NSE4 Practice Test 20 — 15 Questions

Question 1

A FortiGate administrator wants to configure Zero Trust Network Access (ZTNA) to secure access to an internal application. What is required on the FortiGate?

Accepted Answer

A ZTNA server and a ZTNA rule. FortiGate ZTNA requires configuring a ZTNA server (which defines the protected application, its real server, and the access proxy/certificate) and a ZTNA rule (which binds the server to users/groups and enforcement). Together they let the FortiGate act as an access proxy that authenticates users and brokers connections to the internal app without a full VPN tunnel.

Answer

A FortiClient EMS subscription

Answer

A VPN tunnel to the application

Answer

A firewall policy with SSL inspection enabled

Question 2

An administrator is configuring ZTNA (Zero Trust Network Access) on a FortiGate. The administrator needs to ensure that only clients with a valid posture assessment can access an internal application. Which access proxy setting must be configured to enforce this requirement?

Accepted Answer

Configure a ZTNA rule with a ZTNA tag requirement. ZTNA on FortiGate enforces zero trust by requiring clients to present a valid ZTNA tag, which is issued only after a successful posture assessment by FortiClient EMS. Configuring a ZTNA rule with a tag requirement ensures that only endpoints meeting the posture policy can reach the protected application through the access proxy. This is the mechanism that ties posture validation to access enforcement.

Answer

Enable SSL deep inspection on the access proxy

Answer

Set the access proxy to use certificate-based authentication

Answer

Enable multi-factor authentication on the access proxy

Question 3

Which log severity level indicates that the system is unusable?

Accepted Answer

Emergency. The Emergency severity level (level 0) indicates that the system is unusable. It is the highest severity level in syslog (RFC 5424) and is used for catastrophic failures. Alert (level 1) indicates immediate action needed, Critical (level 2) indicates critical conditions, and Error (level 3) indicates error conditions, but Emergency specifically means the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 4

An administrator runs 'diagnose debug flow' for a specific source IP and sees the output includes 'no matching policy'. The FortiGate has a firewall policy that should match the traffic. What is the most likely reason for this message?

Accepted Answer

The firewall policy is disabled or the source/destination interfaces do not match the traffic's ingress/egress interfaces. 'No matching policy' in diagnose debug flow means the FortiGate evaluated the packet against the policy list and found no policy whose ingress interface, egress interface, source, destination, schedule, and service all matched. The most common causes are a disabled policy or an interface mismatch (traffic arriving on an interface the policy does not list as incoming).

Answer

The FortiGate's routing table does not have a route for the destination

Answer

The security profiles applied to the policy are blocking the traffic

Answer

The session table is full and cannot accept new sessions

Question 5

A FortiGate administrator notices that after upgrading the firmware, the HA cluster fails to form. Both units show the correct HA configuration. What is the most likely cause?

Accepted Answer

The firmware versions are different on the two units. FortiGate HA requires that all cluster members run the same firmware version. After an upgrade, if one unit is upgraded and the other is not, the HA cluster will not form because the HA protocol version and heartbeat packet format may differ. The units will show correct HA configuration but will not establish a heartbeat due to version mismatch. This is a common issue during firmware upgrades in an HA cluster.

Answer

The HA heartbeat interfaces are not connected

Answer

The HA mode is set to active-active on one unit and active-passive on the other

Answer

The HA priority values are identical

Question 6

A school district uses a FortiGate to filter web traffic for students. The administrator wants to enforce that Google searches are filtered for explicit content. Which configuration should be applied?

Accepted Answer

Enable 'Google Safe Search' in the web filter profile under 'FortiGuard Categories' -> 'Safe Search'.. FortiGate's web filter profile includes a 'Safe Search' feature that enforces safe search on popular search engines like Google, Bing, and YouTube. Enabling 'Google Safe Search' under FortiGuard Categories -> Safe Search forces Google to return filtered results by modifying the search request to include the safe search parameter (e.g., 'safe=active'). This is the correct and granular way to enforce safe search without blocking search engines entirely.

Answer

Use an application control profile to block the 'Google Search' application.

Answer

Create a URL filter to block URLs containing 'porn' or 'adult'.

Answer

Block the URL category 'Search Engines' and allow only approved search engines.

Question 7

Which inspection mode allows FortiGate to perform virus scanning by reassembling the entire file in memory before scanning, providing better detection but potentially higher latency?

Accepted Answer

Proxy-based inspection. Proxy-based inspection is the FortiGate mode where the full file is buffered and reassembled in memory before the security profile (AV, IPS, etc.) inspects it. This allows complete-file scanning, so detection of threats that span multiple packets or require the whole file is far better, at the cost of added latency and memory usage. Flow-based inspection, by contrast, scans packets as they stream through, which is faster but can miss threats that only appear once the file is fully assembled.

Answer

Fast-path inspection

Answer

Deep inspection

Answer

Flow-based inspection

Question 8

Which of the following FortiGate log types records information about user authentication and administrative access?

Accepted Answer

Event logs. Event logs on a FortiGate record system-level and administrative activity, including administrator logins, configuration changes, user authentication events, and system operations. This is the log category that captures both user authentication and administrative access events, making it the correct answer. Traffic logs record session-level data (source/destination, bytes, action), while security logs cover UTM events like IPS and antivirus detections.

Answer

Traffic logs

Answer

System logs

Answer

Security logs

Question 9

A FortiGate is configured with an IPS profile to protect a web server. The administrator notices that some attacks are not being detected. The IPS signature database is up to date. What should the administrator check first?

Accepted Answer

Ensure the IPS profile is applied to the firewall policy that handles traffic to the web server.. The most common reason an IPS profile fails to detect attacks is that the profile is not actually applied to the firewall policy processing the traffic. In FortiGate, an IPS sensor must be referenced in the security profile settings of the specific firewall policy that permits traffic to the web server. Without this binding, the IPS engine never inspects the packets, regardless of signature database freshness or sensor configuration. Therefore, verifying policy association is the first and most fundamental troubleshooting step.

Answer

Increase the severity level of the IPS sensor.

Answer

Disable flow-based inspection and enable proxy-based inspection.

Answer

Change the IPS signature action from 'default' to 'block'.

Question 10

A FortiGate is configured to integrate with FortiSandbox for advanced threat detection. The antivirus profile is set to send files to FortiSandbox when a virus is detected. What action does FortiGate take on the file while it is being analyzed by FortiSandbox?

Accepted Answer

Blocks the file until a verdict is received from FortiSandbox. When the antivirus profile is configured to send files to FortiSandbox for analysis, FortiGate holds the file in a temporary buffer and does not forward it to the client until a verdict is received. This is known as 'block until verdict' mode. The file is not quarantined on the FortiGate, nor is it immediately blocked or allowed; the session is paused pending the sandbox result.

Answer

Quarantines the file on the FortiGate

Answer

Immediately blocks the file and logs the event

Answer

Allows the file to pass through and logs the event

Question 11

An admin configures a firewall policy with a schedule object that restricts access to Monday to Friday from 9:00 to 17:00. A user attempts to connect on Saturday at 10:00. Which of the following best describes what happens?

Accepted Answer

The FortiGate skips this policy and tries the next policy; if no match, implicit deny blocks the traffic. When a firewall policy includes a schedule, the policy is only active during the specified time. Outside that schedule, the policy is skipped entirely, and the FortiGate evaluates the next policy in the list. If no subsequent policy matches, the implicit deny rule at the end blocks the traffic. Therefore, on Saturday at 10:00, the policy is skipped, and if no other policy allows it, the traffic is denied.

Answer

The traffic is allowed because the schedule is only used for logging

Answer

The traffic is allowed because the schedule is optional

Answer

The traffic is denied because the schedule is not valid

Question 12

An administrator configures a DLP sensor to detect credit card numbers in traffic. However, the sensor is not detecting any credit card numbers even though they are present in emails. What could be the reason?

Accepted Answer

Email traffic is encrypted and SSL deep inspection is not enabled. If a DLP sensor is configured to detect credit card numbers in emails but is not detecting them, a likely reason is that the email traffic is encrypted (e.g., via TLS) and SSL deep inspection is not enabled on the FortiGate. Without SSL deep inspection, the FortiGate cannot see the contents of encrypted emails, so the DLP sensor cannot inspect the payload for credit card numbers. Therefore, enabling SSL deep inspection would allow the DLP sensor to detect the patterns.

Answer

The DLP sensor is applied to the wrong policy

Answer

The credit card regular expression is incorrect

Answer

The DLP sensor is in 'Monitor' mode

Question 13

An administrator configures a web filter profile to block the URL category 'Pornography'. The profile is applied to a policy for the sales department. Users report they can still access some sites that should be blocked. The administrator verifies that the FortiGuard web filter service is licensed and the FortiGate has internet connectivity. What should the administrator check next?

Accepted Answer

Ensure the web filter profile has 'FortiGuard category based filter' enabled and the action for 'Pornography' is set to 'Block'.. In FortiOS, a web filter profile only enforces FortiGuard category blocking if the 'FortiGuard category based filter' toggle is enabled within the profile and the specific category (e.g., Pornography) has its action set to 'Block'. If the toggle is off, or the category action is left at 'Allow' or 'Monitor', the profile will not block those sites even though the FortiGuard license is valid and connectivity is fine. This is the most common misconfiguration when categories appear to be ignored.

Answer

Verify that the antivirus profile is not interfering with web filtering.

Answer

Check if the sales department policy is using NAT that might bypass the FortiGate.

Answer

Confirm that the FortiGate has a static route to the FortiGuard servers.

Question 14

A network administrator is troubleshooting why certain web-based applications are not being identified by application control. The applications are accessed over HTTPS. What is the most likely missing configuration?

Accepted Answer

SSL inspection is not configured and applied to the firewall policy.. Application control relies on inspecting the content of traffic to identify applications. When traffic is encrypted with HTTPS, the firewall cannot inspect the payload without decrypting it first. Therefore, SSL inspection must be configured and applied to the firewall policy to allow the FortiGate to decrypt the traffic and match it against application control signatures.

Answer

Web filter profile is not applied to the firewall policy.

Answer

Deep packet inspection is not enabled on the firewall policy.

Answer

IPS is not enabled on the firewall policy.

Question 15

A FortiGate administrator wants to allow traffic from the internal network to a specific external server using its fully qualified domain name (FQDN) rather than an IP address, because the server's IP changes frequently. Which type of address object should the administrator create for the destination?

Accepted Answer

FQDN object. FQDN object. FortiGate FQDN objects resolve domain names to IP addresses dynamically, allowing the firewall to update the destination IP automatically when the server's IP changes. This is ideal for scenarios where the external server uses a fully qualified domain name and its IP address is not static.

Answer

Subnet object

Answer

Wildcard FQDN object

Answer

Geography object