NSE4 Practice Test 18 — 15 Questions

Question 1

Drag and drop the steps to capture traffic on a FortiGate interface using the CLI into the correct order.

Accepted Answer

Step 1: Specify the interface, Step 2: Specify the filter, Step 3: Specify the verbose level, Step 4: Specify the count. The sniffer command syntax is diagnose sniffer packet .

Answer

Step 1: Specify the filter, Step 2: Specify the interface, Step 3: Specify the verbose level, Step 4: Specify the count

Answer

Step 1: Specify the interface, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the count

Answer

Step 1: Specify the count, Step 2: Specify the verbose level, Step 3: Specify the filter, Step 4: Specify the interface

Question 2

A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?

Accepted Answer

Policy ID 1 because it is the first matching policy in the list. Policy ID 1 is correct because FortiGate uses a sequential, first-match policy evaluation model. Traffic from 10.0.1.10 to 203.0.113.5 matches the source and destination of Policy ID 1 exactly, and since it appears first in the policy list, it is applied immediately. Once a match is found, no further policies are evaluated, even if a later policy (like Policy ID 2) also matches.

Answer

Both policies will be applied because the traffic matches both

Answer

Policy ID 2 because it has a broader destination and is more inclusive

Answer

Neither policy; implicit deny will block the traffic

Question 3

A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization is not enabled. In an active-passive FortiGate HA cluster, the primary unit synchronizes session state (including TCP session tables) to the secondary unit so that upon failover, established sessions can continue without interruption. If session synchronization is not enabled, the secondary unit has no knowledge of existing sessions, so when it takes over, it drops all established TCP sessions because it has no session entries for them. Thus, the most likely cause is that session synchronization is disabled.

Answer

The HA failover threshold is set too high

Answer

The HA mode is active-passive

Answer

The heartbeat interface is down

Question 4

Which type of log records information about firewall policy matches, such as allowed or denied traffic?

Accepted Answer

Traffic logs. Traffic logs in FortiGate record information about firewall policy matches, including allowed and denied traffic. They provide details such as source and destination IP addresses, ports, protocols, and the action taken by the firewall policy. This is the primary log type used for analyzing policy enforcement and troubleshooting connectivity issues.

Answer

Security logs

Answer

Event logs

Answer

Audit logs

Question 5

An administrator needs to block access to specific websites based on their FQDN (e.g., *.example.com). The FortiGate should match the destination domain regardless of the IP address the domain resolves to. Which type of address object should the admin use in the firewall policy destination?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.

Answer

Geography object

Answer

Subnet object

Answer

FQDN object

Question 6

A FortiGate is configured in an HA active-passive cluster. When the active unit fails, the passive unit takes over, but IPsec VPN tunnels fail to re-establish. The configuration is synchronized. What is the most likely cause?

Accepted Answer

The IPsec VPN is using the physical interface IP instead of a virtual IP (VIP) or floating IP.. In an HA active-passive cluster, IPsec VPN tunnels typically bind to the physical interface IP address. When failover occurs, the passive unit assumes the cluster's virtual MAC and IP addresses, but the IPsec tunnel endpoints remain tied to the original physical IP. Since the new active unit has a different physical interface IP, the remote peer sees a mismatched source address and drops the connection. Using a virtual IP (VIP) or floating IP ensures the tunnel endpoint stays consistent across failover.

Answer

The pre-shared key is different on the two units.

Answer

The firewall policies for VPN traffic are not synchronized.

Answer

The HA heartbeat interface is down.

Question 7

Which of the following best describes a Virtual IP (VIP) in FortiGate?

Accepted Answer

A method to translate a public IP/port to a private IP/port for inbound traffic. A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Answer

A method to translate private source IPs to a public IP for outbound traffic

Answer

A method to group multiple firewall policies

Answer

A method to load balance traffic across multiple WAN interfaces

Question 8

You run the following command on a FortiGate: diagnose vpn ike gateway list. The output shows a gateway with state=DOWN. What is the most likely cause?

Accepted Answer

The remote peer is not reachable or is blocking IKE traffic. The `state=DOWN` in the `diagnose vpn ike gateway list` output indicates that the IKE Phase 1 (main mode or aggressive mode) negotiation has failed or never completed. The most common cause is that the remote peer is unreachable (e.g., due to network issues, firewall rules blocking UDP ports 500/4500, or incorrect peer IP configuration) or that the remote peer is actively blocking IKE traffic, preventing the initial exchange of IKE SA proposals.

Answer

The pre-shared key is correct but expired

Answer

The IPsec Phase 2 parameters are mismatched

Answer

The local certificate is not trusted by the remote peer

Question 9

A FortiGate administrator needs to ensure that a specific traffic flow is fully inspected by the antivirus and IPS profiles. The traffic is HTTPS. Which THREE configuration items are required? (Select three.)

Accepted Answer

Apply an IPS profile to the firewall policy. Option B is correct because an IPS profile must be attached to the firewall policy for the FortiGate to inspect the traffic flow for intrusions and exploits. Option C is correct because an antivirus profile must also be applied to the firewall policy so that the same traffic is scanned for malware and viruses. Option D is correct because the traffic is HTTPS, so SSL/TLS deep inspection must be enabled on the firewall policy to decrypt the traffic and allow the antivirus and IPS engines to inspect the payload. Option A is not required because flow-based inspection mode is a global inspection setting and is not a mandatory item for applying antivirus and IPS profiles to a specific HTTPS policy. Option E is not required because a DNS filter profile is used for DNS security filtering and does not enable antivirus or IPS inspection of HTTPS traffic.

Answer

Enable flow-based inspection mode globally

Answer

Configure a DNS filter profile

Question 10

Which security profile type requires a FortiSandbox license to enable advanced detection features?

Accepted Answer

Antivirus. The Antivirus security profile (Option C) is correct because FortiGate's advanced antivirus features, such as outbreak prevention and cloud-based pattern matching, require a FortiSandbox license to offload suspicious files for dynamic analysis. Without this license, the antivirus engine relies solely on local signatures and cannot leverage sandboxing for zero-day threat detection.

Answer

Application Control

Answer

DNS Filter

Answer

Web Filter

Question 11

A FortiGate is configured with SSL inspection and web filtering. The administrator notices that some HTTPS traffic is being blocked even though the URL is in an allowed category. What could be the cause?

Accepted Answer

The SSL inspection profile has 'certificate-validation-failed' action set to 'block'.. When SSL inspection is enabled, the FortiGate acts as a man-in-the-middle and validates the server's certificate. If the certificate is invalid (e.g., expired, self-signed, or mismatched), the FortiGate can block the session based on the 'certificate-validation-failed' action in the SSL inspection profile. Even if the URL belongs to an allowed web filter category, a failed certificate validation will cause the traffic to be blocked before the web filter policy is applied.

Answer

The FortiGate's DNS server is not resolving the domain correctly.

Answer

The web filter's 'allow' list is misconfigured.

Answer

The web filter profile has 'safe-search' enabled.

Question 12

A FortiGate administrator configures an SSL VPN web mode portal. Users can access internal web applications but cannot access internal file shares via SMB. What is the most likely reason?

Accepted Answer

Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares. SSL VPN web mode operates as a reverse proxy, translating HTTP/HTTPS traffic only. SMB (Server Message Block) is a non-web protocol that requires direct network-layer connectivity, which web mode cannot provide. Tunnel mode creates a virtual network interface that allows any IP-based protocol, including SMB, to traverse the VPN. Therefore, the correct solution is to use tunnel mode for file share access.

Answer

The SSL VPN policy does not allow SMB traffic

Answer

The fileserver requires client certificates for authentication

Answer

The firewall policy for SSL VPN is configured with the wrong interface

Question 13

An administrator wants to send logs from a FortiGate to an external syslog server. Which log forwarding method should they configure?

Accepted Answer

Syslog. FortiGate supports external log forwarding via syslog, which is the standard protocol for sending event and traffic logs to a remote server. Configuring syslog on the FortiGate involves specifying the server IP, port (default 514), and facility, and it allows the FortiGate to send logs in a structured format that can be parsed by SIEM or log management tools. SMTP is for email alerts, NetFlow is for traffic flow metadata, and SNMP is for monitoring and traps, not for general log transport.

Answer

SMTP

Answer

NetFlow

Answer

SNMP

Question 14

What is the purpose of enabling 'DNS filter' in a security profile?

Accepted Answer

To block DNS queries to known malicious domains. FortiGate's DNS filter security profile inspects DNS queries and blocks those destined for domains categorized as malicious (botnets, phishing, malware C2) using FortiGuard's DNS threat intelligence. This prevents clients from resolving and reaching known-bad domains, cutting off the first step of many attacks.

Answer

To cache DNS responses for faster browsing

Answer

To prevent DNS tunneling attacks

Answer

To enforce safe search on search engines

Question 15

A FortiGate administrator needs to ensure that traffic logs are sent to a FortiAnalyzer even when the FortiGate's local disk is full. What configuration is required?

Accepted Answer

Enable 'remote log' under Log Settings and specify the FortiAnalyzer IP. To ensure logs are sent to FortiAnalyzer even when the local disk is full, the administrator must enable remote logging under Log Settings and specify the FortiAnalyzer IP. This configures the FortiGate to send logs to the remote server independently of local disk status.

Answer

Enable 'disk logging' with rollover policy

Answer

Increase the log severity to 'emergency' only

Answer

Configure a log filter to send only security logs