NSE4 Practice Test 17 — 15 Questions

Question 1

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 2

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit

Question 3

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

Accepted Answer

Create a policy route with source address set to the specific IP and set the gateway to ISP1. Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Answer

Increase the administrative distance of the ISP2 default route to 20

Answer

Configure SD-WAN rules to steer the traffic

Answer

Add a static host route for the specific source IP via ISP1

Question 4

After upgrading FortiGate firmware, the administrator notices that the 'config router static' command now shows a new keyword 'distance' instead of 'weight'. The upgrade also changed the ECMP load-balancing behavior. What was the likely change in the ECMP algorithm?

Accepted Answer

The ECMP algorithm changed from weighted to source-dest-IP. In FortiOS 6.4, the default ECMP method was weighted, using the 'weight' parameter in static routes. Starting with FortiOS 7.0, the 'weight' parameter was replaced by 'distance', and the default ECMP algorithm changed to source-IP-based hash (also referred to as source-dest-IP hash). This change enhances load balancing by distributing traffic based on source/destination IP addresses rather than priority weights.

Answer

The ECMP algorithm changed from source-IP-based to weighted (hash-based)

Answer

The ECMP algorithm is now configurable via 'config system ecmp'

Answer

The ECMP algorithm changed from source-dest-IP to round-robin

Question 5

A FortiGate has two internet connections: port1 (ISP1) and port2 (ISP2). An administrator configures two static default routes with equal distance and priority. Traffic to a specific public IP is observed going out port1, but the admin wants it to go out port2. What should be configured?

Accepted Answer

Configure a policy route to direct the specific destination to port2. Policy routes (also called PBR) override the routing table for specific traffic matches. Since both default routes have equal distance and priority, the FortiGate uses ECMP or the route with the lowest cost by default. A policy route can match the specific destination IP and force the traffic out port2, bypassing the routing table lookup.

Answer

Use ECMP with source-based hashing

Answer

Increase the administrative distance of the default route on port1

Answer

Configure a blackhole route

Question 6

An admin needs to translate the source IP of traffic from multiple internal hosts to a single public IP when accessing the internet, while keeping track of each session. Which NAT method should be used?

Accepted Answer

Overload NAT (Port Address Translation). Overload NAT, also known as Port Address Translation (PAT), allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is the correct method for translating source IPs from multiple internal hosts to one public IP while maintaining session tracking, as it uses the transport-layer port number to differentiate between concurrent connections.

Answer

Fixed port range NAT

Answer

One-to-one NAT

Answer

Central SNAT without overload

Question 7

An admin wants to allow traffic only from specific countries to access a web server. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. The Geography object (also known as a GeoIP object) in FortiGate allows firewall policies to permit or deny traffic based on the source or destination country. This is the correct choice because the requirement is to filter traffic by country, which is exactly what Geography objects are designed for, using IP-to-country mappings maintained by FortiGuard.

Answer

Subnet object

Answer

FQDN object

Answer

Wildcard FQDN object

Question 8

An administrator is troubleshooting an IPsec VPN that uses aggressive mode. The VPN establishes successfully, but the administrator is concerned about security. Which statement is true regarding aggressive mode?

Accepted Answer

Aggressive mode transmits the identification in clear text. In aggressive mode, the IKE phase 1 exchange uses three messages instead of six, and the peer's identity (such as the IP address or FQDN) is transmitted in cleartext during the second message before the secure tunnel is established. This exposes the identity to eavesdropping, making it less secure than main mode, which encrypts the identity after the tunnel is set up. The administrator's concern is valid because aggressive mode sacrifices identity protection for faster negotiation.

Answer

Aggressive mode is more secure than main mode

Answer

Aggressive mode provides perfect forward secrecy (PFS) by default

Answer

Aggressive mode uses six messages instead of three

Question 9

A FortiGate is configured with flow-based inspection and an IPS profile. The administrator runs 'diagnose ips session list' and sees many sessions with 'state=bypass'. What does this indicate?

Accepted Answer

The sessions are being offloaded to the NPU and are not inspected by IPS. When a FortiGate uses flow-based inspection, sessions that are offloaded to the Network Processor Unit (NPU) are not inspected by the IPS engine. The 'state=bypass' in the 'diagnose ips session list' output indicates that these sessions are being hardware-accelerated and bypassing the IPS inspection, which is normal behavior for traffic that meets offload criteria.

Answer

The IPS profile is configured with 'pass' action for all signatures

Answer

The IPS signatures have expired and are not being applied

Answer

The FortiGate is under DoS attack and is dropping sessions

Question 10

An administrator is troubleshooting why traffic from a specific subnet (192.168.10.0/24) to the internet is not being matched by the expected firewall policy. The policy list shows an allow policy for this traffic at ID 10, but there is a deny policy at ID 5 for any traffic from 192.168.0.0/16. Which TWO statements are correct?

Accepted Answer

The deny policy at ID 5 is matching the traffic before the allow policy at ID 10. FortiGate firewall policies are evaluated sequentially from top to bottom based on their policy ID. Since policy ID 5 (deny for 192.168.0.0/16) appears before policy ID 10 (allow for 192.168.10.0/24), traffic from 192.168.10.0/24 is matched by the broader deny policy first, and the allow policy is never reached. This is a fundamental behavior of FortiGate's policy lookup order.

Answer

The allow policy at ID 10 will override the deny policy because it is more specific

Answer

The traffic will be matched by the implicit deny at the end of the policy list

Answer

The administrator should enable 'policy override' on the allow policy

Question 11

A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?

Accepted Answer

No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions. When a FortiGate performs destination NAT (DNAT) via a VIP for inbound traffic, it automatically creates a session entry that includes the reverse NAT mapping. For return traffic from the internal server, the FortiGate uses this session to perform source NAT (SNAT) back to the original public IP (203.0.113.10). This is called 'implicit reverse NAT' and requires no additional configuration; the session state ensures the reply packets are correctly translated and forwarded to the external client.

Answer

Create a second VIP for the return traffic

Answer

Add a policy from DMZ to WAN allowing the internal server to reply

Answer

Configure static routing on the internal server to route through the FortiGate

Question 12

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

Accepted Answer

Enable SSH administrative access on the interface. To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Answer

Enable HTTPS administrative access only

Answer

Set the administrative access to 'any'

Answer

Configure a firewall policy allowing SSH from the subnet

Question 13

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The firewall policy has application control enabled and SSL deep inspection is not configured. Why is Facebook not blocked?

Accepted Answer

HTTPS traffic is encrypted and cannot be inspected without SSL deep inspection. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the application-layer payload. Application control relies on inspecting unencrypted traffic or using SSL inspection to identify applications within encrypted sessions. Since Facebook uses HTTPS, the encrypted traffic passes through without being matched against the application signature, so the block action is not enforced.

Answer

The application signature for Facebook is not updated

Answer

The application control profile is configured in monitor-only mode

Answer

Facebook uses a non-standard port that application control does not monitor

Question 14

An administrator configures a firewall policy with a schedule object that is set to 'Available: Mon-Fri 09:00-17:00'. At 10:00 AM on Saturday, users report they cannot access the resource. The administrator checks the policy list and sees the policy is enabled. What is the MOST likely reason?

Accepted Answer

The schedule object only allows traffic on weekdays, and Saturday is not included. The schedule object is configured to allow traffic only from Monday to Friday, 09:00-17:00. Since Saturday is outside this range, the firewall policy will deny or not match the traffic, even though the policy is enabled. This is the most direct and likely reason for the access failure.

Answer

The FortiGate's system time is incorrect

Answer

A deny policy with higher priority is blocking the traffic

Answer

The schedule object is not correctly applied to the policy

Question 15

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. An IP Pool in FortiGate allows you to override the source IP address for specific traffic, even when NAT is enabled on the policy. By creating an IP Pool with the single address 203.0.113.2 and referencing it in the firewall policy, traffic from 10.0.0.10 will be NATed to that specific IP instead of the outgoing interface address (203.0.113.1). This is the standard method for fixed source NAT (also called 'static NAT' or 'one-to-one NAT') for a specific host.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'