NSE4 Practice Test 22 — 15 Questions

Question 1

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static routes for each branch's subnet pointing to the respective VPN interface. Static routes for each branch's subnet pointing to the respective VPN interface are required on the hub FortiGate so that the hub knows how to forward traffic destined for one branch's subnet out the correct IPsec tunnel to the other branch. Without these routes, the hub would have no path to the remote branch subnets and would drop the traffic, preventing direct branch-to-branch communication.

Answer

Enable 'forward traffic' in Phase 1 settings

Answer

Disable anti-replay on all tunnels

Question 2

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Accepted Answer

Authorize the FortiGate in the FortiManager GUI.. After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Answer

Enable VDOMs on the FortiGate.

Answer

Create a local admin account on the FortiGate for FortiManager to use.

Question 3

A FortiGate administrator notices that the IPsec VPN tunnel is established but traffic is not passing. The firewall policy allowing traffic from the remote subnet to the local subnet is in place. What is the MOST likely cause?

Accepted Answer

There is no static route on the FortiGate for the remote subnet pointing to the tunnel interface. When an IPsec VPN tunnel is established but traffic fails to pass, the most common cause is the lack of a static route on the FortiGate for the remote subnet pointing to the tunnel interface. Even with a correct firewall policy, the FortiGate cannot forward traffic to the remote subnet without a route that directs packets into the VPN tunnel interface (e.g., 'tunnel.1'). This is a fundamental routing requirement for route-based VPNs, which are the default configuration on FortiGate.

Answer

The VPN tunnel is a policy-based VPN and the policy is incorrectly configured

Answer

The Phase 2 proposal includes PFS, but the remote side does not

Answer

The local firewall is blocking ICMP

Question 4

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

Accepted Answer

The user's IP address is not in the source address range of the policy. Even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Answer

The user is not a member of the FSSO group

Answer

The FSSO collector agent is not running

Answer

The FortiGate is not polling the domain controller

Question 5

Which THREE of the following are valid methods to exclude certain HTTPS traffic from SSL inspection on a FortiGate?

Accepted Answer

Adding the domain to the 'SSL Exempt Domains' list in the SSL/SSH inspection profile.. The 'SSL Exempt Domains' list in the SSL/SSH inspection profile allows you to specify domain names (e.g., *.example.com) that will bypass SSL inspection entirely. When FortiGate matches the SNI field in the ClientHello or the certificate CN/SAN against this list, it skips decryption and passes the traffic through without inspection, reducing overhead for trusted or non-critical domains.

Answer

Setting the firewall policy action to 'accept' with no inspection.

Answer

Using a web filter category exemption.

Question 6

An organization wants to implement data leak prevention (DLP) to detect when credit card numbers are sent via email (SMTP) and webmail (HTTPS). The FortiGate is using proxy-based inspection. Which THREE configurations are necessary? (Choose three.)

Accepted Answer

Create a DLP sensor with a rule to match credit card patterns.. A DLP sensor is the FortiGate component that defines the data patterns to detect, such as credit card numbers. The sensor must be configured with a rule that uses a predefined or custom pattern to match the sensitive data.

Answer

Set the inspection mode to flow-based for better performance.

Answer

Configure the antivirus profile to scan email attachments.

Question 7

An administrator configures a policy route to direct traffic from subnet 10.1.1.0/24 to the internet via ISP1 with a gateway of 203.0.113.1. However, traffic from that subnet is still using the default route via ISP2. What is the MOST likely cause?

Accepted Answer

The source interface is not specified in the policy route. Policy routes in FortiGate are evaluated based on the source interface and source address. If the source interface is not specified, the policy route may not match the incoming traffic because the firewall does not know which interface the traffic is arriving on. Without a matching source interface, the policy route is skipped, and the default route (via ISP2) is used instead.

Answer

The default route has a lower administrative distance

Answer

The policy route's destination is set to 'all' which conflicts with the default route

Answer

The policy route is configured after the default route in the routing table

Question 8

A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?

Accepted Answer

Under system > admin > settings, restrict administrative access to trusted hosts.. The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.

Answer

Create a local-in policy to permit traffic from the management subnet.

Answer

Disable administrative access on all interfaces except the management interface.

Answer

Configure an inbound firewall policy allowing HTTPS from the management subnet to the FortiGate's interface IP.

Question 9

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

Accepted Answer

Move the allow policy above the deny policy. FortiGate policies are evaluated sequentially from top to bottom (lowest ID to highest ID). The first matching policy is applied. If an explicit deny policy appears above an allow policy for the same subnet, the deny policy will match first and drop the traffic. Moving the allow policy above the deny policy ensures it is evaluated first, allowing the traffic.

Answer

Add a new policy with a higher ID

Answer

Disable the deny policy

Answer

Delete the deny policy

Question 10

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover

Question 11

You run the CLI command 'diagnose vpn ike gateway list' and see that an IPsec VPN gateway is in 'up' state with 'initiator' mode, but no Phase 2 selectors are established. What is the most likely cause?

Accepted Answer

The local and remote Phase 2 selectors (proxy IDs) do not match. When an IPsec VPN gateway is in 'up' state with 'initiator' mode but no Phase 2 selectors are established, it indicates that IKE Phase 1 (main mode or aggressive mode) has completed successfully, but Phase 2 (quick mode) negotiation has failed. The most common cause for Phase 2 failure is a mismatch in the Phase 2 selectors (proxy IDs), which define the local and remote subnets to be encrypted. FortiGate uses these selectors to match traffic and establish the IPsec SA; if they do not align between peers, the Phase 2 negotiation will not complete.

Answer

The Phase 2 proposal parameters (encryption, authentication) do not match between peers

Answer

The remote gateway is not responding to IKE packets

Answer

The IPsec interface is down

Question 12

A network administrator wants to implement two-factor authentication for SSL VPN users using FortiToken. The users are already authenticated against an LDAP server. Which configuration step is required to enforce two-factor authentication?

Accepted Answer

Create a user group that uses LDAP as the authentication server and enable FortiToken two-factor authentication in the group settings. FortiGate requires a user group to combine LDAP authentication with FortiToken two-factor authentication. By creating a user group that uses LDAP as the authentication server and enabling FortiToken in the group settings, the FortiGate will first authenticate the user against LDAP and then prompt for a FortiToken code as the second factor. This is the standard method to enforce two-factor authentication for SSL VPN users without creating duplicate local users.

Answer

Create a local user with the same username as the LDAP user and assign a FortiToken to that local user

Answer

Configure the SSL VPN portal to require FortiToken and set the authentication server to LDAP

Answer

Set the SSL VPN authentication method to 'certificate' and use FortiToken as second factor

Question 13

A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?

Accepted Answer

In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication. For IPsec VPN authentication, the FortiGate must know which users are allowed to connect. Setting the peer type to 'dialup' in Phase 1 enables the FortiGate to accept connections from remote users rather than another gateway. Specifying the LDAP user group under authentication tells the FortiGate to validate the VPN user's credentials against that group's members, which are resolved via the LDAP server. Without this configuration, the FortiGate has no way to associate the LDAP group with the VPN tunnel.

Answer

Enable LDAP over TLS (LDAPS) on the FortiGate

Answer

Assign the LDAP user group to a firewall policy

Answer

Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP

Question 14

An administrator wants to inspect SSL traffic to a specific finance application that uses a custom port (9443) and a self-signed certificate. Which configuration is required?

Accepted Answer

Use deep inspection and add the application's self-signed certificate to the FortiGate's trusted CA list.. Deep inspection is required to decrypt and inspect SSL traffic using a self-signed certificate on a non-standard port. The FortiGate must trust the application's self-signed certificate by adding it to the trusted CA list; otherwise, the deep inspection proxy will fail to validate the certificate and drop the connection. Certificate inspection (Option A) only checks the certificate metadata without decrypting the payload, so it cannot inspect the actual application traffic.

Answer

Configure certificate inspection on the policy.

Answer

Disable SSL inspection for that application.

Answer

Use flow-based inspection with certificate inspection.

Question 15

A FortiGate administrator receives reports that users cannot access a legitimate website that uses HTTPS. The web filtering profile is configured with strict FortiGuard categories and 'monitor all' for unknown sites. The firewall policy has an SSL/SSH inspection profile set to 'deep-inspection'. What is the most likely cause of the issue?

Accepted Answer

The website uses a self-signed certificate which is not trusted by the FortiGate CA bundle. The most likely cause is that the website uses a self-signed certificate, which is not included in the FortiGate's trusted CA bundle. When deep inspection is enabled, the FortiGate acts as a man-in-the-middle and must validate the server's certificate against its CA store; a self-signed certificate fails this validation, causing the connection to be blocked. This is a common issue with strict inspection profiles that require trusted certificates.

Answer

The antivirus profile is blocking a file on the website

Answer

The DNS filter is blocking the domain

Answer

The website's FortiGuard category is set to 'block'