NSE4 Practice Test 18 — 15 Questions

Question 1

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Accepted Answer

diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80. 'diagnose firewall policy list' shows the policy list with IDs. 'diagnose firewall iprope' shows the lookup order and matching policy. 'get firewall policy' is a config command, not for real-time traffic. 'execute' commands are for pinging, not policy lookup.

Answer

execute ping 203.0.113.50

Answer

diagnose debug flow

Answer

get firewall policy

Question 2

A network admin runs 'diag sys session filter proto 6' and 'diag sys session list' and sees many sessions with state 'SYN_SENT' to a public web server. The firewall policy allows TCP/443. What is the MOST likely cause?

Accepted Answer

The destination NAT (VIP) for the web server is not configured. SYN_SENT indicates that the FortiGate has sent a SYN but not received a SYN-ACK, suggesting the server is not responding, possibly due to a missing DNAT or VIP configuration for inbound traffic.

Answer

The web server is overloaded and dropping connections

Answer

The policy is in proxy mode but should be flow mode

Answer

The firewall policy has session TTL set too low

Question 3

What is the order of evaluation for firewall policies on a FortiGate?

Accepted Answer

From top to bottom, first match. FortiGate evaluates policies from top to bottom in the policy list, and the first match is applied.

Answer

Random order

Answer

From bottom to top

Answer

By policy ID in ascending order

Question 4

An admin configures a central SNAT rule to translate source IP 10.0.0.0/24 to IP pool 203.0.113.1-203.0.113.10 using overload (PAT). A policy-based NAT on a specific policy also translates the same source to the interface IP. Traffic from 10.0.0.0/24 to the internet shows source IP as the interface IP, not from the IP pool. What is the reason?

Accepted Answer

Policy-based NAT overrides central SNAT rules. Policy-based NAT takes precedence over central SNAT. Since the policy has NAT enabled (policy-based), it overrides the central SNAT rule.

Answer

The central SNAT rule is disabled

Answer

The policy is using fixed port range

Answer

The IP pool is out of addresses

Question 5

An admin troubleshoots an issue where internal users cannot access an internal server using its public IP address. The server is published via a VIP. The admin has already verified that the firewall policy allows traffic from internal to the VIP. Which THREE checks should the admin perform to resolve the issue? (Choose three.)

Accepted Answer

Enable NAT reflection on the VIP. Common causes for hairpin NAT issues: NAT reflection not enabled, policy for internal to VIP missing (but already verified), or the VIP is not configured to allow internal traffic (i.e., not on the correct interface). Additionally, DNS resolution might point to the public IP, but internal DNS might need to return private IP. Also, the server might not be listening on the internal interface. The three most relevant: enable NAT reflection, ensure policy allows traffic, and check that the server is reachable via internal IP.

Answer

Configure the internal users to use the private IP directly

Answer

Change the VIP to use port forwarding

Question 6

Which of the following best describes the policy lookup order on a FortiGate firewall?

Accepted Answer

Policies are evaluated in the order they appear in the policy list, from top to bottom. FortiGate uses a top-down sequential match: the first policy that matches the traffic is executed, and subsequent policies are ignored.

Answer

Policies are evaluated based on the number of hits, least-hit first

Answer

Policies are evaluated randomly to balance load

Answer

The policy with the highest priority number is evaluated first

Question 7

An admin wants to block traffic from a specific geographic region (e.g., North Korea) from reaching the FortiGate's external interface. Which address object type should be used in the firewall policy?

Accepted Answer

Geography address object. FortiGate supports geography-based address objects that use IP geolocation databases to match traffic by country.

Answer

Subnet address object

Answer

FQDN address object

Answer

Wildcard FQDN address object

Question 8

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from subnet 10.0.0.0/24 through port1 and 10.0.1.0/24 through port2. However, traffic from 10.0.0.0/24 is still using port2. The PBR rule appears correctly configured. What is the MOST likely issue?

Accepted Answer

The firewall policy for that traffic has a route override setting that bypasses PBR. PBR rules are evaluated before routing table lookups. But if a firewall policy is matching the traffic before PBR (depending on configuration), the policy's route may override PBR. Also, PBR requires that the policy does not have a route override. Another common issue is that the policy's destination interface is set to auto or the wrong interface, causing the route table decision to take precedence. However, the most common mistake is that the policy created for that traffic has its 'policy-based routing' option disabled or is using a different routing method.

Answer

The source subnet in the PBR rule is incorrectly specified as 10.0.1.0/24

Answer

The static route for 0.0.0.0/0 has a higher administrative distance than the PBR rule

Answer

The PBR rule has a higher priority number than other rules

Question 9

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session that has been active for 1 hour and will expire in about 1 hour. The output shows a TCP session (proto=6) in state 01 (possibly ESTABLISHED or SYN_SENT), duration 3600 seconds, with 3599 seconds until expiry. It is a normal session.

Answer

The session is a TCP session that has been active for 1 hour and will expire immediately

Answer

The session is a UDP session that has been idle for 3600 seconds

Answer

The session is an ICMP session with a short timeout

Question 10

An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?

Accepted Answer

A traffic shaper object that defines bandwidth limits. Traffic shaping requires a shaping policy (or shaping rule) that matches the traffic, a traffic shaper that defines bandwidth limits, and optionally a per-IP shaper for per-user limiting.

Answer

A static route for the YouTube subnet

Answer

A schedule object to apply the shaper only during business hours

Question 11

An administrator is troubleshooting a connectivity issue where users in the 10.0.0.0/24 subnet cannot access the internet. The FortiGate has the following policies (in order):
1: allow 10.0.0.0/24 -> any, service: HTTP, HTTPS
2: deny any -> any, service: all
Users can browse HTTP but not HTTPS. Which TWO actions would resolve the issue?

Accepted Answer

Verify that the HTTPS service object is correctly defined and not misspelled. Policy 1 only allows HTTP and HTTPS. If HTTPS is not working, check if HTTPS is correctly defined. Also, policy 2 denies all other traffic. The solution is to ensure HTTPS is allowed in policy 1 and that it is correctly defined.

Answer

Create a new policy above policy 1 allowing all traffic from 10.0.0.0/24

Answer

Move policy 2 above policy 1

Answer

Check if the HTTPS service object includes both TCP/443 and TCP/8443

Question 12

An administrator needs to allow internal users to access a public web server using the server's private IP address, while external users access it via a public IP. Which TWO components are required?

Accepted Answer

A VIP (Virtual IP) mapping the public IP to the private IP. To allow internal users to access the server via private IP, a firewall policy must allow the traffic. To allow external users, a VIP is used to map the public IP to the private IP, and a corresponding policy is needed.

Answer

Central SNAT policy

Answer

An IP pool for source NAT

Answer

A static route on the FortiGate for the public IP

Question 13

An administrator wants to apply policy-based routing (PBR) to route traffic from a specific subnet through a different ISP. Which TWO elements must be configured?

Accepted Answer

A policy route object with source subnet and gateway. PBR uses policy routes that define a source and destination, and a gateway/interface. A policy route is created, and the traffic must be allowed by a firewall policy (maybe using the same criteria).

Answer

A static route with a higher distance

Answer

An SD-WAN rule

Answer

A VIP to change the destination

Question 14

A FortiGate administrator needs to allow all internal users (10.0.0.0/8) to access a web server in the DMZ (192.168.1.100) using HTTPS. The administrator wants to apply a web filter profile to block malicious URLs while allowing legitimate traffic. Which of the following is the correct policy configuration?

Accepted Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=ACCEPT, web filter profile=default. To allow HTTPS traffic from internal to DMZ with web filtering, the policy must have source=internal_network, destination=DMZ_server, service=HTTPS, action=ACCEPT, and the web filter profile applied. The other options either block the traffic, use the wrong service, or misapply the profile.

Answer

Policy: source=internal, destination=DMZ, service=ALL, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTP, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=DENY, web filter profile=default

Question 15

An administrator is troubleshooting why traffic from a specific VLAN (192.168.10.0/24) to the internet is not being NATed correctly. The firewall policy allows the traffic with NAT enabled and uses an IP Pool (overload) for the source translation. The IP Pool is configured with the address 203.0.113.10. However, the traffic still shows the original source IP. Which THREE of the following could cause this issue? (Choose three.)

Accepted Answer

The firewall policy does not have the IP Pool selected in the NAT section. Possible causes: The policy may not have the IP Pool selected in the NAT settings; the policy order might be incorrect if another policy matches first; the IP Pool might be assigned to the wrong interface or contain a different IP range; or the traffic might be matching a different policy that doesn't use NAT. Central SNAT rules could also override, but the question specifies policy-based NAT.

Answer

There is a Central SNAT rule with higher priority that does not match the traffic

Answer

The IP Pool uses one-to-one NAT instead of overload