NSE4 Practice Exam 1 — 20 Questions

Question 1

What is the primary difference between flow-based and proxy-based Antivirus inspection on a FortiGate?

Accepted Answer

Proxy-based inspection reassembles the file before scanning, while flow-based scans as the file passes through. The primary difference is that proxy-based antivirus inspection fully reassembles the file in memory before scanning, allowing for more thorough detection of threats like polymorphic viruses and archives. Flow-based inspection scans data as it passes through the FortiGate in a single pass, using pattern matching without full file reassembly, which reduces latency but may miss threats that require file-level analysis.

Answer

Flow-based inspection is only available on hardware models with CP8

Answer

Proxy-based inspection uses fewer resources than flow-based

Answer

Flow-based inspection supports virus outbreak detection, but proxy-based does not

Question 2

An administrator wants to allow only HTTPS and SSH administrative access to the FortiGate from a specific management subnet 192.168.100.0/24. Which TWO steps must be taken on the FortiGate?

Accepted Answer

Set the trusted host(s) on the administrator account to 192.168.100.0/24. Setting the trusted host(s) on an administrator account restricts administrative logins to only those originating from the specified subnet (192.168.100.0/24). This is a per-account access control that works in conjunction with interface-level allowaccess settings to enforce administrative source IP restrictions.

Answer

Create a local-in policy to allow traffic from 192.168.100.0/24

Answer

Enable HTTPS and SSH globally under system global

Answer

Configure a firewall policy to permit HTTPS and SSH from the management subnet to the FortiGate

Question 3

A FortiGate admin is troubleshooting an issue where traffic from a specific internal host (10.0.1.50) to the internet is not being NATed as expected. The firewall policy has NAT enabled with an IP pool of type Overload. Which TWO conditions could cause the traffic to bypass the IP pool?

Accepted Answer

A policy with a lower policy ID matches the traffic and has NAT enabled with a different IP pool or no pool. FortiGate processes firewall policies in sequential order based on policy ID. If a policy with a lower ID matches the traffic and has NAT enabled with a different IP pool (or no pool), that policy will be applied first, causing the traffic to bypass the intended IP pool. Option E is correct because an IP pool of type Overload uses a source filter to determine which source addresses are eligible for NAT; if 10.0.1.50 is not included in that filter, the traffic will not use the pool.

Answer

The firewall policy's NAT setting is set to 'disable'

Answer

The IP pool is configured for one-to-one NAT

Answer

The internal host is using a non-standard source port

Question 4

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays the current FSSO login status for all users, including the Fortinet Single Sign-On (FSSO) session information such as username, IP address, and group membership. This command queries the authentication daemon (authd) which maintains the FSSO user database, allowing the administrator to verify if a specific user is authenticated and which firewall policies apply. It directly addresses the scenario where users are logged into the domain but web traffic is blocked, as it confirms whether the FSSO polling has successfully registered the user's login.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 5

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Accepted Answer

Assign an IP address to each VLAN subinterface for management. In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Answer

Enable NAT on the policies to translate addresses between VLANs

Answer

Configure static routes to route between VLANs

Question 6

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

Accepted Answer

Aggregate interface. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Answer

Loopback interface

Answer

VLAN interface

Answer

Software switch interface

Question 7

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

Accepted Answer

The firmware image file is corrupted or not compatible with the platform. When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Answer

The FortiGate was in HA mode and the peer did not upgrade

Answer

The admin did not reboot after the upgrade

Answer

The admin forgot to save the configuration before upgrading

Question 8

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 9

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. In NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 10

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. The HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 11

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

Accepted Answer

Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP. FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Answer

Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate

Answer

Configure a syslog server pointing to the FortiAnalyzer IP

Answer

Configure an SNMP community on the FortiAnalyzer

Question 12

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the process of being established and has not completed the TCP three-way handshake. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

Answer

The session is a UDP session because the proto_state is 01

Answer

The session has been closed and is being removed from the session table

Answer

The session is fully established and has been active for 3600 seconds

Question 13

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Accepted Answer

Enable VLAN forwarding on the bridge. In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Answer

Create static routes for each VLAN subnet

Answer

Disable antivirus inspection on the policy

Answer

Assign IP addresses to the internal interfaces

Question 14

A FortiGate admin needs to allow inbound HTTPS traffic to a web server while also applying an application control profile to block certain web applications. The web server has a VIP configured. Which TWO components are necessary for this configuration?

Accepted Answer

A VIP configured to map the public IP to the web server's private IP. A Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

Answer

A central SNAT rule to translate the server's response

Answer

A security profile group containing only the antivirus profile

Answer

A traffic shaping policy to prioritize HTTPS

Question 15

Which of the following best describes a Virtual IP (VIP) in FortiGate?

Accepted Answer

A method to translate a public IP/port to a private IP/port for inbound traffic. A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Answer

A method to translate private source IPs to a public IP for outbound traffic

Answer

A method to group multiple firewall policies

Answer

A method to load balance traffic across multiple WAN interfaces

Question 16

An administrator runs the CLI command 'diagnose debug rating' and sees that all FortiGuard web filter requests are timing out. What is the most likely cause?

Accepted Answer

The DNS server configured on the FortiGate is not resolving the FortiGuard FQDN. The 'diagnose debug rating' command shows real-time FortiGuard web filter request status. When all requests are timing out, it indicates that the FortiGate cannot reach the FortiGuard servers. The most common cause is a DNS resolution failure, where the FortiGate cannot resolve the FortiGuard FQDN (e.g., service.fortiguard.net) due to an incorrect or unreachable DNS server configuration. Without proper DNS, the FortiGate cannot establish the necessary HTTPS connections to query the FortiGuard rating service.

Answer

The web filter profile has an incorrect action configured

Answer

The web filter is set to 'monitor all' which causes all requests to timeout

Answer

The FortiGuard web filtering license has expired

Question 17

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Answer

The session is blocked by the firewall

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 18

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 19

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

Accepted Answer

Upgrade to 7.0.6 first, then to 7.2.0. Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Answer

Upgrade to 7.2.0 directly after downgrading to 7.0.0

Answer

Upgrade to 7.4.0 first, then downgrade to 7.2.0

Answer

Upgrade directly from 7.0.5 to 7.2.0

Question 20

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

Accepted Answer

The firewall policy action is set to DENY. The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).

Answer

The interface is not configured as a WAN interface

Answer

The policy is disabled

Answer

The traffic is being processed by a higher priority deny policy