NSE4 Practice Test 17 — 15 Questions

Question 1

An administrator is troubleshooting an IPsec VPN tunnel that is not establishing. The Phase 1 status shows 'down'. Which TWO commands can help diagnose the issue? (Choose TWO.)

Accepted Answer

diagnose debug application ike -1. The 'diagnose debug application ike -1' command enables real-time IKE (Internet Key Exchange) debugging, which is essential for troubleshooting Phase 1 failures. This command captures IKEv1/v2 negotiation messages, including proposals, pre-shared key mismatches, and authentication errors, directly showing why the tunnel is down.

Answer

diagnose npu np6 ipsec-sa list

Answer

diagnose sys session clear

Answer

diagnose vpn tunnel list

Question 2

A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?

Accepted Answer

The fixed port range is too small, causing port exhaustion. The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Answer

The external server is rate-limiting connections

Answer

The firewall policy has a timeout setting that is too low

Answer

The IP pool has run out of IP addresses

Question 3

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

Accepted Answer

The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.. When the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Answer

The SD-WAN zone does not include the backup interface wan2.

Answer

The static routes have the same distance, so failover does not occur.

Answer

The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.

Question 4

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The Phase 1 status shows 'init' and then resets. The administrator runs 'diagnose debug application ike -1' and sees the message 'no acceptable proposal'. Which TWO parameters are MOST likely mismatched?

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The 'no acceptable proposal' error during IKE Phase 1 indicates a mismatch in the security proposal parameters that the two peers exchange to establish the SA. The encryption algorithm (e.g., AES256 vs AES128) and Diffie-Hellman group (e.g., group 14 vs group 2) are both part of the Phase 1 proposal; if either differs between peers, the negotiation fails and the status resets to 'init'.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)

Question 5

A FortiGate administrator is troubleshooting an issue where users cannot access a legitimate website that is categorized as 'Pornography' by FortiGuard. The web filter profile is configured to block that category. The administrator wants to allow access for a specific user group without modifying the global web filter profile. What is the BEST approach?

Accepted Answer

Create a separate firewall policy for that user group with a web filter profile that allows the category. It allows the administrator to create a separate firewall policy for the specific user group that uses a web filter profile configured to allow the 'Pornography' category. This approach overrides the global web filter profile for that group without modifying the original profile, leveraging FortiGate's policy-based security profile assignment.

Answer

Change the FortiGuard category rating for the website to 'Unrated'

Answer

Create a URL filter exemption for the website in the same web filter profile

Answer

Disable web filtering for that website in the global settings

Question 6

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

Accepted Answer

Enable SSH administrative access on the interface. To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Answer

Enable HTTPS administrative access only

Answer

Set the administrative access to 'any'

Answer

Configure a firewall policy allowing SSH from the subnet

Question 7

A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?

Accepted Answer

A ZTNA rule (policy) that specifies access conditions. A ZTNA rule (policy) is essential to define the access conditions, such as user identity, device posture, and source IP, that must be met before granting access to the internal application. This policy enforces the zero-trust principle of 'never trust, always verify' by evaluating these conditions in real time.

Answer

A FortiClient EMS server

Answer

An IPsec VPN tunnel to the client

Answer

A static route to the application server

Question 8

What is the primary purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To provide a stable IP address for management and routing protocols. A loopback interface on a FortiGate is a virtual interface that is always up, independent of physical link states. It provides a stable and reachable IP address for management access (e.g., HTTPS, SSH) and for routing protocols like OSPF or BGP to use as the router ID or source interface, ensuring consistent connectivity even if physical interfaces fail.

Answer

To aggregate bandwidth from multiple physical interfaces

Answer

To enable NAT for internal networks

Answer

To increase the number of available physical ports

Question 9

An administrator wants to synchronize the FortiGate's time with a reliable NTP server. After configuring the NTP server, they notice the time is still incorrect. What could be the issue?

Accepted Answer

The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself. By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.

Answer

The NTP server is not reachable due to a missing route

Answer

The FortiGate does not support NTP

Answer

The NTP server is not configured correctly

Question 10

A FortiGate admin is configuring a dial-up IPsec VPN for remote users. The users have dynamic IP addresses. Which Phase 1 configuration is appropriate?

Accepted Answer

Set the remote gateway to 'Dialup User' and enable an IP pool. For dial-up IPsec VPNs where remote users have dynamic IP addresses, the FortiGate cannot know the remote gateway IP in advance. Setting the remote gateway to 'Dialup User' allows the FortiGate to accept connections from any IP, and enabling an IP pool assigns a static internal IP to the remote user for routing and policy enforcement.

Answer

Disable XAuth authentication

Answer

Set the remote gateway to the user's IP address

Answer

Use aggressive mode with a group pre-shared key

Question 11

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Accepted Answer

The phase2 configuration does not specify the local and remote subnets to protect.. The phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

Answer

The phase1 keylife is longer than the phase2 keylife, causing rekey issues.

Answer

The 'set net-device disable' prevents the tunnel from being used for routing.

Answer

The phase2 proposal does not match the phase1 proposal.

Question 12

An administrator is configuring a dial-up IPsec VPN for remote users. Which TWO settings are required on the FortiGate for the dial-up server? (Choose two.)

Accepted Answer

Set 'mode-cfg' to enable on Phase 1. 'mode-cfg' (Mode Config) enables the FortiGate to assign IP addresses and other network settings to remote VPN clients dynamically, which is essential for a dial-up IPsec VPN server. Option B is correct because setting 'peer type' to 'any' allows the FortiGate to accept connections from any remote peer without predefining a specific peer IP, which is required for a dial-up scenario where remote users have dynamic IP addresses.

Answer

Set 'aggressive mode' on Phase 1

Answer

Set 'auto-negotiate' to enable on Phase 2

Answer

Set 'pfs' to enable on Phase 2

Question 13

A FortiGate has policy-based NAT enabled. The admin wants to translate the source IP of internal users to the interface IP for internet traffic. The firewall policy has NAT enabled. However, traffic from the internal network to the internet shows the original source IP instead of the interface IP. What is the MOST likely reason?

Accepted Answer

Central NAT is enabled and overrides the per-policy NAT setting. When policy-based NAT is enabled, the per-policy NAT setting should translate the source IP to the interface IP. However, if Central NAT is also enabled, it takes precedence and overrides the per-policy NAT configuration. Central NAT uses its own rules (e.g., IP pools) and can prevent the interface IP translation from being applied, leaving the original source IP unchanged.

Answer

The destination is a VIP that disables NAT

Answer

The NGFW mode is set to profile-based

Answer

The policy is configured in proxy inspection mode

Question 14

Which statement best describes the 'implicit deny' policy on a FortiGate?

Accepted Answer

It is automatically applied to all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a built-in, last-resort rule that automatically denies any traffic not matching an explicit firewall policy. It is not visible in the policy list and cannot be moved, modified, or deleted; it is always applied as the final rule to ensure that only explicitly permitted traffic is allowed through the FortiGate.

Answer

It can be moved to a different position in the policy list

Answer

It is a configurable policy that denies all traffic

Answer

It logs all denied traffic by default

Question 15

You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?

Accepted Answer

Ensure the tunnel interface is added to the BGP neighbor configuration. When Phase 2 is up and 'diagnose debug ipsec' shows no errors, the IPsec tunnel is functioning correctly at the encryption layer. The BGP session failing to establish typically indicates a routing or interface configuration issue. Option C is correct because the tunnel interface must be explicitly added to the BGP neighbor configuration (e.g., 'config router bgp -> config neighbor -> set interface <tunnel>') so that BGP knows to send its TCP packets (port 179) over that specific tunnel interface; without this, BGP may try to use the physical interface instead, causing the session to fail.

Answer

Disable anti-replay on the tunnel

Answer

Enable NAT traversal

Answer

Check the Phase 1 proposal