NSE4 Practice Test 22 — 15 Questions

Question 1

A FortiGate has a policy-based NAT rule that translates source IPs from subnet 192.168.1.0/24 to 203.0.113.10 when accessing the internet. The admin also enables Central SNAT with a rule that translates the same subnet to 203.0.113.20. If both are configured, which translation will be applied to traffic from 192.168.1.0/24 to the internet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy-based NAT because it is evaluated first. Policy-based NAT is evaluated before Central SNAT because it is directly tied to the firewall policy that matches the traffic. When a policy-based NAT rule exists for the same traffic, it takes precedence over Central SNAT rules, regardless of any global settings or rule IDs. Therefore, the source IPs from 192.168.1.0/24 will be translated to 203.0.113.10.

Answer

Both translations will be applied, causing an error

Answer

Central SNAT because it is a global setting

Answer

The FortiGate will use the translation from the policy with the highest ID

Question 2

A FortiGate has two policies for traffic from port1 to port3: Policy 1 (destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (destination 10.0.2.0/24, schedule 'Weekdays', action accept). A packet destined to 10.0.2.10 arrives on Wednesday at 2 PM. Which policy is applied?

Accepted Answer

Policy 2 because it matches the destination and the schedule is active. Policy 2 is applied because it matches the destination IP (10.0.2.10) and the schedule 'Weekdays' is active on Wednesday at 2 PM. FortiGate uses a first-match approach only when multiple policies have the same priority; here, Policy 1 does not match the destination, so Policy 2 is the only matching policy. Since the schedule is valid, the action 'accept' is executed.

Answer

Both policies are applied sequentially

Answer

Neither; the implicit deny applies

Answer

Policy 1 because it is listed first

Question 3

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Accepted Answer

Add the FortiAnalyzer as a logging device in System > FortiAnalyzer. To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

Answer

Configure syslog server

Answer

Enable FortiCloud logging

Answer

Enable disk logging on the FortiGate

Question 4

What is the default action of the implicit deny policy at the end of the firewall policy list?

Accepted Answer

Deny. In FortiGate firewalls, the implicit deny policy at the end of the firewall policy list has a default action of 'Deny'. This means any traffic that does not match an explicit firewall policy is automatically dropped. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall.

Answer

Monitor (log only)

Answer

Allow

Answer

Redirect to authentication

Question 5

A network administrator notices that HTTP traffic is being scanned by the antivirus profile, but HTTPS traffic to the same web server is not being scanned. The firewall policy has the antivirus profile applied and SSL inspection is set to 'certificate-inspection'. What is the most likely reason HTTPS traffic is not being scanned?

Accepted Answer

Certificate inspection does not decrypt the traffic, so the antivirus scanner cannot inspect the payload.. Certificate inspection only validates the SSL/TLS certificate without decrypting the traffic. Since the antivirus scanner requires access to the plaintext payload to detect threats, it cannot scan HTTPS traffic when only certificate inspection is configured. This is why HTTP traffic is scanned but HTTPS traffic is not.

Answer

The antivirus profile is configured in flow mode, which does not support scanning HTTPS traffic.

Answer

The web server is not using a cipher supported by the FortiGate.

Answer

The FortiGate is using proxy-based inspection, which does not support HTTPS scanning.

Question 6

A FortiGate admin is troubleshooting an IPsec VPN tunnel that fails to establish. The remote site uses aggressive mode. The local FortiGate is configured for main mode. The admin sees 'no proposal chosen' in the IKE debug. What is the MOST likely cause?

Accepted Answer

The IKE mode (main vs aggressive) does not match between peers. The 'no proposal chosen' error in IKE debug indicates a mismatch in the IKE parameters proposed by the peers. Since the remote site uses aggressive mode and the local FortiGate is configured for main mode, the IKE mode mismatch prevents the peers from agreeing on a proposal. IKE main mode and aggressive mode use different packet formats and exchange sequences, so they cannot negotiate a common proposal even if all other parameters match.

Answer

The pre-shared key is incorrect

Answer

The local firewall is blocking UDP port 500

Answer

The Phase 2 encryption algorithm is not supported

Question 7

A company wants to block all peer-to-peer file sharing applications on the network. Which FortiGate feature should be used to achieve this goal?

Accepted Answer

Application Control. Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

Answer

Web Filter

Answer

DNS Filter

Answer

Intrusion Prevention System (IPS)

Question 8

Which authentication method allows a FortiGate to transparently authenticate users based on their Active Directory login events without prompting for credentials?

Accepted Answer

FSSO (Fortinet Single Sign-On). Fortinet Single Sign-On (FSSO) allows FortiGate to transparently authenticate users by collecting login events from Active Directory domain controllers. It uses the NetAPI or a polling mechanism to capture user logon events without requiring any user interaction or credential prompts, enabling seamless identity-based policy enforcement.

Answer

RADIUS authentication

Answer

Local database authentication

Answer

LDAP authentication

Question 9

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in established state and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED state per Fortinet's session state encoding), `duration=3600` seconds (1 hour), and `expire=3599` seconds (nearly full lifetime remaining). This indicates the session is actively established and has been ongoing for one hour, matching the description of an established state session.

Answer

The session is in FIN_WAIT state

Answer

The session is in TIME_WAIT state and will close soon

Answer

The session is in SYN_SENT state waiting for a SYN-ACK

Question 10

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from a specific subnet out of a particular interface. The admin also has a firewall policy allowing that subnet to the internet. However, the traffic is not being routed as expected. What could be the issue?

Accepted Answer

The PBR rule uses an incorrect source or destination address. Policy-based routing (PBR) is evaluated before firewall policies. If the PBR rule specifies an incorrect source or destination address, traffic from the intended subnet will not match the PBR rule and will fall through to the default routing table, potentially exiting via a different interface. The firewall policy alone cannot override the routing decision; the PBR rule must correctly identify the traffic to steer it to the desired egress interface.

Answer

The firewall policy is placed above the PBR rule

Answer

The PBR rule does not have a matching protocol or service defined

Answer

The FortiGate is in transparent mode

Question 11

An administrator configures an email filter profile to block spam. Despite correct configuration, spam emails still reach users' inboxes. The FortiGate is deployed as a transparent bridge. What is the most likely reason?

Accepted Answer

The firewall policy is using flow-based inspection, which does not support SMTP proxy. In a transparent bridge deployment, FortiGate uses flow-based inspection by default, which does not support SMTP proxy-based email filtering. The email filter profile requires proxy-based inspection to intercept and block spam at the SMTP protocol level. Without enabling proxy-based inspection on the firewall policy, the FortiGate cannot apply the email filter profile effectively, allowing spam to pass through.

Answer

The FortiGate does not have a valid FortiGuard license

Answer

The emails are encrypted with TLS and deep inspection is not enabled

Answer

The email filter profile is set to 'monitor' instead of 'block'

Question 12

An administrator is creating firewall policies for a FortiGate that separates the internal network (10.0.1.0/24) from a DMZ (192.168.1.0/24). The goal is to allow HTTP traffic from the internal network to the DMZ web server (192.168.1.10) but deny all other traffic. What is the recommended security posture for the implicit deny policy?

Accepted Answer

Rely on the implicit deny policy at the end of the policy list, which will block all traffic not explicitly allowed. The implicit deny policy is a default, hidden policy at the end of the FortiGate policy list that denies all traffic not explicitly allowed by preceding policies. Since the administrator wants to allow only HTTP traffic from internal to the DMZ web server and deny all other traffic, relying on the implicit deny is the correct and recommended security posture. It automatically blocks everything else without requiring manual configuration, ensuring no unintended traffic is permitted.

Answer

Set the allow policy to also deny all other traffic using security profiles

Answer

Disable the implicit deny policy and create a catch-all deny policy

Answer

Create an explicit deny policy with logging enabled before the allow policy

Question 13

What is the purpose of the 'implicit deny' policy on a FortiGate?

Accepted Answer

It denies all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a default, last-resort rule that denies all traffic not matching any explicit firewall policy. It ensures that any packet that does not meet the source, destination, service, or schedule criteria of a configured policy is dropped, enforcing a default-deny security posture. This behavior is fundamental to stateful firewall operation and prevents unauthorized traffic from traversing the device.

Answer

It allows traffic from trusted internal networks

Answer

It logs all traffic that is denied

Answer

It allows all traffic that matches no other policy

Question 14

A FortiGate administrator runs the command 'diagnose application urlfilter 0 status' and sees 'status: enable' but users report that some malicious URLs are not blocked. The web filter profile uses FortiGuard categories with 'block' action. What should the administrator check next?

Accepted Answer

The FortiGuard web filter rating service is reachable. The 'diagnose application urlfilter 0 status' command shows that the URL filter process is enabled locally, but if the FortiGate cannot reach the FortiGuard rating service, it cannot retrieve category ratings for URLs. Without a valid rating, the device may allow malicious URLs by default (depending on the 'unrated' action), even if the profile is set to block certain categories. Option B is correct because checking the reachability of the FortiGuard web filter rating service is the logical next step to diagnose why categories are not being enforced.

Answer

The antivirus profile is blocking URL filtering

Answer

The DNS filter is overriding the web filter

Answer

The firewall policy is set to 'accept' without inspection

Question 15

A FortiGate administrator wants to send logs to a FortiAnalyzer. The FortiAnalyzer IP is 192.168.1.100, and logging is configured under Log & Report. However, no logs are being received. Which command should the administrator use on the FortiGate to verify connectivity to the FortiAnalyzer?

Accepted Answer

diagnose log device status. The 'diagnose log device status' command specifically checks the connectivity status and last-acknowledged sequence number between the FortiGate and the configured FortiAnalyzer. This command verifies whether the FortiGate can reach the FortiAnalyzer at the logging protocol level (FGFM), which is essential for log transmission, unlike a basic ICMP ping that only tests network-layer reachability.

Answer

execute ping 192.168.1.100

Answer

show full-configuration log fortianalyzer

Answer

get system ha status