NSE4 Practice Test 19 — 15 Questions

Question 1

A FortiGate has a policy that matches traffic from LAN to WAN with NAT enabled and an IP pool. The pool contains IPs 203.0.113.1 to 203.0.113.5. The administrator notices that all traffic appears to come from 203.0.113.1. Which THREE reasons could explain this?

Accepted Answer

Only one source IP is generating traffic. If all traffic uses the first IP in the pool, possible reasons: the pool is configured for fixed port range which might allocate only one IP, or the NAT mode is not overload (which uses multiple IPs), or a single session is using all ports.

Answer

The IP pool is configured with 'type overload' and all source ports are being used

Answer

The 'set nat' command is missing from the policy

Question 2

An administrator configures Central SNAT for traffic going from internal network (10.0.0.0/8) to the internet. The rule uses an IP Pool with overload (PAT) and the pool address is 203.0.113.10. However, traffic from 10.0.0.10 to a public server is not being NATed; the source IP remains 10.0.0.10. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The firewall policy does not have NAT enabled. Central SNAT rules are evaluated before policy-based NAT. If a Central SNAT rule exists but does not match the traffic (e.g., wrong source interface, destination, or pool), FortiGate falls back to policy-based NAT. If the firewall policy has no NAT enabled, the traffic is not translated. The admin likely has Central SNAT configured incorrectly or the policy has NAT disabled.

Answer

The IP Pool is configured for one-to-one NAT instead of overload

Answer

The Central SNAT rule's source interface is set to 'wan1' instead of 'internal'

Answer

The IP Pool is configured with 'Fixed Port Range' which conflicts with overload

Question 3

A FortiGate administrator has configured a firewall policy allowing HTTP traffic from the internal network (10.0.1.0/24) to the DMZ server (192.168.1.10). The policy is placed after a deny-all policy that blocks traffic from internal to DMZ. Even though the allow policy is more specific, traffic is still being denied. What is the most likely cause?

Accepted Answer

The deny-all policy is placed above the allow policy in the policy list. FortiGate uses first-match logic for firewall policies. The deny-all policy is placed before the allow policy, so all traffic hits the deny policy first and is dropped. The allow policy never gets evaluated.

Answer

The deny-all policy has a higher policy ID than the allow policy

Answer

The allow policy is configured with the wrong source interface

Answer

The allow policy uses a schedule that is not active at the current time

Question 4

An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?

Accepted Answer

FortiClient. FortiClient is required on the client device to collect endpoint posture information (e.g., antivirus status, OS patches) and enforce ZTNA rules. The FortiGate uses FortiClient telemetry to make access decisions.

Answer

FortiManager

Answer

FortiToken

Answer

FortiAnalyzer

Question 5

A FortiGate administrator is troubleshooting an IPsec VPN between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees the following output:
IKE: phase 2 negotiation completed
IKE: IPsec SA up
What THREE possible causes should the administrator investigate?

Accepted Answer

Firewall policies on either FortiGate are not allowing traffic between the local and remote subnets. Options A, C, and E are correct. The tunnel is up, so Phase 1 and Phase 2 are fine. Common causes for traffic not passing include incorrect firewall policies, routing issues, or NAT traversal problems if traffic is being NATed before hitting the tunnel.

Answer

The pre-shared key is incorrect

Answer

The IKE mode is set to aggressive mode on one side and main mode on the other

Question 6

An administrator configures an SSL VPN portal with web mode and split tunneling enabled. Remote users can access internal web applications but cannot reach the internet through the VPN. What needs to be checked?

Accepted Answer

The firewall policy allowing internet traffic from the SSL VPN interface is missing or incorrect.. Split tunneling allows internet-bound traffic to bypass the VPN. If users cannot reach the internet, it could be because the split tunneling exclusion list includes internet destinations, or the DNS resolution is not working. However, the most common cause is that the firewall policy for internet traffic is missing or blocking.

Answer

The remote user's browser does not support SSL VPN.

Answer

The split tunneling setting is disabled.

Answer

The SSL VPN portal is configured in web mode only; tunnel mode is required for internet access.

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is in SYN_SENT state and might be stuck due to no response from the server.. The session state '01' indicates TCP SYN_SENT, meaning the session is still in the handshake phase. The duration is 3600 seconds, which is unusually long for a TCP handshake, suggesting the session is stuck or the server is not responding.

Answer

The session is fully established and has been active for 3600 seconds.

Answer

The session has been idle for 3599 seconds and will expire soon.

Answer

The session is in FIN_WAIT state and is being closed.

Question 8

An administrator configures a dial-up IPsec VPN using IKEv2 with certificates. Remote users can connect, but traffic is not routed through the tunnel. The Phase 1 status shows 'up', but Phase 2 shows 'down'. What is the most likely issue?

Accepted Answer

The Phase 2 proposals do not match between the FortiGate and the client.. IKEv2 requires a valid proposal match for Phase 2. If the Phase 2 parameters (encryption, authentication, etc.) do not match between the peer and the FortiGate, Phase 2 fails. Also, with IKEv2, the tunnel mode and proxy IDs must be correctly configured.

Answer

The firewall policy for the VPN traffic is missing.

Answer

The pre-shared key for Phase 2 is incorrect.

Answer

The remote user's client does not support IKEv2.

Question 9

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal works by configuring a firewall policy that matches the user's traffic with 'Authentication' set to 'Captive Portal' or by enabling it directly on the interface. Typically, a policy with 'Security Mode' 'Captive Portal' forces redirect.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.

Question 10

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. Route-based VPNs create a virtual interface (e.g., 'tunnel') that is used in routing and firewall policies, while policy-based VPNs define the traffic selectors within the Phase 2 configuration itself, without a separate interface.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

Question 11

A FortiGate administrator is troubleshooting an SSL VPN issue where users can authenticate but cannot access any internal resources. The SSL VPN status shows 'connected'. Which THREE commands or actions should be used to diagnose the problem?

Accepted Answer

Check the firewall policies that match the SSL VPN interface.. To diagnose SSL VPN connectivity, check the tunnel interface with 'diagnose vpn ssl stat', verify the routing table with 'get router info routing-table', and examine the firewall policies to ensure traffic is allowed. Option A shows VPN stats, Option B shows routing (necessary for tunnel routing), Option D checks policies.

Answer

'execute ping 8.8.8.8'

Answer

'diagnose debug application sslvpn -1'

Question 12

A FortiGate administrator is configuring an SSL VPN web mode portal. The administrator wants users to access only a specific internal web application (https://internal-app.company.local) and nothing else. Which SSL VPN setting should be configured to achieve this?

Accepted Answer

Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local. Option D is correct. In web mode, 'URL Access' allows the administrator to specify which URLs users can access. By adding only the desired application URL, the administrator restricts access to that application only.

Answer

In the SSL VPN portal, set the default bookmark to the application URL

Answer

Configure a firewall policy that allows traffic only to the application's IP address

Answer

Enable split tunneling under the SSL VPN settings

Question 13

An administrator runs 'diagnose debug application fnbamd -1' on a FortiGate to troubleshoot authentication issues. The output shows that the FortiGate successfully contacts the LDAP server but the user authentication fails. What does this indicate?

Accepted Answer

The user's password is incorrect or the user account is locked. Option D is correct. The debug output shows successful communication with the LDAP server, meaning the bind user has proper privileges. The authentication failure indicates that the user's credentials are incorrect or the user does not exist in the LDAP database.

Answer

The LDAP server is unreachable

Answer

The LDAP bind user password is incorrect

Answer

The LDAP schema does not match what FortiGate expects

Question 14

A FortiGate administrator runs 'diagnose vpn tunnel list' and sees the following output for an IPsec tunnel: 'status: up', 'incoming: 0 packets', 'outgoing: 100 packets'. Phase 1 and Phase 2 both show state 'up'. What is the MOST likely cause of zero incoming packets?

Accepted Answer

The Phase 2 proposal includes a mismatched proxy ID. If outgoing packets are being sent but no incoming packets, the remote side may have a misconfiguration such as a wrong remote subnet in Phase 2 or a firewall policy blocking return traffic.

Answer

The remote gateway is using aggressive mode

Answer

The FortiGate has a static route pointing to the VPN interface

Answer

The VPN is configured in policy-based mode

Question 15

An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?

Accepted Answer

Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.. In hub-and-spoke, to allow spoke-to-spoke traffic via the hub, the hub must have Phase 2 selectors that cover the spoke subnets (0.0.0.0/0.0.0.0 or specific ranges) and the firewall policies must permit traffic between the spoke interfaces. Option B (Phase 2 with 0.0.0.0/0) allows any destination, and Option D (firewall policies allowing inter-spoke traffic) enables forwarding.

Answer

Enable NAT on the hub's tunnel interface.

Answer

Configure the hub as a DNS server for the spokes.

Answer

Configure IKEv2 instead of IKEv1 on all tunnels.