NSE4 Practice Test 20 — 15 Questions

Question 1

Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)

Accepted Answer

Use the GUI under System > Firmware.. The FortiGate GUI under System > Firmware allows uploading and installing firmware images, a standard upgrade method. Option B is incorrect because the command syntax is reversed; the correct syntax is 'execute upgrade image tftp '. Options C, D, and E are not firmware upgrade commands (they are backup/restore and reboot, respectively). Therefore, only option A is a valid upgrade method among the choices.

Answer

Use the command 'execute upgrade image tftp '.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 2

What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.. Certificate inspection only validates the server certificate's authenticity (e.g., checking the certificate chain, expiration, and revocation status) without decrypting the actual TLS session. In contrast, full SSL deep inspection performs a man-in-the-middle decryption by re-encrypting traffic with a FortiGate-generated certificate, allowing the firewall to inspect the entire payload for threats like malware or data leakage. This distinction is critical for understanding how FortiGate applies security profiles to encrypted traffic.

Answer

Certificate inspection decrypts the traffic but does not check the certificate.

Answer

Deep inspection is less secure than certificate inspection.

Answer

Both methods provide the same level of inspection.

Question 3

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

Accepted Answer

Policy ID 2 because it matches the source and service. Policy ID 2 matches because the source IP 10.0.1.50 falls within the 10.0.1.0/24 subnet, and the service is set to ALL, which includes HTTP. FortiGate uses a top-down policy lookup and selects the first match based on source, destination, and service; since Policy ID 2 matches all criteria, it is applied.

Answer

Both policies, and the traffic is load-balanced

Answer

No policy matches, traffic is denied by implicit deny

Answer

Policy ID 1 because it is first in order and matches the service HTTP

Question 4

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

Accepted Answer

Enable SNMP agent and configure an SNMP community. To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Answer

Configure a performance SLA monitor

Answer

Enable SNMP on the interface and set administrative access to SNMP

Answer

Configure an SNMP v3 user and enable SNMP traps

Question 5

A company has a web server in the DMZ that needs to be accessible from the internet on port 443 (HTTPS). The administrator configures a Virtual IP (VIP) mapping the public IP 203.0.113.10 to the private IP 10.0.1.10 port 443. Which firewall policy is required to allow inbound traffic?

Accepted Answer

A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT. When a Virtual IP (VIP) is configured in FortiGate, the firewall policy must reference the VIP object as the destination, not the actual private IP. The VIP translates the public IP (203.0.113.10) to the private IP (10.0.1.10), and the policy from WAN to DMZ with destination VIP ensures that inbound traffic is matched and permitted before NAT translation occurs. Without this policy, the VIP alone does not allow traffic; it only defines the translation rule.

Answer

A policy from WAN to DMZ with source any, destination IP of the server (10.0.1.10), and action ACCEPT

Answer

No firewall policy is needed; the VIP automatically allows traffic

Answer

A policy from DMZ to WAN with source VIP, destination any, and action ACCEPT

Question 6

A FortiGate administrator is troubleshooting an issue where users cannot access an internal HTTPS server (10.10.10.10:443) after enabling SSL deep inspection. The administrator sees that the server's certificate is self-signed. Which TWO actions should the administrator take to allow access while maintaining inspection?

Accepted Answer

Import the server's self-signed certificate into FortiGate's trusted CA list. Importing the server's self-signed certificate into FortiGate's trusted CA list allows the FortiGate to trust the certificate during SSL deep inspection, preventing certificate validation errors. Option E is correct because adding the server's IP to the SSL/SSH profile's exemption list bypasses inspection for that specific server, allowing access without deep inspection while still applying other security profiles.

Answer

Disable deep inspection on the policy

Answer

Change the policy action to DENY

Answer

Disable certificate validation in the SSL/SSH profile

Question 7

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. A captive portal authenticates users but does not automatically grant network access. A firewall policy must explicitly allow traffic from the captive portal interface to the internet and include the authenticated user group as a source. Without this policy, even after successful authentication, traffic is dropped and users are not redirected to the internet.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 8

An administrator integrates FortiGate with FortiSandbox for advanced threat detection. The FortiGate is configured to send files to FortiSandbox for analysis. Despite correct configuration, files are not being submitted. The administrator runs 'diagnose debug application fortisandbox -1' and sees 'no server configured'. What is the issue?

Accepted Answer

The FortiSandbox server IP address is not configured on the FortiGate. The debug output 'no server configured' explicitly indicates that the FortiGate does not have a FortiSandbox server IP address defined in its configuration. Without the server IP configured under 'config system fortisandbox', the FortiGate cannot establish a connection or submit files, regardless of other settings. This is a prerequisite step before any file submission can occur.

Answer

The FortiSandbox license has expired

Answer

Firewall policies are blocking communication to the FortiSandbox server

Answer

The antivirus profile is not configured to submit files to FortiSandbox

Question 9

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Accepted Answer

The performance SLA for jitter is not configured, only latency.. The SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Answer

The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Answer

The LTE link has a higher cost and is not considered for failover.

Answer

The fiber link has a higher interface weight.

Question 10

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. Which two additional diagnostics should the administrator run to isolate the issue?

Accepted Answer

diagnose sys session filter and diagnose sys session list. 'diagnose sys session filter' allows you to set filters (e.g., by source/destination IP or port) and 'diagnose sys session list' then displays the current session table entries matching those filters. Since the IPsec tunnel is up but traffic is not passing, the session table may show that traffic is being dropped or not matching the expected policies, helping isolate whether the issue is with policy routing, firewall rules, or session setup. Option C is also correct because 'diagnose debug application ike -1' enables detailed IKE debugging that can reveal post-establishment issues, such as rekey failures, phase 2 problems, or IPsec SA mismatches, which may not be apparent from the tunnel list alone. Both diagnostics are appropriate: A checks the data plane (session table), and C checks the control plane (IKE negotiation details).

Answer

diagnose hardware sysinfo memory

Answer

diagnose netlink interface list

Answer

execute ping-options source and execute ping

Question 11

A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?

Accepted Answer

Web mode only allows access to specific bookmarks configured in the portal. In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.

Answer

The user must be authenticated via LDAP

Answer

The user has not installed the FortiClient VPN plugin

Answer

The SSL VPN policy is missing a security profile

Question 12

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 13

An administrator wants to ensure that traffic from the engineering department (subnet 192.168.10.0/24) to the internet uses a specific public IP address for source NAT. Additionally, traffic from the marketing department (192.168.20.0/24) should use a different public IP. Which method should be used?

Accepted Answer

Create two firewall policies, each with its own IP pool, for the respective subnets. The requirement is to map specific source subnets to different public IP addresses. In FortiGate, this is achieved by creating separate firewall policies for each subnet, each with its own IP pool configured for source NAT. A single Central SNAT rule with one IP pool cannot differentiate between subnets to assign different public IPs.

Answer

Configure a single Central SNAT rule with multiple source subnets and a single IP pool

Answer

Use VIP for source NAT

Answer

Use a single policy with a dynamic IP pool that randomly assigns IPs

Question 14

Which TWO web filtering features can be used to block access to malicious websites? (Choose two.)

Accepted Answer

FortiGuard category-based filtering. FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

Answer

Static URL filtering

Answer

Application control

Answer

DNS filter

Question 15

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Accepted Answer

Set the manual strategy with MPLS as first member and enable SLA check.. A manual strategy with ordered members and an SLA check allows the SD-WAN rule to first attempt the MPLS link; if the SLA is met, traffic uses MPLS, and if the SLA fails, the rule automatically fails over to the next member (broadband). This directly implements the engineer's requirement of 'MPLS if SLA met, otherwise broadband.'

Answer

Set the strategy to 'volume' and configure MPLS as preferred.

Answer

Use 'load balancing' strategy and assign MPLS a higher weight.

Answer

Set the strategy to 'best quality' and set MPLS with highest priority.