NSE4 Practice Test 2 — 10 Questions

Question 1

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

Accepted Answer

Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP. FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Answer

Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate

Answer

Configure a syslog server pointing to the FortiAnalyzer IP

Answer

Configure an SNMP community on the FortiAnalyzer

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the process of being established and has not completed the TCP three-way handshake. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

Answer

The session is a UDP session because the proto_state is 01

Answer

The session has been closed and is being removed from the session table

Answer

The session is fully established and has been active for 3600 seconds

Question 3

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Accepted Answer

Enable VLAN forwarding on the bridge. In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Answer

Create static routes for each VLAN subnet

Answer

Disable antivirus inspection on the policy

Answer

Assign IP addresses to the internal interfaces

Question 4

A FortiGate admin needs to allow inbound HTTPS traffic to a web server while also applying an application control profile to block certain web applications. The web server has a VIP configured. Which TWO components are necessary for this configuration?

Accepted Answer

A VIP configured to map the public IP to the web server's private IP. A Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

Answer

A central SNAT rule to translate the server's response

Answer

A security profile group containing only the antivirus profile

Answer

A traffic shaping policy to prioritize HTTPS

Question 5

Which of the following best describes a Virtual IP (VIP) in FortiGate?

Accepted Answer

A method to translate a public IP/port to a private IP/port for inbound traffic. A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Answer

A method to translate private source IPs to a public IP for outbound traffic

Answer

A method to group multiple firewall policies

Answer

A method to load balance traffic across multiple WAN interfaces

Question 6

An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?

Accepted Answer

The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN. The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.

Answer

The web filter profile has an incorrect action configured

Answer

The web filter is set to 'monitor all' which causes all requests to timeout

Answer

The FortiGuard web filtering license has expired

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Answer

The session is blocked by the firewall

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 8

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 9

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

Accepted Answer

Upgrade to 7.0.6 first, then to 7.2.0. Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Answer

Upgrade to 7.2.0 directly after downgrading to 7.0.0

Answer

Upgrade to 7.4.0 first, then downgrade to 7.2.0

Answer

Upgrade directly from 7.0.5 to 7.2.0

Question 10

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

Accepted Answer

The firewall policy action is set to DENY. The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).

Answer

The interface is not configured as a WAN interface

Answer

The policy is disabled

Answer

The traffic is being processed by a higher priority deny policy