NSE4 Practice Test 15 — 15 Questions

Question 1

An administrator needs to configure a firewall policy that allows internal users to access a specific web server on the internet using its domain name. The web server's IP address may change. Which type of address object should be used as the destination in the policy?

Accepted Answer

FQDN address object. An FQDN address object resolves the domain name to IP addresses dynamically. This allows the policy to adapt to IP changes, unlike a subnet object.

Answer

IP Range object that covers the entire public IP space

Answer

Subnet object with the current IP address

Answer

Geography object

Question 2

An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?

Accepted Answer

Policy-based routing (PBR) configured with a policy matching the destination and service. Policy-based routing (PBR) allows traffic matching a policy to be routed to a specific next-hop or interface, overriding the regular routing table. This is the correct approach for selective routing.

Answer

Central NAT policy to force the traffic out of WAN2

Answer

Static route with a higher priority for WAN2 to 203.0.113.0/24

Answer

SD-WAN with a strategy of 'Best Quality'

Question 3

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. Geography address objects allow matching based on country (or region) using the IP geolocation database. This is useful for geo-blocking.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 4

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Accepted Answer

diagnose firewall iprope list. Using diagnose debug flow to trace the packet and diagnose firewall iprope list to see policy hit counts are effective ways to identify traffic matching.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 5

A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?

Accepted Answer

The traffic is in a different VDOM than the policy. Firewall policies are VDOM-specific. Traffic in a different VDOM will not match policies from another VDOM. The policy must be created in the VDOM where the traffic is being routed.

Answer

The internet-facing interface is not part of any VDOM

Answer

The subnet object is defined in the wrong address group

Answer

The policy is placed at the bottom of the list

Question 6

An admin wants to allow traffic only from specific countries to access a web server. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. FortiGate supports geography-based address objects that allow or deny traffic based on the source IP's country. These are configured using geography objects.

Answer

Subnet object

Answer

FQDN object

Answer

Wildcard FQDN object

Question 7

Which statement about the implicit deny policy on a FortiGate is true?

Accepted Answer

It is always at the bottom of the policy list and denies all unmatched traffic. The implicit deny policy is a built-in policy at the end of the policy list that denies all traffic not matching any explicit policy. It cannot be removed or modified.

Answer

It is a user-configurable policy that can be deleted

Answer

It allows traffic that matches no other policy

Answer

It can be moved to a different position in the policy list

Question 8

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been active for 3600 seconds and will expire in 3599 seconds. proto=6 indicates TCP, proto_state=01 is TCP SYN_SENT (or ESTABLISHED depending on FortiOS version, but typically 01 is ESTABLISHED), duration=3600 seconds, expire=3599 seconds remaining. The session is established and about to expire (TTL almost up).

Answer

The session is a UDP session for DNS

Answer

The session is an ICMP echo request

Answer

The session is blocked by a firewall policy

Question 9

A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?

Accepted Answer

Policy ID 2, because it matches the source interface and destination. Policy lookup is performed top-down. The first matching policy is used. Policy 1 matches only LAN traffic, not DMZ. Policy 2 matches all traffic from DMZ to WAN, so it matches the packet.

Answer

Policy ID 1, because it is first in order

Answer

Policy ID 2, but only if it has a service allowing HTTPS

Answer

Implicit deny, because no policy matches HTTPS traffic

Question 10

An administrator wants to limit the bandwidth for a specific application (e.g., YouTube) across all users. The administrator creates a traffic shaper and applies it to the firewall policy. What additional configuration is needed to identify YouTube traffic?

Accepted Answer

Apply an Application Control profile to the policy. Application control profiles identify applications by signature. After identification, traffic shapers can be applied to limit bandwidth.

Answer

Enable deep inspection and create a URL filter

Answer

Create a custom service object for YouTube

Answer

Use a geography object to block non-local traffic

Question 11

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. To use a specific source IP for NAT, an IP Pool object must be created with the desired IP (203.0.113.2) and then referenced in the firewall policy. Option C is correct.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'

Question 12

A FortiGate administrator wants to create a firewall policy that matches traffic based on the destination domain name (e.g., *.example.com). Which type of address object should be used?

Accepted Answer

Wildcard FQDN object. Wildcard FQDN objects allow matching based on domain name patterns like *.example.com. Option D is correct.

Answer

FQDN object

Answer

Subnet object

Answer

Geography object

Question 13

An admin needs to allow outbound HTTP and HTTPS traffic from the internal network to the internet. Which two built-in service objects can be used in a single firewall policy to achieve this?

Accepted Answer

HTTP and HTTPS. FortiGate provides predefined service objects for common protocols. HTTP (TCP/80) and HTTPS (TCP/443) are separate objects. To allow both, you can either create a service group containing both or add both individually. The question asks for two built-in service objects that together cover both protocols.

Answer

WEB and SSL

Answer

ANY and HTTPS

Answer

ALL_TCP and ALL_UDP

Question 14

An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?

Accepted Answer

The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP. By default, when using NAT (including VIP), FortiGate performs source NAT (SNAT) for the traffic destined to the VIP unless specifically configured otherwise. To preserve the original source IP, the admin must disable NAT on the policy or use a policy with NAT disabled.

Answer

The VIP is configured with port forwarding and the server is expecting a different port

Answer

The VIP is using a different public IP than expected

Answer

The server's routing is misconfigured and traffic is returning via a different path

Question 15

An admin needs to configure NAT for internal users accessing the internet. The requirements are: 1) All internal users must be translated to a single public IP. 2) The translation should use port address translation (PAT). 3) The configuration must allow tracking of which internal user initiated a connection. Which THREE settings must be configured? (Choose three.)

Accepted Answer

Enable NAT on the firewall policy and select the IP pool. To translate to a single public IP with PAT, the admin should use an IP pool configured as overload (PAT). Additionally, to track users, the policy must have logging enabled for user activity, and optionally, identity-based policy or authentication can be used. The pool itself does not track users; logging does.

Answer

Set the policy's NAT to use the egress interface IP

Answer

Configure a central SNAT policy with the same pool