NSE4 Practice Test 23 — 15 Questions

Question 1

An administrator notices that traffic to a specific HTTPS website is being blocked. The FortiGate has SSL inspection enabled, and the web filter profile is set to monitor all categories. The URL is not in any blocked category. What should the administrator check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the SSL/SSH inspection profile's certificate revocation check settings.. When SSL inspection is enabled and a specific HTTPS site is blocked despite not being in a blocked category, the issue often lies in the SSL/SSH inspection profile's certificate revocation check. If the FortiGate cannot verify the server's certificate revocation status (e.g., via OCSP or CRL), it may block the connection as a security precaution, even if the web filter category allows the URL. Option B directly addresses this by suggesting a review of the revocation check settings.

Answer

Check if the SSL inspection policy is using certificate inspection instead of full SSL inspection.

Answer

Ensure that the FortiGate has the latest web filter database.

Answer

Verify that the web filter has the correct rating for the URL.

Question 2

Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?

Accepted Answer

The packet will be allowed (pass).. The IPS sensor in the exhibit defines rules only for severity 'medium' and 'critical', both with action 'block'. When a packet triggers a signature with severity 'low', it does not match any entry in the sensor. Therefore, the default action for unmatched signatures is to allow (pass) the traffic. FortiGate IPS sensors apply actions only to explicitly configured severity levels; unlisted severities are not affected.

Answer

The packet will be logged and a session will be created.

Answer

The packet will be blocked if the signature severity is 'low' or 'high'.

Answer

The packet will be blocked because the sensor is enabled.

Question 3

A FortiGate administrator needs to prevent data leakage by blocking the upload of files containing credit card numbers via web traffic. Which THREE components must be configured? (Choose three.)

Accepted Answer

DLP profile with a rule to detect credit card numbers. A DLP (Data Loss Prevention) profile is specifically designed to inspect content for sensitive data patterns, such as credit card numbers, using predefined or custom data patterns. When configured with a rule to detect credit card numbers, the DLP profile can block or log the upload of files containing such data over web traffic.

Answer

Application control profile to block file upload applications

Answer

Antivirus profile to scan the files for malware

Question 4

What is the primary function of Fortinet Single Sign-On (FSSO) in a FortiGate deployment?

Accepted Answer

To collect user login events from Active Directory for user-based policies. Fortinet Single Sign-On (FSSO) is designed to collect user login events from Active Directory (AD) domain controllers. It monitors authentication traffic (e.g., via NetAPI or polling the AD security event log) to map IP addresses to usernames, enabling FortiGate to enforce user-based firewall policies without requiring users to manually authenticate to the firewall.

Answer

To provide two-factor authentication using FortiToken

Answer

To sync FortiGate configuration with Active Directory

Answer

To authenticate users against a RADIUS server

Question 5

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

Accepted Answer

The hub is missing static routes to the spoke networks via the respective tunnel interfaces. In a hub-and-spoke route-based VPN, the hub uses tunnel interfaces for each spoke. After a reboot, the hub's routing table is cleared, and without static routes pointing to the spoke networks via the respective tunnel interfaces, the hub cannot forward traffic between spokes. Even though each spoke can reach the hub, inter-spoke traffic requires the hub to have explicit routes to the remote spoke networks, as dynamic routing protocols are not mentioned in this scenario.

Answer

The firewall policies on the hub do not allow traffic between the spoke networks

Answer

The spokes have mismatched IKE versions

Answer

The hub's IPsec Phase1 is not configured for DPD

Question 6

An administrator is troubleshooting an IPsec VPN that fails to establish Phase 2. The Phase 1 is up. The administrator runs 'diagnose vpn ike log' and sees the message 'no matching phase2 proposal found'. What is the MOST likely cause?

Accepted Answer

Phase 2 proxy ID mismatch. The message 'no matching phase2 proposal found' indicates that the IPsec security associations (SAs) proposed by the remote peer do not match the local Phase 2 configuration. Phase 2 uses proxy IDs (local/remote subnets and ports) to define which traffic should be encrypted. A mismatch in these proxy IDs, such as incorrect subnet definitions or protocol/port values, prevents the IKE negotiation from completing Phase 2, even though Phase 1 (which authenticates and establishes the IKE SA) is already up.

Answer

Pre-shared key mismatch

Answer

IKE version mismatch (IKEv1 vs IKEv2)

Answer

Phase 1 encryption algorithm mismatch

Question 7

An organization uses FortiSandbox to detect advanced threats. The administrator wants to ensure that files downloaded from the internet are sent to FortiSandbox for analysis before being delivered to users. Which Antivirus profile setting should be configured?

Accepted Answer

Enable 'Inline Scan' for FortiSandbox. To ensure files downloaded from the internet are sent to FortiSandbox for analysis before delivery to users, the 'Inline Scan' option for FortiSandbox must be enabled in the Antivirus profile. This setting causes the FortiGate to hold the file, send it to FortiSandbox, and only deliver it to the user after receiving a verdict (e.g., clean or malicious). Without inline scanning, files are delivered first and scanned asynchronously, which defeats the 'before delivery' requirement.

Answer

Enable 'FortiSandbox Monitoring'

Answer

Enable 'FortiSandbox Quarantine'

Answer

Set 'Scan Mode' to 'Quick'

Question 8

An administrator has configured LDAP authentication on a FortiGate. When testing the LDAP connectivity, the test succeeds. However, users cannot authenticate through the captive portal. What is a possible cause?

Accepted Answer

The user group is not configured to use the LDAP server. The LDAP connectivity test succeeds, confirming the FortiGate can reach and bind to the LDAP server. However, for captive portal authentication to work, the user group must be explicitly configured to reference the LDAP server as its remote authentication source. Without this mapping, the FortiGate does not know to send authentication requests to the LDAP server, even though the LDAP server connection itself is functional.

Answer

The captive portal is disabled

Answer

The LDAP server is not reachable from the captive portal interface

Answer

The LDAP server's SSL certificate is expired

Question 9

Refer to the exhibit. An administrator has configured the SSL/SSH profile shown. However, users are unable to access HTTPS websites. What is the most likely cause?

Accepted Answer

The 'untrusted-caname' should be set to a trusted CA certificate to handle untrusted server certificates.. When the SSL/SSH profile has 'untrusted-caname' set to 'Fortinet_CA_SSL' (an untrusted CA), the FortiGate cannot re-sign certificates from untrusted servers with a trusted CA. This causes HTTPS websites to fail as the client receives an untrusted certificate warning or connection error. Setting 'untrusted-caname' to a trusted CA certificate ensures that even untrusted server certificates are re-signed with a certificate the client trusts.

Answer

The port is set to 443, but HTTPS also uses port 8443.

Answer

The 'caname' is set to 'Fortinet_CA_SSL', which is not a valid certificate name.

Answer

The 'whitelist-mode' is disabled, which prevents inspection.

Question 10

An administrator uses 'diagnose sys session list' and sees the following output for a session: 'proto=6 proto_state=01 duration=3600 expire=3599'. The session is for HTTPS traffic. What does 'proto_state=01' typically indicate in FortiGate?

Accepted Answer

The session is in the initial connection setup phase (SYN_SENT). In FortiGate, 'proto_state=01' for TCP (proto=6) indicates the session is in the SYN_SENT phase, meaning the initial SYN packet has been sent but the three-way handshake is not yet complete. For HTTPS traffic, this shows the session is still in the connection setup stage, not fully established. The 'duration' and 'expire' values reflect the time since the session was created and the remaining timeout, which is typical for an incomplete handshake.

Answer

The session is being NATted

Answer

The session is fully established and active

Answer

The session is being inspected by a security profile

Question 11

A FortiGate administrator is troubleshooting an IPsec VPN between two FortiGates. The tunnel is established, but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees the following output:
IKE: phase 2 negotiation completed
IKE: IPsec SA up
What THREE possible causes should the administrator investigate?

Accepted Answer

Firewall policies on either FortiGate are not allowing traffic between the local and remote subnets. Even though the IPsec SA is up (phase 2 completed), traffic will not pass unless firewall policies explicitly permit traffic between the local and remote subnets. FortiGate requires a policy that allows the traffic and references the VPN tunnel interface as the outgoing interface.

Answer

The pre-shared key is incorrect

Answer

The IKE mode is set to aggressive mode on one side and main mode on the other

Question 12

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Accepted Answer

The gateway 203.0.113.1 (port1) is unreachable. When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

Answer

The second route is overwriting the first route

Answer

Both routes are equal-cost and load-balancing is not working

Answer

The configuration is invalid because duplicate default routes are not allowed

Question 13

In Fortinet ZTNA, what is the primary purpose of the ZTNA access proxy component?

Accepted Answer

To proxy connections to internal applications after authentication and device verification. The ZTNA access proxy is the core component that mediates user access to internal applications. It intercepts client requests, enforces authentication and device posture checks (via FortiClient telemetry), and then proxies the connection to the protected application. This ensures no direct network access is granted; all traffic must pass through the proxy, which validates trust before forwarding.

Answer

To act as a forward proxy for web traffic

Answer

To provide load balancing for multiple FortiGates

Answer

To terminate IPsec VPN tunnels

Question 14

An administrator configures an antivirus profile in proxy-based inspection mode on a FortiGate. However, SMTP traffic is not being scanned for viruses. The firewall policy includes the antivirus profile and the FortiGate has a valid FortiGuard subscription. What is the most likely cause?

Accepted Answer

The SMTP protocol is not enabled in the proxy options of the security profile. In proxy-based inspection mode, the antivirus profile relies on the proxy options to determine which protocols to scan. If SMTP is not explicitly enabled in the proxy options of the security profile, the FortiGate will not inspect SMTP traffic for viruses, even if the antivirus profile is applied to the policy and the FortiGuard subscription is valid.

Answer

Flow-based inspection is required for SMTP scanning

Answer

The FortiGate does not have a valid SSL certificate for SMTP inspection

Answer

The antivirus profile is configured to scan only HTTP traffic

Question 15

A FortiGate administrator needs to configure a policy route to send all traffic destined to 10.10.10.0/24 out through interface port3 instead of the default route. Which configuration steps are necessary?

Accepted Answer

Configure a policy route under 'config router policy' with destination 10.10.10.0/24 and output interface port3. Policy routes override the routing table for specific traffic based on criteria like source, destination, or protocol. Option D correctly configures a policy route under 'config router policy' to match destination 10.10.10.0/24 and set the output interface to port3, ensuring that traffic is forwarded out port3 regardless of the default route.

Answer

Add a firewall policy with source interface any, destination 10.10.10.0/24, and set the egress interface to port3

Answer

Create a static route for 10.10.10.0/24 with a lower distance pointing to port3

Answer

Set the default gateway to port3 and remove the existing default route