NSE4 Practice Test 18 — 15 Questions

Question 1

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 2

An administrator runs 'diagnose debug application fnbamd -1' on a FortiGate to troubleshoot authentication issues. The output shows that the FortiGate successfully contacts the LDAP server but the user authentication fails. What does this indicate?

Accepted Answer

The user's password is incorrect or the user account is locked. The 'diagnose debug application fnbamd -1' output shows successful contact with the LDAP server, meaning network connectivity and server reachability are fine. Since the server is reachable but authentication fails, the most likely cause is that the user's credentials (password) are incorrect or the account is locked/disabled on the LDAP server. This is a standard LDAP bind failure scenario where the server returns an 'invalid credentials' or 'account locked' error.

Answer

The LDAP server is unreachable

Answer

The LDAP bind user password is incorrect

Answer

The LDAP schema does not match what FortiGate expects

Question 3

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.

Question 4

What is the function of an IPS 'protocol decoder'?

Accepted Answer

Parse and normalize protocol traffic to improve detection accuracy. An IPS protocol decoder parses and normalizes traffic for a specific protocol (e.g., HTTP, SMB, DNS) to reconstruct the application-layer data stream. This normalization strips away evasion techniques like chunked encoding or whitespace obfuscation, allowing the IPS to match attack signatures against the true payload, which significantly improves detection accuracy.

Answer

Encode traffic to prevent attacks

Answer

Rate-limit traffic based on protocol

Answer

Decrypt SSL traffic for inspection

Question 5

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from subnet 10.0.0.0/24 through port1 and 10.0.1.0/24 through port2. However, traffic from 10.0.0.0/24 is still using port2. The PBR rule appears correctly configured. What is the MOST likely issue?

Accepted Answer

The firewall policy for that traffic has a route override setting that bypasses PBR. The 'route override' setting in a firewall policy allows the FortiGate to ignore policy-based routing (PBR) rules for matching traffic. When enabled, the firewall policy uses the routing table (e.g., static or dynamic routes) instead of PBR, which explains why traffic from 10.0.0.0/24 is still using port2 despite a correctly configured PBR rule. This is a common misconfiguration where PBR appears correct but is overridden by the firewall policy's route override option.

Answer

The source subnet in the PBR rule is incorrectly specified as 10.0.1.0/24

Answer

The static route for 0.0.0.0/0 has a higher administrative distance than the PBR rule

Answer

The PBR rule has a higher priority number than other rules

Question 6

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 7

An administrator has configured an IPS profile with an anomaly detection sensor for 'tcp_syn_flood'. After applying the profile to a firewall policy, users report intermittent connectivity issues. The administrator runs 'diagnose ips anomaly list' and sees entries for 'tcp_syn_flood' with action 'pass'. What is the MOST likely cause of the connectivity issues?

Accepted Answer

The anomaly sensor is not actually applied; the list shows default entries. The 'diagnose ips anomaly list' command shows default entries for 'tcp_syn_flood' with action 'pass' only when no custom anomaly sensor is applied to the policy. The administrator configured an IPS profile with an anomaly detection sensor, but if the profile is not correctly attached to the firewall policy or the sensor is not enabled, the firewall falls back to default anomaly entries that are set to 'pass' (i.e., no blocking). The intermittent connectivity issues are therefore not caused by the anomaly sensor blocking traffic, but by another misconfiguration or unrelated network problem.

Answer

The anomaly sensor is set to 'block' but the action is overridden by the policy

Answer

The anomaly sensor is using a different action than expected; it might be set to 'block' for some other sensor

Answer

The anomaly sensor is set to 'pass' but the threshold is too low, causing false positives

Question 8

An administrator has configured an SSL VPN. Remote users can connect and authenticate but cannot access internal resources. The SSL VPN policy allows all traffic from the SSL VPN interface to internal servers. What is the MOST likely missing configuration?

Accepted Answer

The firewall policy allowing traffic from SSL VPN interface to internal network is missing. The most likely missing configuration is a firewall policy that explicitly permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network. Even with an SSL VPN policy allowing traffic, FortiGate requires a separate firewall policy to control and allow the decrypted traffic to reach internal resources. Without this policy, packets are dropped by the implicit deny rule.

Answer

The remote user's client does not support split tunneling

Answer

The authentication timeout is too short

Answer

The SSL VPN portal does not have the correct bookmark configured

Question 9

A network administrator notices that after configuring a new static route on a FortiGate, traffic to a remote subnet is still being forwarded via the default route. The administrator confirms the static route is present in the routing table with a lower distance than the default route. What is the MOST likely cause?

Accepted Answer

The static route's gateway is not reachable via any interface.. If the gateway specified in the static route is not reachable via any interface (e.g., the next-hop IP is not on a directly connected subnet or there is no ARP resolution), FortiGate will not install the route in the forwarding information base (FIB). The route may appear in the routing table but will be marked as inactive, causing traffic to still use the default route with a higher distance. FortiGate requires the next-hop to be reachable on a directly connected interface for the static route to be active.

Answer

The static route is disabled by a firewall policy.

Answer

The static route is configured with a higher priority than the default route.

Answer

The static route's destination subnet overlaps with a directly connected subnet.

Question 10

Which of the following is the default action of a FortiGate firewall policy if no policy matches the traffic?

Accepted Answer

Deny. FortiGate firewall policies operate on a 'first-match' basis, and if no policy matches the traffic, the default action is to deny the traffic. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall. The implicit deny rule is automatically applied at the end of the policy list and cannot be removed or modified.

Answer

Log and drop

Answer

Redirect to authentication

Answer

Accept

Question 11

A FortiGate administrator has configured an Application Control profile to block 'P2P' applications. However, users are still able to use BitTorrent. What is the MOST likely reason?

Accepted Answer

The firewall policy does not have SSL deep inspection enabled, and BitTorrent is using encryption. BitTorrent often uses encryption (e.g., MSE/PE protocol encryption) to evade detection. Without SSL deep inspection, the FortiGate cannot decrypt the traffic to inspect the application payload, so Application Control signatures for BitTorrent may not match the encrypted flows. Enabling SSL deep inspection on the firewall policy allows the FortiGate to decrypt the traffic and apply the 'Block' action effectively.

Answer

The Application Control profile is configured in 'Monitor' mode instead of 'Block'

Answer

The BitTorrent signatures are not included in the FortiGate firmware

Answer

The Application Control profile is applied to the wrong direction

Question 12

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Accepted Answer

Verify that the firewall policy between the SSL VPN interface and the internal network allows the traffic. Even if the SSL VPN policy permits access to the internal subnet, traffic must still traverse a firewall policy from the SSL VPN interface (e.g., ssl.root) to the internal network interface. Without an explicit firewall policy allowing the traffic, the FortiGate will drop the packets, preventing resource access. This is a common oversight because the SSL VPN policy only controls tunnel establishment and route injection, not the actual forwarding of traffic between zones.

Answer

Check the routing table on the FortiGate for the internal subnet

Answer

Ensure the users have the correct client software installed

Answer

Check the FortiGate's DNS settings

Question 13

A FortiGate administrator runs 'diagnose vpn tunnel list' and sees the following output for an IPsec tunnel: 'status: up', 'incoming: 0 packets', 'outgoing: 100 packets'. Phase 1 and Phase 2 both show state 'up'. What is the MOST likely cause of zero incoming packets?

Accepted Answer

The Phase 2 proposal includes a mismatched proxy ID. The output shows the VPN tunnel is up with outgoing packets but zero incoming packets. This indicates a Phase 2 mismatch, most commonly due to mismatched proxy IDs (local/remote subnets). When proxy IDs do not match between peers, the tunnel establishes but traffic is not correctly matched, causing the remote gateway to drop or not send traffic to the FortiGate, resulting in zero incoming packets.

Answer

The remote gateway is using aggressive mode

Answer

The FortiGate has a static route pointing to the VPN interface

Answer

The VPN is configured in policy-based mode

Question 14

An administrator configures an application control profile to block 'Facebook' and 'Twitter' using application signatures. Users can still access Facebook via HTTPS. The firewall policy has application control enabled and SSL deep inspection is not configured. Why is Facebook not blocked?

Accepted Answer

HTTPS traffic is encrypted and cannot be inspected without SSL deep inspection. Without SSL deep inspection, the FortiGate cannot decrypt HTTPS traffic to inspect the application-layer payload. Application control relies on inspecting unencrypted traffic or using SSL inspection to identify applications within encrypted sessions. Since Facebook uses HTTPS, the encrypted traffic passes through without being matched against the application signature, so the block action is not enforced.

Answer

The application signature for Facebook is not updated

Answer

The application control profile is configured in monitor-only mode

Answer

Facebook uses a non-standard port that application control does not monitor

Question 15

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit