NSE4 Practice Exam 4 — 20 Questions

Question 1

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 2

An administrator needs to forward logs from a FortiGate to a FortiAnalyzer for centralized logging. The FortiAnalyzer IP is 10.10.10.10. Which configuration is required on the FortiGate?

Accepted Answer

config log fortianalyzer setting
 set status enable
 set server 10.10.10.10
 end. The FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Answer

config system central-management
 set type fortianalyzer
 set ip 10.10.10.10
 end

Answer

config log setting
 set fortianalyzer ip 10.10.10.10
 end

Answer

config log syslogd setting
 set server 10.10.10.10
 end

Question 3

A FortiGate is set to NAT/Route mode. The admin wants traffic from internal users to the internet to use an IP address on the WAN interface for source NAT. Which configuration is required?

Accepted Answer

Enable NAT on the policy from internal to WAN and set the outgoing interface to the WAN interface. In NAT/Route mode, source NAT (SNAT) is configured by enabling NAT on the firewall policy that governs traffic from the internal network to the WAN interface. When NAT is enabled on the policy and the outgoing interface is set to the WAN interface, FortiGate automatically translates the source IP of internal users to the primary IP address of that WAN interface (or a configured IP pool). This is the standard method for allowing internal users to access the internet with a public IP address.

Answer

Set the FortiGate to transparent mode

Answer

Configure a policy route to force traffic through a specific interface

Answer

Configure a virtual IP mapping internal IPs to the WAN IP

Question 4

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. DLP (Data Loss Prevention) profiles are specifically designed to inspect content such as credit card numbers in outbound emails and block them to prevent data leakage. While other profiles handle spam, web access, or malware, only DLP can perform pattern-based content inspection on email bodies and attachments.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 5

Which of the following statements about FortiGate backup is true?

Accepted Answer

The backup file contains the full configuration and can be encrypted with a password. FortiGate backup files contain the full device configuration, including all settings and policies, and can be encrypted with a password using the 'execute backup config' command with the 'password' option. This ensures confidentiality during storage or transfer, as the backup is stored in a binary format that requires the password for decryption during restoration.

Answer

The backup includes all current sessions and logs

Answer

A backup can be restored only on the same hardware model

Answer

Backup files are saved in plain text format

Question 6

An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic. A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.

Answer

Set DNS server to FortiGate's IP

Answer

Enable sinkhole on the DNS filter profile

Answer

Configure SSL deep inspection for DNS over HTTPS

Question 7

A FortiGate administrator needs to block all traffic from a specific IP address (10.0.0.100) to the internet, but allow all other internal users. The administrator has created a firewall policy with source=10.0.0.100, destination=all, service=all, action=DENY, and placed it at the top of the policy list. Which TWO additional steps should the administrator take to ensure the block is effective? (Choose two.)

Accepted Answer

Enable the policy. A newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

Answer

Configure an IP Pool for the deny policy

Answer

Add a schedule to the policy for business hours

Answer

Set the action to ACCEPT

Question 8

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. The Geography address object type in FortiGate allows you to match traffic based on the source or destination country by using the ISO 3166-1 alpha-2 country codes. This is configured within a firewall policy to enforce geo-blocking or geo-allowance, leveraging FortiGuard's GeoIP database to map IP addresses to countries.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 9

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Accepted Answer

Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.. Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Answer

Disable DPD on the phase1 interface to reduce overhead.

Answer

Use aggressive mode for faster IKE negotiation.

Answer

Disable PFS to reduce CPU load on the firewall.

Question 10

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session for HTTPS traffic. The output shows `proto=6` (TCP), `proto_state=01` (TCP established), `dport=443` (HTTPS), and a duration/expire indicating an active session. This confirms an established TCP session for HTTPS traffic, making D correct.

Answer

The session is a half-open TCP connection

Answer

The session is a multicast session

Answer

The session is a UDP session for DNS over HTTPS

Question 11

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security

Question 12

Which of the following best describes the difference between flow-based and proxy-based inspection for antivirus scanning?

Accepted Answer

Flow-based inspection uses pattern matching and anomaly detection with low latency, while proxy-based provides full content reassembly and higher detection rates. Flow-based inspection uses pattern matching and anomaly detection to scan traffic with low latency, while proxy-based inspection fully reassembles files and content, enabling deeper analysis and higher detection rates. In Fortinet's FortiOS, flow-based mode is optimized for performance, whereas proxy-based mode provides more thorough inspection by buffering and reconstructing the entire data stream before scanning.

Answer

Flow-based inspection reassembles the entire file before scanning, while proxy-based scans packets on the fly

Answer

Flow-based inspection scans first packet and allows, while proxy-based buffers the entire session

Answer

Flow-based inspection requires SSL deep inspection, while proxy-based does not

Question 13

Which of the following is NOT a valid address object type in FortiGate?

Accepted Answer

MAC address. FortiGate address objects support Subnet, Wildcard FQDN, and Geography types, but MAC addresses are not a valid address object type. MAC addresses are used in other contexts like static ARP entries or DHCP reservations, not as firewall address objects.

Answer

Subnet

Answer

Wildcard FQDN

Answer

Geography

Question 14

An administrator needs to ensure that a firewall policy applies only during business hours (Monday to Friday, 9:00 AM to 6:00 PM). What object should be configured and applied to the policy?

Accepted Answer

Schedule object. A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

Answer

Service group

Answer

Address group

Answer

Traffic shaper

Question 15

A large enterprise is deploying a FortiGate 600F as the perimeter firewall. The security team requires that all administrative access (SSH, HTTPS, and Ping) to the FortiGate must be restricted to a dedicated management network (10.10.10.0/24). Additionally, any failed login attempt from outside the management network should be logged and the source IP should be blocked for 30 minutes. The administrator has configured a local-in policy to deny all administrative access from non-management networks and enabled logging. However, the administrator wants to automatically block the offending IPs. The FortiGate is not connected to any FortiAnalyzer or FortiManager. What should the administrator do to achieve this?

Accepted Answer

Create an automation stitch that triggers on local-in policy logging and adds the source IP to a blocked list via CLI script.. An automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

Answer

Use a FortiAnalyzer to generate alerts and send to SIEM.

Answer

Configure a firewall policy to block the offending IPs manually based on logs.

Answer

Enable 'set block-session-ttl' on the local-in policy.

Question 16

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy must specify the destination address of the traffic, which is the web server at 192.168.2.10. Without an address object for this server, the policy cannot match the destination IP of the VPN users' HTTP requests.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 17

An administrator plans to upgrade FortiGate firmware from version 6.0 to 7.2. The current version is 6.0.10. Which upgrade path is correct?

Accepted Answer

Upgrade to 6.2, then 6.4, then 7.0, then 7.2. FortiGate firmware upgrades must follow a supported path that does not skip major versions. Upgrading from 6.0.10 to 7.2.0 requires stepping through 6.2, 6.4, and 7.0 because Fortinet only supports upgrades from one major version to the next major version (e.g., 6.0→6.2→6.4→7.0→7.2). Option D correctly lists this sequential path.

Answer

Upgrade to 6.4 first, then to 7.2

Answer

It is not possible to upgrade from 6.0 to 7.2

Answer

Direct upgrade from 6.0.10 to 7.2.0 is supported

Question 18

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy B is correct because at 8:00 AM on Saturday, the 'WorkHours' schedule (Mon-Fri 9-17) is not active. FortiGate evaluates policies sequentially; when the first matching policy's schedule is inactive, the firewall skips it and continues to the next policy. Policy B with schedule 'Always' matches and permits the traffic.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 19

A FortiGate has two firewall policies for HTTP traffic to the internet: Policy A (source: 10.0.1.0/24) and Policy B (source: 10.0.2.0/24). Both policies have the same destination and service. The admin wants to apply a traffic shaper to limit bandwidth for Policy B. Which TWO actions are correct? (Choose two.)

Accepted Answer

Create a traffic shaping policy that matches Policy B's source and apply the shaper. A traffic shaping policy can match the source address of Policy B (10.0.2.0/24) and apply a specific shaper, allowing granular bandwidth control without affecting Policy A. Option E is correct because FortiGate allows a traffic shaper to be applied directly within a firewall policy's 'Traffic Shaping' settings, which overrides any default or VDOM-level shaping. Both methods achieve the goal of limiting bandwidth for Policy B only.

Answer

Apply the shaper to both policies and use a different shaper for Policy B

Answer

Use a QoS queue on the outgoing interface

Answer

Enable traffic shaping on the VDOM

Question 20

A FortiGate policy allows traffic from the internal network to a DMZ server. The admin wants to limit access to only specific hours. Which object type should be used in the policy?

Accepted Answer

Schedule. A schedule object is the correct choice because it defines time-based conditions (e.g., specific hours, days, or recurring intervals) that FortiGate applies to firewall policies. By attaching a schedule to a policy, the admin can restrict traffic to the DMZ server only during the permitted hours, such as business hours or maintenance windows.

Answer

Address group

Answer

Service group

Answer

Traffic shaper