NSE4 Practice Test 21 — 15 Questions

Question 1

An administrator has configured DLP sensors to detect credit card numbers in outgoing traffic. However, the administrator notices that traffic containing credit card numbers is still passing through undetected. The firewall policy uses flow-based inspection. What is the MOST likely reason DLP is not detecting the data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DLP requires proxy-based inspection to perform data leakage detection.. DLP requires proxy-based inspection to buffer and analyze the content. Flow-based inspection does not support DLP.

Answer

The DLP sensor is not applied to the correct firewall policy.

Answer

The DLP sensor is configured with the wrong regular expression.

Answer

The credit card numbers are encrypted by SSL and deep inspection is not enabled.

Question 2

An administrator wants to configure SNMP on a FortiGate to allow a monitoring server 192.168.1.100 to poll read-only information. Which set of commands is correct?

Accepted Answer

config system snmp community
edit 1
set name public
set query enable
set query-port 161
set hosts 192.168.1.100
end. SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.

Answer

config system snmp sysinfo
set status enable
set community public
set trap-receiver 192.168.1.100
end

Answer

config system snmp
set enable
set community public
set host 192.168.1.100
end

Answer

config system interface
edit port1
set snmp-index 1
set allowaccess snmp
end

Question 3

An administrator runs 'diagnose debug flow' for a specific policy and sees the following output:
id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet'
What does this indicate?

Accepted Answer

The destination IP address has no matching route in the routing table. The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

Answer

The packet is being blocked by a firewall policy

Answer

The source interface is down

Answer

The session table is full

Question 4

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Accepted Answer

Using a data interface as the heartbeat interface. Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Answer

Different firmware versions on cluster members

Answer

Mismatched HA passwords between cluster members

Answer

Mismatched HA priority values

Question 5

A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?

Accepted Answer

Add the server certificates to the FortiGate's trusted CA store. Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to validate those certificates during SSL deep inspection. This prevents certificate errors for users, as the FortiGate will trust the self-signed certificates and generate a valid signed certificate for the client, avoiding browser warnings.

Answer

Configure the firewall policy to accept invalid certificates

Answer

Use certificate inspection instead of deep inspection

Answer

Disable deep inspection for those servers

Question 6

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which step is necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. To block BitTorrent traffic, the admin must add the BitTorrent application signature to the application control profile and set the action to block (option B). Application control can detect BitTorrent even though it uses proprietary encryption—FortiGate uses protocol decoders and signature matching on unencrypted handshake data. SSL deep inspection (option E) is not required because BitTorrent does not use SSL/TLS encryption; enabling deep inspection would not help and would add unnecessary overhead. Options A, C, and D are also unnecessary: DNS filter does not block the application itself, proxy-based inspection is not mandatory, and deep inspection (in the profile) is not the correct setting.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Answer

Enable SSL deep inspection on the firewall policy

Question 7

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

Accepted Answer

Policy-based routing (PBR). Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Answer

Equal-cost multi-path (ECMP) routing

Answer

Static route with higher distance

Answer

SD-WAN with load balancing

Question 8

A network administrator notices that traffic from a specific internal host is not being inspected by the application control profile applied to the firewall policy. The policy is configured with proxy-based inspection and the application control profile includes a rule to block 'Facebook'. The administrator confirms the host can still access Facebook. What is the MOST likely cause?

Accepted Answer

The host is accessing Facebook over HTTPS and the policy does not have SSL/TLS deep inspection enabled.. The most likely cause is that the host is accessing Facebook over HTTPS, and the firewall policy does not have SSL/TLS deep inspection enabled. Without deep inspection, the firewall cannot decrypt the HTTPS traffic to inspect the application layer payload, so the application control profile cannot identify or block 'Facebook' traffic. Proxy-based inspection requires decryption to match application signatures for encrypted traffic.

Answer

The firewall policy is using flow-based inspection instead of proxy-based.

Answer

The application control profile is configured with 'deep inspection' disabled.

Answer

The application control profile is applied only to outgoing traffic, but the host is using a proxy.

Question 9

A FortiGate administrator needs to ensure that all internal users (10.0.0.0/8) accessing the internet use a single public IP address 203.0.113.10 for source NAT. Which NAT configuration should be used?

Accepted Answer

Create a Central SNAT rule with a Dynamic IP Pool using overload. Central SNAT with a Dynamic IP Pool using overload (Port Address Translation) allows all internal users in 10.0.0.0/8 to share a single public IP (203.0.113.10) by dynamically mapping multiple private source IPs and ports to unique source ports on the public IP. This is the standard method for many-to-one NAT, ensuring all outbound internet traffic appears from the same public address.

Answer

Enable NAT on the outgoing interface policy without an IP pool

Answer

Create a policy-based NAT rule with fixed port range

Answer

Configure a VIP with port forwarding

Question 10

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

Accepted Answer

A firewall is blocking the required ports between FortiGate and FortiAnalyzer.. The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Answer

The FortiAnalyzer is not registered with the FortiGate.

Answer

The FortiGate is not generating any logs.

Answer

The FortiAnalyzer SNMP community string is incorrect.

Question 11

An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?

Accepted Answer

The destination interface should be the internal interface, not wan1. The VIP maps the public IP to the internal server, but the firewall policy's destination interface is set to 'wan1', which is the external interface. Traffic arriving on wan1 and destined for the VIP must be processed by a policy where the destination interface is the internal interface (e.g., 'internal' or 'lan') so that the firewall can route the decapsulated traffic to the private server. Setting the destination interface to wan1 prevents the firewall from forwarding the traffic to the internal network, breaking connectivity.

Answer

The policy needs NAT enabled

Answer

The source interface should be the internal interface

Answer

The VIP is not associated with the policy

Question 12

A FortiGate administrator has configured a firewall policy allowing HTTP traffic from the internal network (10.0.1.0/24) to the DMZ server (192.168.1.10). The policy is placed after a deny-all policy that blocks traffic from internal to DMZ. Even though the allow policy is more specific, traffic is still being denied. What is the most likely cause?

Accepted Answer

The deny-all policy is placed above the allow policy in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom. The first matching policy is applied, and subsequent policies are ignored. Since the deny-all policy is placed above the more specific allow policy, traffic from 10.0.1.0/24 to 192.168.1.10 matches the deny-all first and is dropped, never reaching the allow rule.

Answer

The deny-all policy has a higher policy ID than the allow policy

Answer

The allow policy is configured with the wrong source interface

Answer

The allow policy uses a schedule that is not active at the current time

Question 13

Which web filtering feature allows an administrator to force web search engines to filter explicit content in search results, regardless of the user's browser settings?

Accepted Answer

Safe search. Safe search is a web filtering feature that forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific query parameters (such as `safe=active` for Google) to the search request. This enforcement occurs at the FortiGate proxy level, overriding the user's browser settings and ensuring compliance with acceptable use policies.

Answer

DNS filter

Answer

URL filter

Answer

Application control

Question 14

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

Accepted Answer

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.. SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Answer

Remove the slower link from the SD-WAN interface.

Answer

Increase the bandwidth on the slower link.

Answer

Configure policy-based routing for the SaaS application.

Question 15

What is the order of evaluation for firewall policies on a FortiGate?

Accepted Answer

From top to bottom, first match. FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.

Answer

Random order

Answer

From bottom to top

Answer

By policy ID in ascending order