NSE4 Practice Exam 4 — 20 Questions

Question 1

Which statement best describes the implicit deny policy at the end of a FortiGate policy list?

Accepted Answer

It is always present and denies any traffic that does not match an explicit allow policy. The implicit deny policy is a built-in, last-resort rule at the bottom of the FortiGate policy list that silently drops any traffic not matching an explicit allow policy. It cannot be moved, disabled, or deleted because it is a fundamental security mechanism ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It denies all traffic that does not match any explicit policy, and it logs the denied traffic

Answer

It can be moved to a different position in the policy list

Answer

It can be disabled or deleted by the admin

Question 2

An administrator configures a web filter profile with FortiGuard category blocking and URL filter to allow example.com. Users report that example.com is still blocked. What is the most likely cause?

Accepted Answer

The FortiGuard category action is set to 'block' and takes precedence over the URL filter allow rule. When both FortiGuard category blocking and a URL filter are configured in the same web filter profile, the FortiGuard category action (e.g., 'block') is evaluated first and takes precedence over any URL filter allow rule. This is because FortiGate processes web filter rules in a specific order: FortiGuard category blocking is applied before URL filter entries. Therefore, even if a URL filter explicitly allows example.com, the FortiGuard category block will prevent access.

Answer

The URL filter requires deep inspection to be enabled

Answer

The URL filter entry is placed after the FortiGuard category in the policy

Answer

The DNS filter is blocking example.com before the web filter is evaluated

Question 3

A network administrator creates a firewall policy allowing HTTP traffic from the internal network to a web server in the DMZ. Users report that they cannot access the web server. The administrator runs 'diagnose firewall iprope list' and sees the policy is present. What is the MOST likely cause of the issue?

Accepted Answer

A deny policy with a lower policy ID is matching the traffic before the allow policy. The 'diagnose firewall iprope list' command confirms the allow policy exists in the FortiGate's kernel policy list, meaning it is present and enabled. However, FortiGate evaluates policies in sequential order based on policy ID (lowest first), so a deny policy with a lower ID that matches the same traffic (e.g., from internal to DMZ) will be hit first, blocking the HTTP request before the allow policy can be evaluated. This is the most likely cause because the policy is present but not being matched due to ordering.

Answer

The firewall policy has an incorrect source interface

Answer

The policy is disabled

Answer

The web server is not responding to HTTP requests

Question 4

A FortiGate administrator is configuring ZTNA to secure access to an internal application. The administrator creates a ZTNA access proxy and a ZTNA rule. However, users connecting from the internet receive a 403 Forbidden error. The administrator verifies that the users are authenticated and the application is reachable. What is the MOST likely cause?

Accepted Answer

The ZTNA rule requires a specific client posture tag that the users' devices do not have. The 403 Forbidden error in ZTNA typically indicates that the client device does not meet the required security posture. Even though users are authenticated and the application is reachable, the ZTNA rule enforces a specific client posture tag (e.g., antivirus enabled, OS patch level) via FortiClient telemetry. If the device lacks the required tag, FortiGate denies access with a 403, as the ZTNA access proxy validates both identity and device compliance before proxying traffic.

Answer

The firewall policy allowing traffic to the application is placed after a deny-all policy

Answer

The application's IP address is not included in the ZTNA access proxy's destination

Answer

The ZTNA access proxy does not have a valid SSL certificate

Question 5

An admin is configuring a policy-based NAT (central SNAT) to translate internal users to a pool of public IPs using overload. The admin wants to ensure that specific applications using non-standard ports are not affected by NAT. Which THREE steps should the admin consider?

Accepted Answer

Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'. Adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation, ensuring that applications using non-standard ports are not affected by the overload behavior. Option B is correct because configuring a separate IP pool dedicated to those applications allows you to control the NAT behavior independently, such as using a pool without PAT or with a fixed port range, thereby avoiding port remapping issues. Option C is correct because using a fixed port range in the IP pool confines source port allocation to a specified range, accommodating applications that expect particular ports. Option D is incorrect because a VIP is for destination NAT, not source NAT, and does not address source port modification. Option E is incorrect because enabling NAT on the policy would translate all traffic, not protect specific applications.

Answer

Use central SNAT with a VIP for source NAT

Answer

Enable 'set nat enable' on the policy

Question 6

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 7

A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?

Accepted Answer

A security profile applied to the policy is blocking the HTTPS traffic.. Security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.

Answer

NAT is disabled, so the server cannot send replies back.

Answer

The policy order is incorrect; a deny policy above is blocking traffic.

Answer

The schedule is configured incorrectly and the policy is inactive during the current time.

Question 8

A FortiGate admin is configuring a hub-and-spoke IPsec VPN. The hub has multiple phase 2 configurations for each spoke. The spokes can communicate with the hub but not with each other. The admin wants to allow spoke-to-spoke traffic through the hub. Which configuration change is required on the hub?

Accepted Answer

Modify the Phase 2 selectors on the hub to include both spoke subnets and add firewall policies allowing traffic between the spoke networks. In a hub-and-spoke VPN with policy-based IPsec, the hub's Phase 2 selectors define which subnets can communicate through each tunnel. By default, each spoke's Phase 2 selector only includes the hub and that specific spoke's subnets, blocking spoke-to-spoke traffic. Adding both spoke subnets to the hub's Phase 2 selectors and creating firewall policies that permit traffic between those spoke networks allows the hub to route traffic between spokes, effectively enabling spoke-to-spoke communication through the hub.

Answer

Change the IPsec mode from policy-based to route-based

Answer

Enable 'add-route' on the hub's Phase 1 settings

Answer

Configure a static route on each spoke pointing to the other spoke's subnet via the tunnel

Question 9

A network administrator is configuring a new FortiGate and needs to ensure that all traffic from the internal network to the internet is source NATed to the public IP address on port1. The default route points to port1. Which configuration step is required to achieve this?

Accepted Answer

Enable NAT on the firewall policy from internal to internet. Source NAT (SNAT) on a FortiGate is configured at the firewall policy level, not on the interface or via a static route. By enabling NAT on the firewall policy from the internal network to the internet, the FortiGate automatically translates the source IP of traffic egressing port1 to the interface's primary IP address (the public IP). This is the standard method for implementing source NAT in FortiOS, as defined in the FortiGate Administration Guide.

Answer

Configure a static route to the internet with NAT enabled

Answer

Set the interface port1 to NAT mode in its settings

Answer

Create an IP pool with the public IP and reference it in the policy

Question 10

A network administrator wants to prevent users from downloading files with .exe extensions via HTTP and HTTPS. Which security profile feature should be used?

Accepted Answer

Antivirus profile with 'block' action for file pattern matching .exe. The Antivirus profile in FortiGate can be configured with a file pattern matching rule to block files based on their extension, such as .exe. This feature operates at the application layer, inspecting HTTP and HTTPS traffic (via SSL inspection) to identify and block executable files before they reach the user. Option C is correct because it directly uses the antivirus engine's file pattern matching capability to enforce this policy.

Answer

Web filter profile with URL filter to block .exe sites

Answer

Application control profile to block file transfer applications

Answer

IPS profile to block executable file transfers

Question 11

A network administrator notices that some users can access blocked web categories despite a web filter profile applied to the policy. The admin runs 'diagnose debug rating' and sees 'rating not allow' for the category. What is the MOST likely cause?

Accepted Answer

The web filter profile has an 'override' configured for those users. The 'rating not allow' message in the 'diagnose debug rating' output indicates that the FortiGate's rating engine correctly identified the category as blocked by the web filter profile. However, if an 'override' is configured for specific users or groups, it allows them to bypass the blocked category. This explains why some users can access the site despite the profile blocking it, as the override takes precedence over the profile's default action.

Answer

The policy is not using the correct web filter profile

Answer

DNS filter is allowing the domain

Answer

The FortiGuard web filter database is outdated

Question 12

A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following:
- Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53).
- Outbound NAT (IP Pool) for internal users to 203.0.113.1.
- Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services).

Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?

Accepted Answer

The port forwarding rule maps the public IP to the DMZ server, not the internal server. The port forwarding rule is configured to forward external HTTP requests (port 80) to the DMZ web server at 10.0.0.10. The internal web server at 192.168.1.10 is not covered by any port forwarding rule. Therefore, when internal users try to access the public IP 203.0.113.1:80, the traffic is not redirected to the internal server, and the request fails. This is the primary cause, not a missing hairpin NAT or misconfigured outbound NAT.

Answer

The firewall policy from internal to DMZ is blocking traffic

Answer

Hairpin NAT is not enabled on the FortiGate

Answer

The IP Pool for outbound NAT is misconfigured

Question 13

An administrator is troubleshooting a connectivity issue. A ping from the FortiGate to 8.8.8.8 succeeds, but traffic from internal hosts to the internet is failing. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The internal hosts have the wrong default gateway configured. Since the FortiGate can ping 8.8.8.8, its default route and internet connectivity are working. The issue is that internal hosts cannot reach the internet, which points to a Layer 3 forwarding problem at the host level. The most likely cause is that the internal hosts have the wrong default gateway configured, so their traffic is not being sent to the FortiGate for routing.

Answer

The default route on the FortiGate is missing

Answer

DNS resolution is failing

Answer

The FortiGate's interface to the internal network is down

Question 14

A FortiGate is configured with flow-based antivirus and an IPS profile on a policy. The administrator runs 'diagnose ips packet-list' and sees that packets are being forwarded without inspection. What is the most likely reason?

Accepted Answer

The session is offloaded to the NPU and is not being sent to the IPS engine. When a FortiGate offloads a session to the NPU (Network Processor Unit), the traffic bypasses the CPU and therefore does not reach the IPS engine for inspection. The 'diagnose ips packet-list' command shows packets forwarded without inspection because the NPU handles them directly, and flow-based inspection requires the session to be processed by the IPS engine on the CPU. This is the most likely reason when the administrator observes packets bypassing inspection despite having flow-based antivirus and IPS profiles applied.

Answer

The antivirus profile is set to proxy-based, conflicting with flow-based IPS

Answer

The IPS profile is configured with 'monitor' mode instead of 'protect'

Answer

The traffic is UDP and flow-based inspection does not inspect UDP

Question 15

A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?

Accepted Answer

The user is not a member of the configured user group. The most likely cause is that the user is not a member of the configured user group. In FortiGate, when LDAP authentication is used for a captive portal, the FortiGate first verifies the user's credentials against the LDAP server. Even if the credentials are valid, the FortiGate then checks whether the authenticated user belongs to a specific user group that is permitted to access the captive portal. If the user is not a member of that group, the authentication fails, even though the LDAP server itself accepts the credentials.

Answer

The captive portal is using HTTP instead of HTTPS

Answer

The captive portal interface is not in the same VDOM as the LDAP server

Answer

The LDAP server requires TLS and FortiGate is using plain LDAP

Question 16

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The FortiGuard antivirus subscription has expired

Question 17

A FortiGate administrator is configuring a route-based IPsec VPN between two FortiGate devices. After setting up the tunnel and firewall policies, traffic does not flow. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. 'get router info routing-table all' shows routes on both sides. However, pings from the local network to the remote network fail. What is the MOST likely cause?

Accepted Answer

The firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. The tunnel is up and routes are present, indicating Phase 1 and Phase 2 negotiations succeeded. The most likely cause is that the firewall policy allowing traffic to the remote subnet has the source and destination interfaces reversed. In a route-based VPN, the policy must have the incoming interface as the source (e.g., internal) and the outgoing interface as the destination (e.g., the VPN tunnel interface). Reversing these prevents traffic from being matched, even though the tunnel is established.

Answer

The pre-shared key is incorrect

Answer

The remote FortiGate's static route points to the wrong local subnet

Answer

The Phase 2 proposal uses different encryption algorithms on each side

Question 18

A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?

Accepted Answer

The new policy is placed below the older policy in the policy list. A FortiGate firewall evaluates policies sequentially from top to bottom, applying the first match. If the new policy is placed below an older policy with a broader source definition, traffic from 'Internal_Net' will match the older policy first and never reach the new policy. Therefore, option B is the correct answer.

Answer

The source address object 'Internal_Net' has an incorrect subnet mask

Answer

The new policy is disabled

Answer

Traffic shaping is applied to the new policy and is interfering

Question 19

An admin runs the command 'diagnose firewall iprope list 100000' and sees the following output:
id=2000000000 action=deny flag=0x0 src-interface=any dst-interface=any proto=0 src-addr=0.0.0.0-255.255.255.255 dst-addr=0.0.0.0-255.255.255.255
What does this entry represent?

Accepted Answer

The implicit deny policy at the end of the policy list. The output shows an entry with id=2000000000, action=deny, and source/destination addresses covering all possible IPs (0.0.0.0-255.255.255.255). In FortiGate, the implicit deny policy is automatically inserted at the end of the policy list with a high ID (typically 2000000000) and matches any traffic that hasn't been permitted by earlier policies. This is not a user-created policy but the built-in default deny rule.

Answer

A loopback interface policy

Answer

A user-created deny policy that blocks all traffic

Answer

A NAT policy that translates all addresses

Question 20

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

Accepted Answer

The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy. The FQDN object in a policy above the allow policy resolved to an IP that includes 203.0.113.5. FortiGate performs policy lookup based on cached IP addresses for FQDN objects. Since the FQDN object's cached IP now matches the destination IP of the website, traffic hits the higher-priority policy (which likely denies or otherwise blocks the traffic) before reaching the allow policy. This is why users cannot access the website despite the allow policy existing.

Answer

The destination NAT on the allow policy is misconfigured

Answer

The FortiGate's DNS server is not resolving the FQDN correctly

Answer

The antivirus profile on the allow policy is blocking the website