NSE4 Practice Test 16 — 15 Questions

Question 1

An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?

Accepted Answer

Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access. The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Answer

Set the administrative access profile to allow SSH from any IP

Answer

Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate

Answer

Create a local-in policy to allow SSH from 10.0.1.0/24

Question 2

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. Option D is correct because ZTNA on FortiGate requires a proxy-based firewall policy, which enables full inspection of the traffic and allows the FortiGate to enforce ZTNA access control for the internal application. Option E is correct because the ZTNA rule is the core enforcement component that verifies the endpoint's identity and posture (via FortiClient EMS tags) before granting access to the protected resource. Options A and C are incorrect because ZTNA does not rely on IPsec VPN or policy-based IPsec tunnels; it uses a client-based access proxy model instead of traditional tunnel-based remote access. Option B is incorrect because transparent mode is not an essential requirement for ZTNA; ZTNA can be deployed on a FortiGate in NAT/route mode as well.

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 3

What is the order of evaluation for firewall policies on a FortiGate?

Accepted Answer

From top to bottom, first match. FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.

Answer

Random order

Answer

From bottom to top

Answer

By policy ID in ascending order

Question 4

Which of the following best describes the purpose of a captive portal on a FortiGate?

Accepted Answer

To authenticate users before granting network access. A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.

Answer

To provide secure remote access to internal resources

Answer

To encrypt traffic between sites

Answer

To block malware from entering the network

Question 5

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

Accepted Answer

The user's IP address is not in the source address range of the policy. Even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Answer

The user is not a member of the FSSO group

Answer

The FSSO collector agent is not running

Answer

The FortiGate is not polling the domain controller

Question 6

A FortiGate administrator runs the following command and sees: 'diagnose ips anomaly list' returns no entries, but the IPS sensor is configured with anomaly signatures. What is the MOST likely reason the signatures are not appearing?

Accepted Answer

The anomaly signatures have not triggered any events yet because traffic thresholds have not been exceeded.. The 'diagnose ips anomaly list' command displays only anomaly signatures that have been triggered and are currently in a state where thresholds have been exceeded. If no entries appear, it means the configured anomaly signatures have not yet detected traffic surpassing their defined thresholds (e.g., packets per second, connections per second). Anomaly signatures are threshold-based and only become active when the monitored traffic exceeds the configured limits, at which point they would appear in the list.

Answer

The IPS sensor is configured in 'passive' mode, which suppresses anomaly detection.

Answer

Anomaly signatures are not displayed by 'diagnose ips anomaly list'; they require a different command.

Answer

The IPS sensor is not enabled on any firewall policy.

Question 7

An administrator is troubleshooting an IPsec VPN between two FortiGates. Phase 1 is up but Phase 2 is down. The admin runs 'diagnose vpn ike log' and sees 'no matching proposal'. To resolve this issue, which TWO settings should be checked on both ends?

Accepted Answer

Phase 2 PFS (Perfect Forward Secrecy) group. The 'no matching proposal' error during Phase 2 negotiation means the two peers cannot agree on the Phase 2 (IPsec SA) parameters, so the administrator must verify the Phase 2 proposal settings on both ends. Option A is correct because the Phase 2 PFS (Perfect Forward Secrecy) group (e.g., DH group 5, 14, 19) is part of the Phase 2 proposal; if one side enables PFS with a different DH group than the other, or one side omits PFS entirely, the proposals will not match and Quick Mode will fail. Option D is correct because the Phase 2 encryption algorithm (e.g., AES128, AES256) must be identical on both peers; a mismatch in the encryption transform is a classic cause of 'no matching proposal' at Phase 2. Options B and E are incorrect because the Phase 1 authentication method and Phase 1 encryption algorithm are negotiated during Phase 1 (Main/Aggressive Mode), and since Phase 1 is already up, those parameters have already matched successfully. Option C is incorrect because the Phase 2 local and remote subnets are the selectors used to build the IPsec SA; a subnet mismatch typically causes traffic to not match the tunnel or produces a 'no policy' or traffic-selector error, not a 'no matching proposal' error.

Answer

Phase 1 authentication method

Answer

Phase 2 local and remote subnets

Answer

Phase 1 encryption algorithm

Question 8

A FortiGate is configured with an application control profile to allow only 'business-approved' applications. Users are still able to use Skype for Business. The admin wants to ensure that only Skype for Business is allowed and other Skype variants are blocked. Which THREE steps should the admin take? (Choose three.)

Accepted Answer

Identify the exact application signatures for Skype for Business. The admin must first identify the exact application signatures for Skype for Business to distinguish it from other Skype variants. FortiGate's application control uses predefined signatures to classify traffic, and without knowing the specific signature IDs (e.g., 'Skype.For.Business'), the admin cannot selectively allow or block applications in the profile.

Answer

Enable logging for all traffic to verify the application being used

Answer

Create a custom application signature for Skype for Business

Question 9

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

Accepted Answer

Configure two static default routes with the same distance and metric. Configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Answer

Configure a single default gateway and rely on ARP for failover

Answer

Configure a policy route for each subnet directing traffic to a different ISP

Answer

Configure two static default routes with different distances

Question 10

A FortiGate administrator needs to backup the configuration to a remote TFTP server. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The 'execute backup config tftp' command is the proper CLI syntax in FortiOS for backing up the current configuration to a remote TFTP server. This command triggers an immediate backup operation, and the filename and TFTP server IP are required parameters to specify the destination.

Answer

copy config tftp

Answer

execute restore config tftp

Answer

backup configuration to tftp <tftp_server_ip>

Question 11

An administrator wants to create a firewall policy that blocks all traffic from a specific IP address (10.0.0.99) to the internet, but allows all other traffic. Which policy configuration is correct?

Accepted Answer

Create a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface, then an allow policy for all other traffic. FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. By placing a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface first, traffic from that IP is blocked. Then a subsequent allow policy for all other traffic (source 'all') permits everything else, ensuring the specific IP is blocked while all other traffic is allowed.

Answer

Create an allow policy for source 'all' and then a deny policy for 10.0.0.99

Answer

Use a local-in policy to block the IP

Answer

Create a policy that denies all traffic from 10.0.0.99 to any destination

Question 12

An organization uses FortiMail for email filtering and FortiGate for web filtering. The administrator wants to ensure that email traffic is filtered for spam and malware before reaching the internal mail server. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Configure FortiMail to scan incoming emails and then forward them to the internal mail server.. Option A is correct because FortiMail is the dedicated email security appliance that must actually perform the spam and malware scanning of inbound messages before relaying them to the internal mail server. Option D is correct because the FortiGate must be configured to direct SMTP traffic to FortiMail first, typically via a policy route or a VIP/port-forwarding rule, so that mail is inspected before it reaches the internal mail server. Option B is not correct because an antivirus profile on the FortiGate only scans traffic passing through the firewall and does not provide the full email spam/malware filtering that FortiMail delivers. Option C is not correct because FortiGate email filter profiles are not the mechanism used to filter SMTP for spam and malware in this FortiMail-based design. Option E is not correct because disabling SMTP inspection on the FortiGate would remove an additional layer of protection and does not accomplish the goal of filtering email through FortiMail.

Answer

Apply an antivirus profile to the firewall policy that handles SMTP traffic.

Answer

Apply an email filter profile to the firewall policy that handles SMTP traffic.

Answer

Disable SMTP inspection on the FortiGate to avoid double scanning.

Question 13

A company wants to provide remote access to internal resources for employees using laptops that may connect from untrusted networks. The security team requires that all traffic between the remote users and the corporate network be encrypted, and that users must authenticate using a username/password plus a one-time passcode from a hardware token. Which FortiGate VPN solution best meets these requirements?

Accepted Answer

SSL VPN with FortiToken two-factor authentication. SSL VPN with FortiToken two-factor authentication meets the requirement for encrypted remote access with username/password plus a one-time passcode from a hardware token. SSL VPN provides encrypted tunnels over HTTPS, and FortiToken adds the required second factor, ensuring strong authentication even from untrusted networks.

Answer

IPsec VPN with certificate-based authentication

Answer

SSL VPN with local password authentication

Answer

L2TP/IPsec VPN with a pre-shared key and user password

Question 14

A company uses Active Directory for user authentication. They want users to automatically authenticate to the FortiGate without entering credentials when accessing the internet. Which authentication method should the administrator configure?

Accepted Answer

FSSO with Active Directory polling. FSSO (Fortinet Single Sign-On) with Active Directory polling allows users to be automatically authenticated to the FortiGate based on their existing Windows domain login. The FortiGate polls the domain controllers for user logon events, mapping the user's IP address to their authenticated identity without requiring any additional credential entry. This meets the requirement of transparent internet access authentication.

Answer

LDAP authentication with captive portal

Answer

RADIUS authentication with PAP

Answer

Local user authentication

Question 15

An administrator wants to use Active Directory credentials to authenticate firewall administrators. Which authentication server type should be configured on the FortiGate?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it directly integrates with Microsoft Active Directory to authenticate firewall administrators using their existing AD credentials. FortiGate can bind to an LDAP server to verify username and password pairs, making it the native protocol for AD authentication without requiring additional services or translation layers.

Answer

TACACS+

Answer

FSSO

Answer

RADIUS