and Saturday is not included. The schedule object is configured to allow traffic only from Monday to Friday, 09:00-17:00. Since Saturday is outside this range, the firewall policy will deny or not match the traffic, even though the policy is enabled. This is the most direct and likely reason for the access failure.

Answer

The FortiGate's system time is incorrect

Answer

A deny policy with higher priority is blocking the traffic

Answer

The schedule object is not correctly applied to the policy

Question 6

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. An IP Pool in FortiGate allows you to override the source IP address for specific traffic, even when NAT is enabled on the policy. By creating an IP Pool with the single address 203.0.113.2 and referencing it in the firewall policy, traffic from 10.0.0.10 will be NATed to that specific IP instead of the outgoing interface address (203.0.113.1). This is the standard method for fixed source NAT (also called 'static NAT' or 'one-to-one NAT') for a specific host.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'

Question 7

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

Accepted Answer

FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually. When a firewall policy is deleted on a FortiGate, the existing sessions that were created by that policy are not automatically removed. The FortiGate continues to process those sessions until they expire naturally based on their timeout values. In this case, the sessions with 'proto=6' (TCP) and 'expire=3599' seconds remaining will persist until the timer counts down, even though the originating policy no longer exists. The admin must manually clear them using 'diagnose sys session clear' or wait for the timeout to expire.

Answer

The sessions are using UDP protocol, which has a longer timeout

Answer

The sessions are protected by a different policy that still exists

Answer

The sessions are in a different VDOM

Question 8

A FortiGate administrator wants to block spam emails sent to the company's mail server. The mail server is behind the FortiGate. Which THREE configurations should be applied?

Accepted Answer

Enable FortiGuard spam filtering in the Email Filter profile. FortiGate's Email Filter profile integrates with FortiGuard's antispam service to block spam at the gateway. This profile uses real-time signature-based and heuristic analysis to identify and reject spam before it reaches the internal mail server.

Answer

Enable DLP to filter spam

Answer

Configure Application Control to block email applications

Question 9

Which IPsec VPN mode is typically used when the VPN peer has a dynamic public IP address?

Accepted Answer

Aggressive mode. Aggressive mode is used in IPsec IKE phase 1 when the VPN peer has a dynamic public IP address because it allows the initiator to send its identity and authentication data in the first packet, enabling the responder to identify the peer without requiring a reverse DNS lookup or static IP. This mode reduces the number of exchanges from six (Main mode) to three, which is essential when the peer's IP address is not known in advance, as in many remote-access or dynamic-IP site-to-site scenarios.

Answer

Quick mode

Answer

IKEv2

Answer

Main mode

Question 10

A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?

Accepted Answer

Policy ID 1 because it is the first matching policy in the list. Policy ID 1 is correct because FortiGate uses a sequential, first-match policy evaluation model. Traffic from 10.0.1.10 to 203.0.113.5 matches the source and destination of Policy ID 1 exactly, and since it appears first in the policy list, it is applied immediately. Once a match is found, no further policies are evaluated, even if a later policy (like Policy ID 2) also matches.

Answer

Both policies will be applied because the traffic matches both

Answer

Policy ID 2 because it has a broader destination and is more inclusive

Answer

Neither policy; implicit deny will block the traffic

Question 11

An administrator needs to block access to specific websites based on their FQDN (e.g., *.example.com). The FortiGate should match the destination domain regardless of the IP address the domain resolves to. Which type of address object should the admin use in the firewall policy destination?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.

Answer

Geography object

Answer

Subnet object

Answer

FQDN object

Question 12

A FortiGate is configured in an HA active-passive cluster. When the active unit fails, the passive unit takes over, but IPsec VPN tunnels fail to re-establish. The configuration is synchronized. What is the most likely cause?

Accepted Answer

The IPsec VPN is using the physical interface IP instead of a virtual IP (VIP) or floating IP.. In an HA active-passive cluster, IPsec VPN tunnels typically bind to the physical interface IP address. When failover occurs, the passive unit assumes the cluster's virtual MAC and IP addresses, but the IPsec tunnel endpoints remain tied to the original physical IP. Since the new active unit has a different physical interface IP, the remote peer sees a mismatched source address and drops the connection. Using a virtual IP (VIP) or floating IP ensures the tunnel endpoint stays consistent across failover.

Answer

The pre-shared key is different on the two units.

Answer

The firewall policies for VPN traffic are not synchronized.

Answer

The HA heartbeat interface is down.

Question 13

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

Accepted Answer

Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ. To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Answer

Use policy-based routing to forward SSH traffic

Answer

Configure source NAT on the outbound policy from DMZ to WAN

Answer

Enable NAT on the WAN interface

Question 14

An administrator is troubleshooting an IPsec VPN between two FortiGates. Phase 1 is up but Phase 2 is down. The admin runs 'diagnose vpn ike log' and sees 'no matching proposal'. To resolve this issue, which TWO settings should be checked on both ends?

Accepted Answer

Phase 2 PFS (Perfect Forward Secrecy) group. The 'no matching proposal' error in Phase 2 often indicates a mismatch in the Perfect Forward Secrecy (PFS) group. PFS ensures that if a private key is compromised, past session keys are not exposed; both ends must agree on the same Diffie-Hellman group (e.g., group 2, 5, 14) for Phase 2. If one side has PFS enabled with a specific group and the other does not, or uses a different group, the proposal fails.

Answer

Phase 1 authentication method

Answer

Phase 2 local and remote subnets

Answer

Phase 1 encryption algorithm

Question 15

An administrator needs to block traffic from a specific geographic region (e.g., country) from reaching the corporate web server. Which type of address object should be used to define the source?

Accepted Answer

Geography object. A Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

Answer

Wildcard FQDN object

Answer

FQDN object

Answer

Subnet object