NSE4 Practice Test 17 — 15 Questions

Question 1

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The session is a TCP (proto=6) session, state 01 means TCP SYN sent, duration 3600 seconds indicates it has been up for 1 hour, expire 3599 means it will expire in about 3599 seconds (almost 1 hour from now). Option C is correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP

Question 2

An admin wants to apply different QoS markings to traffic from two different departments. The admin creates two firewall policies: one for Sales (policy ID 1) and one for Engineering (policy ID 2). Both policies have traffic shaping enabled. However, traffic from both departments receives the same QoS marking. What is the MOST likely mistake?

Accepted Answer

The admin applied the same traffic shaper to both policies. The traffic shaping policy must be associated with the firewall policy. If the same traffic shaper is applied to both policies, they will get the same markings. The question implies different markings are desired, so the admin likely used the same shaper.

Answer

The policies are in the wrong order

Answer

QoS marking is only applied at the interface level

Answer

The traffic shaping policy is applied globally

Question 3

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

Accepted Answer

The firewall policy action is set to DENY. The implicit deny policy at the end of the policy list will drop traffic that does not match any explicit policy. If the policy is not the last matching policy or if there is a deny policy above it, traffic could be denied. But the most common issue is that the policy is not correctly ordered, and a deny policy above it is matching. However, the stem says packets hit the policy but are dropped. This typically indicates that the policy matched but another factor (like security profile action) dropped it, or the policy's action is set to DENY by mistake. Given the options, the admin likely set the policy action to DENY.

Answer

The interface is not configured as a WAN interface

Answer

The policy is disabled

Answer

The traffic is being processed by a higher priority deny policy

Question 4

When creating a firewall policy, an admin wants to ensure that traffic from a specific user group is allowed only during business hours (Monday to Friday, 09:00-18:00). Which object type must be configured and applied to the policy?

Accepted Answer

A schedule object with a recurring schedule. Schedule objects define time-based conditions. A recurring schedule can be set for weekdays and specific hours.

Answer

A security profile with time-based filtering

Answer

A user group object with time restrictions

Answer

A traffic shaping policy with a time-based rule

Question 5

A FortiGate admin configures an IP pool with type 'Fixed Port Range' to translate source IPs from 192.168.1.0/24 to 203.0.113.0/28 using port range 10000-20000. After applying the IP pool to a policy, some users cannot establish connections while others work. What is the MOST likely cause?

Accepted Answer

The IP pool's port range is exhausted because the number of internal hosts exceeds the number of available port ranges. Fixed port range assigns a unique port range per internal IP. If the number of internal hosts exceeds the number of available port ranges, no range will be available for new hosts, causing failures.

Answer

The internal subnet is using RFC 1918 addresses that cannot be NATed

Answer

The IP pool is configured with overload enabled, causing conflicts

Answer

The firewall policy has NAT disabled

Question 6

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy needs to identify the source (VPN users) and destination (web server). Address objects for the VPN subnet and the web server IP are required.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 7

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

Accepted Answer

Overload NAT. Overload NAT (Port Address Translation) allows many internal IPs to share one public IP by using unique source ports.

Answer

Central SNAT

Answer

One-to-one NAT

Answer

Fixed port range NAT

Question 8

An admin needs to allow traffic from a specific IP to a web server on port 8080. The web server is behind a VIP that forwards port 80 to port 8080. When configuring the security policy, which destination should be used?

Accepted Answer

The VIP object. When using VIP, the security policy destination should reference the VIP object, not the real server IP. The VIP handles the translation of destination IP and port.

Answer

The virtual IP address of the FortiGate

Answer

The real server IP address

Answer

Any destination, because the VIP translates automatically

Question 9

A FortiGate has two firewall policies for HTTP traffic to the internet: Policy A (source: 10.0.1.0/24) and Policy B (source: 10.0.2.0/24). Both policies have the same destination and service. The admin wants to apply a traffic shaper to limit bandwidth for Policy B. Which TWO actions are correct? (Choose two.)

Accepted Answer

Create a traffic shaping policy that matches Policy B's source and apply the shaper. To apply a traffic shaper to a specific policy, you need to either select the shaper in the policy configuration, or use a traffic shaping policy. Also, ensure that the shaping policy is enabled and applied correctly.

Answer

Apply the shaper to both policies and use a different shaper for Policy B

Answer

Use a QoS queue on the outgoing interface

Answer

Enable traffic shaping on the VDOM

Question 10

An admin needs to create a firewall policy that allows SMTP traffic (TCP/25) from the internal network (10.0.0.0/24) to a mail server in the DMZ (172.16.1.10). Additionally, the admin wants to ensure that the mail server can only be accessed by the internal network, not from the internet. Which THREE settings must be configured in the firewall policy? (Choose three.)

Accepted Answer

Source interface set to 'internal'. To define the traffic, the policy needs source interface (internal), destination interface (DMZ), source address (internal subnet), and destination address (mail server). Also, the service must be SMTP. Additionally, to block internet access, the policy from DMZ to internet should not exist, but the question asks for settings in the policy for internal traffic. The three required are source interface, destination interface, and service. Address objects are also required but the question asks for settings, not objects. However, the options include interface and service settings.

Answer

Set schedule to 'always'

Answer

Enable NAT to translate source IP

Question 11

An administrator needs to allow FTP traffic from the internal network to a specific server on the internet. The FTP server uses passive mode. Which service object should be used in the firewall policy to ensure proper operation?

Accepted Answer

Use the predefined 'FTP' service object and also allow a high port range (e.g., TCP/1024-65535). FTP uses TCP/21 for control. Passive mode uses a range of high ports for data. A generic FTP service object may include TCP/21 and TCP/20 (active mode). For passive, a custom service with TCP/21 and the data port range is needed, but the question asks which service object to use. Typically, the predefined 'FTP' service includes TCP/21 only. Many deployments create a custom service for passive. However, the best answer is to use the FTP service and also allow the ephemeral port range.

Answer

Use a custom service object with TCP/21 and TCP/20

Answer

Use the predefined 'FTP' service object

Answer

Use the 'ALL' service object

Question 12

An administrator needs to block access to a specific website using FQDN address objects. Which TWO steps are necessary?

Accepted Answer

Create an FQDN address object for the website. To block by FQDN, you create an address object with the FQDN, then use it in a firewall policy with action DENY.

Answer

Create a wildcard FQDN address object

Answer

Configure a DNS filter to block the FQDN

Answer

Create a VIP for the website

Question 13

A FortiGate administrator is configuring a firewall policy to allow inbound HTTPS traffic from the internet to an internal web server. The web server has a private IP address 10.0.0.10. The administrator wants to translate the destination IP to the internal server using a Virtual IP (VIP). Which TWO of the following must be configured for the VIP to work correctly? (Choose two.)

Accepted Answer

The VIP must have the external IP set to a public IP address assigned to the FortiGate's WAN interface. A VIP requires mapping an external IP/port to an internal IP/port. The firewall policy must reference the VIP as the destination and use the VIP's mapped port if different from the incoming port. The VIP must have the correct external IP (the FortiGate's public IP) and internal IP (10.0.0.10). Option C is unnecessary if the external and internal ports are the same (443->443). Option E is for source NAT, not destination NAT.

Answer

An IP Pool must be configured for the web server's return traffic

Answer

The VIP must have port forwarding enabled with the external and internal ports set to 443

Answer

The firewall policy must have NAT enabled

Question 14

An administrator is configuring policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet (172.16.1.0/24) through a different internet connection (wan2) instead of the default route via wan1. The administrator has created a PBR rule matching source 172.16.1.0/24 and set the gateway to the next-hop IP on wan2. The traffic is still using wan1. Which THREE of the following could be causing the issue? (Choose three.)

Accepted Answer

The PBR rule's gateway is not reachable from the FortiGate. PBR requires the rule to be enabled, the gateway to be reachable, and the rule's priority to be higher (lower number) than other routes. Also, the PBR must be applied to the correct incoming interface. If the interface is wrong, or the gateway is unreachable, or the rule is disabled, PBR will not work.

Answer

The PBR rule's priority is set too high (e.g., 100) and a static route with lower priority is used instead

Answer

The PBR rule's destination is set to 'all' but the traffic's destination is not covered

Question 15

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from a specific subnet out of a particular interface. The admin also has a firewall policy allowing that subnet to the internet. However, the traffic is not being routed as expected. What could be the issue?

Accepted Answer

The PBR rule uses an incorrect source or destination address. Policy-based routing is evaluated after the routing table lookup but before firewall policy matching. If the PBR rule is incorrectly configured (e.g., wrong source/destination), traffic may take a different path. Another common issue is that PBR might conflict with the default route. The question asks for the most likely issue — often it's that the PBR rule is not matching the traffic.

Answer

The firewall policy is placed above the PBR rule

Answer

The PBR rule does not have a matching protocol or service defined

Answer

The FortiGate is in transparent mode