NSE4 Practice Exam 3 — 20 Questions

Question 1

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VIP does not have NAT reflection enabled. The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.

Answer

The server is not responding to internal requests

Answer

The firewall policy for internal to VIP is missing

Answer

The VIP is configured on a different interface

Question 2

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 3

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 4

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

Accepted Answer

The port range for each IP in the pool is exhausted. With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Answer

The firewall policy has 'set nat enable' disabled

Answer

The route to the internet is missing

Answer

The pool does not have enough IPs to cover all users

Question 5

A FortiGate admin wants to ensure that traffic from the internal network (192.168.1.0/24) to the internet uses a specific public IP (203.0.113.10) for source NAT, and that the same public IP is also used for inbound connections to an internal web server (10.0.1.10) on port 443. Which TWO configurations are required? (Choose two.)

Accepted Answer

Configure an IP Pool with type Overload using 203.0.113.10. An IP Pool with type Overload allows multiple internal hosts to share a single public IP (203.0.113.10) for source NAT when traffic goes to the internet. This is the standard method for PAT (Port Address Translation) in FortiGate, enabling many-to-one NAT.

Answer

Create a firewall policy with source NAT enabled and the IP Pool selected

Answer

Configure Central SNAT with the same public IP

Question 6

A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?

Accepted Answer

Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10. To allow inbound HTTPS to an internal server with destination NAT, a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10 is required. A firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination permits the traffic and applies the NAT. Additionally, to translate the source port to a fixed range for logging, an IP pool with fixed port range is needed. Thus, options A, B, and D are all required.

Answer

Configure Central SNAT to translate the server's source IP for return traffic

Answer

Enable 'allow source port translation' on the VIP

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.. The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Answer

The session is an ICMP session with state 01 and expires in 1 second.

Answer

The session is a UDP session to port 443 and has been active for 3600 seconds.

Answer

The session is a TCP session that has timed out and will be removed in 3599 seconds.

Question 8

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

Accepted Answer

Create an allow policy for HTTP/HTTPS and apply a web filter profile. FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Answer

Configure a DNS filter instead of a web filter

Answer

Create a policy with action DENY and a web filter profile

Answer

Use an application control profile to block malicious sites

Question 9

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

Accepted Answer

Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.. Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Answer

Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

Answer

Enable SSH access on the WAN interface instead of HTTPS.

Answer

Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

Question 10

An admin is configuring ECMP (Equal Cost Multi-Path) on a FortiGate with two ISPs. Which TWO conditions must be met for ECMP to load balance traffic across both links? (Choose two.)

Accepted Answer

The routes must have the same priority. ECMP requires that multiple routes to the same destination have equal cost. On FortiGate, the cost is determined by administrative distance (AD) and priority (which is the route metric). Both routes must have the same AD and the same priority to be considered equal-cost and eligible for load balancing. If either value differs, one route will be preferred over the other, and ECMP will not activate.

Answer

The routes must be configured with the same metric

Answer

The FortiGate must be in transparent mode

Answer

The routes must point to different next-hop IP addresses

Question 11

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. ZTNA on FortiGate requires a proxy-based firewall policy to intercept and inspect application-layer traffic. This policy type enables the FortiGate to act as a reverse proxy, terminating TLS connections and enforcing access control based on user identity and device posture before forwarding traffic to the internal application.

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 12

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

Question 13

Which of the following best describes the purpose of a captive portal on a FortiGate?

Accepted Answer

To authenticate users before granting network access. A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.

Answer

To provide secure remote access to internal resources

Answer

To encrypt traffic between sites

Answer

To block malware from entering the network

Question 14

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Accepted Answer

Define a traffic shaper object with the desired bandwidth limits. A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Answer

Enable SD-WAN on the FortiGate

Answer

Configure Central NAT to translate the source IP

Question 15

An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?

Accepted Answer

Enable 'require client certificate' in the SSL VPN settings. The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.

Answer

Configure a firewall policy with identity-based authentication

Answer

Enable 'certificate-based authentication' in the user group

Answer

Import the users' public keys into the FortiGate

Question 16

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Accepted Answer

diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80. B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.

Answer

execute ping 203.0.113.50

Answer

diagnose debug flow

Answer

get firewall policy

Question 17

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

Accepted Answer

Enable the specific IPS signature for the exploit in the sensor.. The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Answer

Set the IPS sensor severity filter to 'low' and above.

Answer

Change the IPS sensor action from 'default' to 'block' for all signatures.

Answer

Create a custom IPS signature for the exploit.

Question 18

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 19

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Accepted Answer

diagnose firewall iprope list. The 'diagnose firewall iprope list' command (D) displays the kernel's internal firewall rule list, allowing the administrator to verify the exact order and matching criteria of all policies. The 'diagnose debug flow' command (E) enables real-time packet flow tracing, showing which policy each packet matches and why it is accepted or denied. Together, these two commands directly reveal if traffic is matching a different policy than intended.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 20

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security