NSE4 Practice Test 21 — 15 Questions

Question 1

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the IP pool type to 'Fixed Port Range'. When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.

Answer

Disable NAT and use policy-based routing

Answer

Use Central SNAT instead of policy-based NAT

Answer

Enable 'Preserve Source Port' in the firewall policy

Question 2

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 3

A FortiGate is configured with an IPsec VPN to a remote site using IKEv1. The VPN tunnel goes down intermittently. The admin runs 'diagnose vpn ike gateway list' and sees 'state=UP' but no Phase2 selectors. What is the most likely cause?

Accepted Answer

Mismatched Phase2 parameters between the local and remote gateways. When 'diagnose vpn ike gateway list' shows the IKE gateway state as UP but no Phase2 selectors are present, it indicates that the IKE Phase1 (main mode or aggressive mode) has completed successfully, but the IPsec Phase2 (quick mode) negotiation has failed. The most common cause for this is a mismatch in Phase2 parameters such as encryption algorithm, authentication algorithm, or proxy IDs (local/remote subnets) between the local and remote gateways. Since the tunnel goes down intermittently, the Phase2 rekey may be failing due to these mismatches, causing the tunnel to drop until a successful renegotiation occurs.

Answer

The firewall policy allowing IPsec traffic is misconfigured

Answer

The remote gateway has a different PSK

Answer

Dead Peer Detection (DPD) is disabled

Question 4

A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?

Accepted Answer

Use policy-based routing (PBR) to route traffic based on destination. Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.

Answer

Create a VIP for the cloud service

Answer

Configure static routes with different distances

Answer

Use SD-WAN rules to load balance

Question 5

Which two inspection modes are available for antivirus scanning on a FortiGate?

Accepted Answer

Flow-based and proxy-based. FortiGate offers two distinct inspection modes for antivirus scanning: flow-based and proxy-based. Flow-based inspection uses a single-pass, low-latency engine that examines traffic as it passes through, while proxy-based inspection buffers and reassembles the entire file before scanning, providing deeper analysis at the cost of higher latency. Both modes are configured within the antivirus security profile to match different performance and security requirements.

Answer

Stateful and stateless

Answer

Inline and passive

Answer

Kernel-based and user-based

Question 6

An organization has multiple remote sites connected via IPsec VPN. The administrator needs to ensure that traffic from the internal network (10.0.0.0/8) to the VPN destination (10.10.0.0/16) uses a specific interface (port2) instead of the default route. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) allows you to override the default routing table by matching traffic based on source/destination addresses and directing it to a specific egress interface (port2). This is the correct feature because the requirement is to force traffic from 10.0.0.0/8 to 10.10.0.0/16 out port2, bypassing the default route.

Answer

Central NAT

Answer

Static route with higher distance

Answer

Traffic shaping

Question 7

What is the purpose of a 'realm' in FortiGate SSL VPN configuration?

Accepted Answer

To create distinct portals with separate authentication and access policies.. In FortiGate SSL VPN, a 'realm' allows the administrator to create distinct login portals, each with its own authentication requirements and access policies. This enables different user groups (e.g., employees vs. contractors) to have separate VPN experiences without requiring multiple FortiGate interfaces or IP pools. The realm is appended to the VPN URL (e.g., https://fortigate:10443/remote/portal) to direct users to the correct portal.

Answer

To enable two-factor authentication.

Answer

To specify the authentication server for the VPN.

Answer

To define the encryption algorithm for SSL VPN.

Question 8

A FortiGate administrator is configuring FSSO to authenticate users transparently. The FSSO collector agent is installed on a Windows server in the domain. Which TWO requirements must be met for FSSO to work correctly?

Accepted Answer

The FortiGate must be able to reach the FSSO collector agent on TCP port 8000 (or the configured port). The FortiGate must communicate with the FSSO collector agent over TCP port 8000 (or a custom port) to receive real-time user login/logoff events. This connection is essential for the FortiGate to map IP addresses to authenticated domain users and enforce identity-based firewall policies. Without this reachability, the FortiGate cannot obtain the necessary user-to-IP mappings from the collector agent.

Answer

The FortiGate must be a member of the Active Directory domain

Answer

The users must authenticate via captive portal at least once

Answer

The firewall policies must use FSSO groups directly without any user objects

Question 9

An admin configures a central SNAT rule to translate source IP 10.0.0.0/24 to IP pool 203.0.113.1-203.0.113.10 using overload (PAT). A policy-based NAT on a specific policy also translates the same source to the interface IP. Traffic from 10.0.0.0/24 to the internet shows source IP as the interface IP, not from the IP pool. What is the reason?

Accepted Answer

Policy-based NAT overrides central SNAT rules. Policy-based NAT (PBNAT) takes precedence over central SNAT rules because it is applied directly to a specific firewall policy. When a policy matches traffic, its NAT configuration (including translation to the interface IP) is evaluated before any central SNAT rules. This override occurs regardless of the central SNAT rule's order or status, as PBNAT is considered more specific and thus higher priority in FortiOS.

Answer

The central SNAT rule is disabled

Answer

The policy is using fixed port range

Answer

The IP pool is out of addresses

Question 10

A FortiGate is configured with IPsec VPN using IKEv2 and a policy-based tunnel. The remote subnet is 10.0.2.0/24, and the local subnet is 192.168.1.0/24. The tunnel is up, but traffic from 192.168.1.0/24 to 10.0.2.0/24 fails. The administrator checks the firewall policy and sees a policy allowing traffic from the local interface (port1) to the remote interface (virtual ipsec interface) with the action set to IPSEC. What is the most likely missing configuration?

Accepted Answer

The firewall policy's source or destination addresses are not correctly set to the local and remote subnets. In a policy-based IPsec VPN on FortiGate, the firewall policy must explicitly specify the local and remote subnets as the source and destination addresses. Even if the tunnel is up, traffic will fail if the policy's source/destination address objects do not match the actual subnets (192.168.1.0/24 and 10.0.2.0/24). The action set to IPSEC only enables VPN encapsulation; it does not override incorrect address matching.

Answer

IKEv2 does not support policy-based VPNs

Answer

The tunnel interface is not assigned to the correct VDOM

Answer

The Phase 2 proposal does not match the remote subnet

Question 11

An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?

Accepted Answer

The policy route's incoming interface is incorrectly configured. Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.

Answer

The static default route has a lower administrative distance than the policy route

Answer

The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM

Answer

The policy route has a lower priority than the static default route

Question 12

An administrator configures an HA cluster of two FortiGates in active-passive mode. The cluster is synchronized, but after a failover, some existing TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization (session-pickup) is disabled. Session synchronization (session-pickup) is required for active-passive HA clusters to replicate TCP session state from the primary FortiGate to the secondary. When disabled, the backup unit has no knowledge of existing sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in NAT mode

Answer

The cluster is using a virtual MAC address for the HA interface

Question 13

An administrator runs the command 'diagnose ips anomaly list' and sees many entries for 'tcp_src_session' with high counts. Users report slow internet. What is the most likely issue?

Accepted Answer

A host on the network is infected with malware that is generating many outbound connections. The 'diagnose ips anomaly list' command displays anomalies detected by the IPS engine, and 'tcp_src_session' tracks the number of TCP sessions originating from a single source IP. A high count indicates a single host is initiating an excessive number of outbound TCP connections, which is a classic sign of malware infection (e.g., a botnet client or worm) that is generating numerous outbound connections, consuming bandwidth and causing slow internet for users.

Answer

The IPS signature database is corrupted

Answer

The FortiGate has a hardware failure

Answer

The FortiGate is under a DDoS attack

Question 14

An admin notices that a firewall policy allowing inbound HTTPS to a server is not matching traffic. The policy has source set to 'all', destination to the server's IP, and service to HTTPS. The admin checks the policy list and sees that policy ID 1 matches the traffic. What is the MOST likely reason the intended policy (ID 10) is not matching?

Accepted Answer

Policy ID 1 has a higher priority and matches before policy ID 10. Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

Answer

The firewall policy is disabled

Answer

The service object for HTTPS is misconfigured in policy ID 10

Answer

The destination address is incorrect in policy ID 10

Question 15

A company policy requires that all web searches by employees use safe search. Which setting should be configured in the web filtering profile?

Accepted Answer

Enable 'Enforce 'Safe Search' on Google, Bing, and Yahoo'. The 'Enforce Safe Search' setting in a FortiGate web filtering profile forces Google, Bing, and Yahoo to use their built-in safe search parameters (e.g., &safe=active for Google). This ensures that all web searches from the network comply with the company policy by appending the required query strings to search URLs, blocking explicit content at the search engine level.

Answer

Enable 'Restrict YouTube Access'

Answer

Create a URL filter to block URLs with 'safe search'

Answer

Set the 'Action' for FortiGuard categories to 'Warning'