NSE4 Practice Exam 3 — 20 Questions

Question 1

A FortiGate administrator is configuring a firewall policy to allow inbound HTTPS traffic from the internet to an internal web server. The web server has a private IP address 10.0.0.10. The administrator wants to translate the destination IP to the internal server using a Virtual IP (VIP). Which TWO of the following must be configured for the VIP to work correctly? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VIP must have the external IP set to a public IP address assigned to the FortiGate's WAN interface. A Virtual IP (VIP) must map a public IP address (typically assigned to the FortiGate's WAN interface) to the internal private IP of the web server. Without setting the external IP to a public address, the VIP cannot receive inbound traffic from the internet. Option D is correct because the firewall policy must reference the VIP as the destination address object; this triggers the destination NAT translation from the public IP to the private IP 10.0.0.10.

Answer

An IP Pool must be configured for the web server's return traffic

Answer

The VIP must have port forwarding enabled with the external and internal ports set to 443

Answer

The firewall policy must have NAT enabled

Question 2

A network administrator has configured a static route on a FortiGate with a distance of 10 and a priority of 0. Later, they add another static route to the same destination with a distance of 15 and priority of 0. Which route will be used for traffic forwarding?

Accepted Answer

The route with distance 10 because it has a lower administrative distance. The FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

Answer

The route with distance 15 because it has a higher priority

Answer

Both routes will be used for ECMP load balancing

Answer

The route with distance 15 will be used because it was added last

Question 3

An admin configures a Central SNAT rule to translate internal 192.168.1.0/24 to 203.0.113.10 when accessing the internet. However, traffic from 192.168.1.100 to 8.8.8.8 shows source IP 192.168.1.100 in logs. What is the MOST likely cause?

Accepted Answer

The Central SNAT rule is applied to the wrong outgoing interface. The Central SNAT rule is not being applied to the traffic. The most likely cause is that the rule specifies an outgoing interface different from the one used to reach 8.8.8.8, so the rule does not match and no source translation occurs.

Answer

The Central SNAT rule is disabled

Answer

The firewall policy has an IP pool configured, overriding Central SNAT

Answer

The destination address in the Central SNAT rule is incorrect

Question 4

A company with 500 users has a FortiGate 1000D running FortiOS 7.2. They have configured full SSL inspection and web filtering to block malware and phishing sites. The administrator receives complaints that some users cannot access a legitimate business website (https://vendor.example.com). The administrator checks the FortiGate logs and sees that the connection is allowed by the firewall policy and web filter. However, the user's browser shows 'ERR_CERT_AUTHORITY_INVALID'. The administrator verifies that the FortiGate's CA certificate is installed on all client machines. Further investigation reveals that the vendor's website uses a certificate signed by a private CA that is not trusted by the FortiGate. The administrator wants to resolve the issue without disabling SSL inspection for the whole website or compromising security. What should the administrator do?

Accepted Answer

Import the vendor's private CA certificate into the FortiGate's trusted root CA store.. The FortiGate cannot validate the vendor's certificate because its private CA is not in the FortiGate's trusted root store. By importing that CA certificate into the FortiGate's trusted root CA store, the FortiGate will trust the vendor's certificate chain, allowing full SSL inspection to proceed without errors. This resolves the ERR_CERT_AUTHORITY_INVALID error while maintaining security inspection for the domain.

Answer

Create an SSL exemption for the vendor's domain in the SSL inspection profile.

Answer

Change the SSL inspection profile to certificate inspection only.

Answer

Install the vendor's CA certificate on the client machines.

Question 5

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

Accepted Answer

The port range for each IP in the pool is exhausted. With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Answer

The firewall policy has 'set nat enable' disabled

Answer

The route to the internet is missing

Answer

The pool does not have enough IPs to cover all users

Question 6

An admin is configuring a dial-up IPsec VPN for remote users. The users will connect from various public IP addresses. Which Phase 1 configuration is required for the FortiGate to accept connections from unknown remote gateways?

Accepted Answer

Set the remote gateway to 0.0.0.0. For a dial-up IPsec VPN where remote users connect from dynamic public IP addresses, the FortiGate must be configured to accept connections from any remote gateway. Setting the remote gateway to 0.0.0.0 (or 0.0.0.0/0) in Phase 1 tells the FortiGate to accept IKE negotiation from any source IP, which is essential for dial-up scenarios. This is the standard method to allow unknown remote gateways to initiate the VPN tunnel.

Answer

Enable aggressive mode

Answer

Configure a static route to the remote users' subnet

Answer

Set the remote gateway to a specific IP address

Question 7

An administrator configures an application control profile to block social media applications. Users can still access Facebook and Twitter via web browsers. What is the most likely reason?

Accepted Answer

The firewall policy has SSL/SSH inspection set to 'certificate-inspection' instead of 'deep-inspection'. When SSL/SSH inspection is set to 'certificate-inspection' (default), the FortiGate only inspects the certificate handshake and cannot decrypt the encrypted application-layer traffic. Social media applications like Facebook and Twitter use HTTPS, so without deep inspection (full decryption), the application control profile cannot identify and block the application signatures within the encrypted payload. Deep inspection is required to decrypt the traffic and allow the IPS engine to match application signatures.

Answer

The application signatures for Facebook and Twitter are not up to date

Answer

The application control profile is set to 'monitor' instead of 'block'

Answer

The firewall policy is configured with flow-based inspection

Question 8

An admin creates a firewall policy allowing HTTP traffic from internal users to the internet. Users complain that they cannot access HTTPS websites. The admin checks and sees that the policy only has HTTP service. What is the BEST course of action to allow HTTPS while maintaining security?

Accepted Answer

Add the HTTPS service to the existing policy. Adding the HTTPS service (TCP/443) to the existing policy allows HTTPS traffic without creating a separate rule, which could introduce complexity or misordering issues. This approach maintains security by explicitly permitting only the required service rather than opening all traffic. FortiGate policies evaluate services as part of the match criteria, so modifying the existing policy is the most efficient and secure method.

Answer

Create a new policy above the existing one with HTTPS service

Answer

Use a security policy that automatically adds HTTPS

Answer

Change the HTTP service to ALL services

Question 9

An administrator configured SSL inspection with 'deep-inspection' profile. Users report that some websites fail to load with certificate errors. The firewall policy is correct. What is the most likely reason?

Accepted Answer

The web server uses a cipher that the FortiGate cannot re-encrypt.. When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

Answer

The CA certificate has expired.

Answer

The user's browser is outdated.

Answer

The firewall needs a policy to allow DNS traffic.

Question 10

An administrator is troubleshooting an IPsec VPN that fails to establish. The 'diagnose vpn ike log' shows 'initial contact received'. What does this message indicate?

Accepted Answer

The remote peer has restarted and cleared its security associations. In IPsec IKE (Internet Key Exchange), an 'initial contact' notification is sent by a peer to inform the other side that it has just restarted or cleared its security associations (SAs). This message tells the receiving peer to delete any existing SAs associated with that peer, allowing a fresh IKE negotiation to begin. Therefore, the message indicates the remote peer has restarted and cleared its SAs, not a configuration or NAT issue.

Answer

The pre-shared key is incorrect

Answer

The Phase 1 proposal is mismatched

Answer

A network address translation device is altering the IKE packets

Question 11

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

Accepted Answer

Create an allow policy for HTTP/HTTPS and apply a web filter profile. FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Answer

Configure a DNS filter instead of a web filter

Answer

Create a policy with action DENY and a web filter profile

Answer

Use an application control profile to block malicious sites

Question 12

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 13

A network administrator needs to configure a FortiGate to allow HTTPS access to the GUI from the internal network. Which two steps must be performed?

Accepted Answer

Create a firewall policy that permits HTTPS traffic from internal to the FortiGate interface IP.. To allow HTTPS access to the GUI from the internal network, two actions are required. First, a firewall policy must be created to permit HTTPS traffic (TCP/443) from the internal network to the FortiGate's interface IP. This can be done via CLI with 'config firewall policy' or through the GUI. Second, HTTPS administrative access must be enabled on the internal interface. This is configured either via CLI with 'config system interface' and 'set allowaccess https' or by checking 'HTTPS' under Administrative Access in the GUI. Without both steps, GUI access will fail.

Answer

Disable HTTP administrative access on the internal interface.

Answer

Enable SSH administrative access on the internal interface.

Question 14

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) is the correct feature because it performs destination NAT (DNAT), translating the public destination IP 203.0.113.10 to the internal server IP 10.0.0.5. This allows inbound traffic from the internet to reach the internal web server by rewriting the destination IP address in the packet header as it traverses the FortiGate.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 15

An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?

Accepted Answer

FSSO with Active Directory polling. FSSO with Active Directory polling allows users to authenticate once at Windows logon, and FortiGate polls the AD domain controllers to capture authentication events. This enables transparent network access control without repeated logins, as the user's identity and group memberships are mapped to firewall policies automatically.

Answer

Local user authentication

Answer

Captive portal with LDAP

Answer

SSL VPN with certificate authentication

Question 16

Which statement about the implicit deny policy on a FortiGate is true?

Accepted Answer

It is always at the bottom of the policy list and denies all unmatched traffic. The implicit deny policy is a built-in, non-configurable security policy that resides at the very bottom of the FortiGate policy list. It automatically denies all traffic that does not match any explicit user-defined policy, ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It is a user-configurable policy that can be deleted

Answer

It allows traffic that matches no other policy

Answer

It can be moved to a different position in the policy list

Question 17

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

Accepted Answer

Transparent mode. Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Answer

HA mode

Answer

VDOM mode

Answer

NAT/Route mode

Question 18

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The output shows `proto=6`, which is the protocol number for TCP, and `proto_state=01`, which in FortiGate's session table indicates an established TCP connection (state ESTABLISHED). The `duration=3600` seconds means the session has been active for exactly 1 hour, and `expire=3599` seconds shows the remaining time before the session times out. This confirms the session is an active TCP connection that has been established for 1 hour, making option C correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP

Question 19

An admin configures two static routes to the same destination with different distances. The route with distance 10 points to ISP1, and the route with distance 20 points to ISP2. The admin wants to use ISP2 only if ISP1 fails. What is the expected behavior?

Accepted Answer

Traffic will use ISP1 until its route is removed, then use ISP2. When two static routes have different administrative distances, the route with the lower distance (10) is preferred and installed in the routing table. The route with distance 20 remains in the routing table as a backup. If the preferred route (via ISP1) is removed due to a failure, the backup route (via ISP2) is automatically activated. This behavior is fundamental to how FortiGate (and most routers) handle static routes with unequal distances.

Answer

Traffic will load-balance between ISP1 and ISP2

Answer

The route with distance 20 will be ignored entirely

Answer

Both routes will be active simultaneously, and the FortiGate will choose based on source IP

Question 20

An administrator is configuring web filtering on a FortiGate. Which TWO statements about web filtering profiles are correct?

Accepted Answer

Web filtering profiles can be used together with application control profiles.. Web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Answer

Web filtering profiles can only be applied to users who are authenticated.

Answer

Web filtering profiles are applied globally by default.

Answer

Web filtering profiles are used to configure SSL certificate inspection.