NSE4 Practice Test 19 — 15 Questions

Question 1

A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP. A firewall policy from WAN to DMZ is required to permit the inbound HTTPS traffic to the VIP. The policy must reference the VIP as the destination and allow HTTPS (TCP/443) to pass through the FortiGate.

Answer

A static route for 203.0.113.10 pointing to the ISP gateway

Answer

A Central SNAT policy to translate the source to the FortiGate's IP

Question 2

Which of the following statements about FortiGate policy lookup order is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is used. FortiGate uses a top-down sequential search for policy matching. When a packet arrives, the firewall starts at the top of the policy list and evaluates each policy in order until it finds one where all configured criteria (source, destination, service, schedule, etc.) match. The first matching policy is then applied, and no further policies are checked. This is the fundamental behavior of FortiGate's firewall policy lookup.

Answer

Policies are evaluated based on a priority number assigned to each policy

Answer

Policies are evaluated from bottom to top, and the last matching policy is used

Answer

Policies are evaluated randomly to balance load

Question 3

An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?

Accepted Answer

The client's routing table is set to route all traffic through the VPN. When split tunneling is enabled on the FortiGate SSL VPN portal, the FortiClient VPN software should only route traffic destined for the corporate network through the tunnel. If remote users report that all internet traffic is going through the VPN tunnel, the most likely cause is that the client's routing table has been configured to route all traffic (0.0.0.0/0) through the virtual adapter, overriding the split-tunneling rules. This can happen if the client is set to 'Route all traffic through VPN' in its settings, which forces a default route into the VPN interface regardless of the portal configuration.

Answer

The firewall policy allows traffic to the internet

Answer

The SSL VPN portal has 'split tunneling' disabled

Answer

The user has installed a root certificate

Question 4

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

Accepted Answer

The secondary unit detects loss of heartbeat from the primary and takes over. In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Answer

The administrator must manually reboot the secondary unit

Answer

The secondary unit becomes active only if the heartbeat link is also down

Answer

The secondary unit waits for a configuration change before becoming active

Question 5

A FortiGate administrator is configuring logging to meet a compliance requirement that all security events must be stored for at least one year. The FortiGate has limited local disk space. Which THREE actions should the administrator take to meet this requirement? (Choose three.)

Accepted Answer

Configure log rolling and retention policies to automatically delete older logs from the local disk after a set period. The administrator needs to store logs for at least one year with limited local disk space. To comply, logs must be offloaded to external storage or the cloud. Configuring log rolling and retention on the local disk (B) allows automatic deletion of old logs to free space, ensuring only recent logs are kept locally while older logs are deleted if not offloaded. However, to meet the one-year retention, offloading is necessary: sending logs to FortiAnalyzer (D) provides centralized long-term storage, and enabling FortiCloud logging (E) offers cloud-based retention. Disabling local disk logging (C) would stop log storage entirely, losing logs unless offloading is configured, but it is not a standalone solution. Setting severity to emergency only (A) would miss most security events, violating the requirement to log all security events. Therefore, the correct three actions are B, D, and E.

Answer

Set the log severity filter to only log 'emergency' events to reduce volume

Answer

Disable local disk logging to save space

Question 6

A network administrator configures a firewall policy allowing HTTP traffic from the internal network (10.0.0.0/8) to the internet. After applying the policy, users report they can browse the web, but the FortiGate logs show that all sessions are using the 'implicit deny' policy ID 0. What is the most likely cause?

Accepted Answer

The source interface on the policy is set to the WAN interface instead of the internal interface. If the source interface on the firewall policy is set to the WAN interface instead of the internal interface, traffic arriving from the internal network (10.0.0.0/8) on the internal interface will not match that policy. The FortiGate then falls through to the implicit deny policy (ID 0), which logs and drops the session. Since HTTP traffic is still reaching the internet, it suggests that another mechanism (such as a default route or NAT) is allowing the traffic, but the policy matching fails due to the interface mismatch.

Answer

Central NAT is enabled and overriding the policy-based NAT

Answer

The policy has a schedule applied that is currently inactive

Answer

The policy is placed after the implicit deny rule

Question 7

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

Accepted Answer

The PBR rule's source address does not match the traffic correctly.. Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Answer

The default route has a lower administrative distance than the PBR rule.

Answer

PBR is not supported on FortiGate.

Answer

The PBR rule has a higher priority than the default route.

Question 8

An administrator is configuring SNMP on a FortiGate for monitoring. Which THREE items are required for SNMPv3 configuration?

Accepted Answer

Security level (authPriv or authNoPriv). SNMPv3 requires a security level to define whether authentication and encryption are used. The security level (authPriv or authNoPriv) determines the operational mode for the user, making it a mandatory configuration element. Without specifying the security level, the FortiGate cannot enforce the appropriate authentication and privacy policies for SNMPv3 communications.

Answer

SNMP view definition for the user

Answer

SNMP community string (read-only or read-write)

Question 9

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. In the output of 'diagnose vpn ike gateway list', the 'peers' field shows the number of active IPsec tunnels (Phase 1 SAs) currently established through that gateway. A value of '0' means no remote clients have successfully completed IKE negotiation and are connected. Since the gateway state is 'up', it is ready to accept connections, but no clients are currently associated with it.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 10

An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?

Accepted Answer

The policy route is applied to the wrong incoming interface. Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

Answer

The firewall policy denies the traffic before policy routing

Answer

The default route has a higher administrative distance

Answer

The policy route destination is set to all

Question 11

A FortiGate administrator wants to ensure that traffic from the internal network to an external FTP server uses a specific source IP address (203.0.113.10). The internal network uses RFC 1918 addresses. Which NAT configuration should be used?

Accepted Answer

Policy-based NAT using an IP pool with type 'Overload' and the IP address 203.0.113.10. Policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

Answer

Policy-based NAT using an IP pool set to 'Fixed Port Range'

Answer

Virtual IP (VIP) mapping the internal server to 203.0.113.10

Answer

Central SNAT with dynamic IP pool

Question 12

An administrator creates a firewall policy with a traffic shaper to limit bandwidth for guest wireless users. After applying the policy, users can still consume high bandwidth. The administrator confirms the policy is matching. What is the MOST likely reason the traffic shaper is not effective?

Accepted Answer

The traffic shaper is configured but not applied to the policy's 'Traffic Shaper' field. In FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Answer

The traffic shaper's maximum bandwidth is set too high

Answer

The traffic shaper is applied to the wrong direction (egress vs ingress)

Answer

The traffic shaper is a per-IP shaper but the policy applies to a subnet

Question 13

An administrator configured a DLP profile to detect credit card numbers in outgoing emails. The profile is applied to an outbound SMTP policy. Users report that emails with credit card numbers are still being sent successfully. What is the most likely cause?

Accepted Answer

The SMTP traffic is encrypted and deep inspection is not enabled. FortiGate DLP inspection requires the firewall to decrypt SSL/TLS-encrypted SMTP traffic before it can match patterns like credit card numbers. If deep inspection (SSL/SSH inspection) is not enabled on the outbound SMTP policy, the DLP profile will only see encrypted data and cannot detect the credit card numbers, allowing the emails to pass through successfully.

Answer

The DLP profile is set to 'monitor' instead of 'block'

Answer

The DLP profile is not applied to the correct policy

Answer

The credit card number pattern is not correctly defined

Question 14

Which of the following FortiGate features allows users to authenticate using a one-time password generated by a mobile app?

Accepted Answer

FortiToken. FortiToken is Fortinet's two-factor authentication solution that generates one-time passwords (OTPs) via a mobile app (FortiToken Mobile) or hardware token. When a user authenticates, they must provide both their regular password and the current OTP from the FortiToken app, which is validated by the FortiGate against the token's seed record. This directly matches the question's requirement for OTP generation by a mobile app.

Answer

FSSO

Answer

LDAP

Answer

Captive portal

Question 15

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so the FortiGate cannot inspect the payload for viruses unless SSL/TLS deep inspection is enabled to decrypt the traffic. Even with an antivirus profile applied, the FortiGate can only scan the outer headers of encrypted sessions without deep inspection, leaving the actual content unscanned. Option C correctly identifies that deep inspection must be explicitly enabled on the firewall policy to allow the antivirus profile to scan decrypted HTTPS traffic.

Answer

The FortiGuard antivirus subscription has expired

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based