NSE4 Practice Test 24 — 15 Questions

Question 1

Which FortiGate operating mode is used when the device acts as a Layer 2 bridge without performing NAT?

Accepted Answer

Transparent mode. Transparent mode (Option B) is correct because in this mode the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any NAT or routing. The device is invisible to the network, and all interfaces share the same IP subnet, allowing it to inspect and filter traffic at the application layer while remaining transparent to connected devices.

Answer

HA mode

Answer

VPN mode

Answer

NAT/Route mode

Question 2

A FortiGate administrator needs to allow inbound SSH access from the internet to a single internal server at IP 10.0.1.10. The public IP on the WAN interface is 203.0.113.5. Which type of object should be configured to map the public IP and port to the internal server?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) object is the correct choice because it specifically maps a public IP and port (203.0.113.5:22) to a private IP and port (10.0.1.10:22) for inbound destination NAT (DNAT). This allows external SSH traffic to reach the internal server by translating the destination address and port at the FortiGate WAN interface.

Answer

IP Pool

Answer

Central NAT policy

Answer

Address object

Question 3

A FortiGate administrator wants to block spam emails destined for internal users. The FortiGate receives SMTP traffic on port 25. What is the most effective way to filter spam using the email filter profile?

Accepted Answer

Apply an email filter profile to a firewall policy that allows SMTP traffic. An email filter profile is specifically designed to inspect SMTP traffic and apply anti-spam techniques such as RBL, MIME header checks, and heuristic analysis. By applying the email filter profile to a firewall policy that allows SMTP traffic on port 25, the FortiGate can intercept and filter spam before it reaches internal users.

Answer

Enable spam filtering in the antivirus profile

Answer

Use a DNS filter to block spam domains

Answer

Configure a web filter to block webmail

Question 4

An administrator is configuring ZTNA on a FortiGate. The goal is to allow access to an internal web server only if the client device has a specific security posture (e.g., antivirus running). Which ZTNA component is responsible for verifying the client's security posture?

Accepted Answer

FortiClient EMS. FortiClient EMS (Endpoint Management Server) is the ZTNA component that verifies the client's security posture by collecting endpoint telemetry (e.g., antivirus status, OS patch level) and enforcing compliance policies. The FortiGate queries FortiClient EMS via the FortiTelemetry protocol to determine if the client meets the required security posture before granting access. Without EMS, the FortiGate has no mechanism to assess endpoint health in a ZTNA flow.

Answer

ZTNA access proxy

Answer

IPsec VPN interface

Answer

SSL VPN portal

Question 5

A network admin needs to log all traffic from the sales VLAN to the internet. The firewall policy is configured with logging enabled. However, the admin notices that only session start logs are generated, not detailed traffic logs. What setting must be enabled to capture per-packet or per-session details?

Accepted Answer

Set the log generation to 'All sessions' in the policy. In FortiGate, the 'Log Generation' setting on a firewall policy controls whether logs are generated for session start only or for all sessions. By default, a policy may log only session start events; setting it to 'All sessions' ensures that per-session details (including traffic volume, duration, and packet counts) are recorded. This is distinct from enabling security profiles, which inspect traffic but do not change the logging verbosity.

Answer

Enable 'Log Memory' on the policy

Answer

Enable security profiles

Answer

Configure a traffic shaper

Question 6

During a firmware upgrade, the FortiGate reboots and the administrator cannot access the GUI via HTTPS. The CLI shows the system is running the previous firmware. What is the most likely cause?

Accepted Answer

The upgrade failed and the system rolled back to the previous firmware.. FortiGate firmware upgrades include an automatic rollback mechanism. If the upgrade fails or the new firmware does not boot successfully, the system automatically reverts to the previous firmware partition during the next reboot. The administrator seeing the previous firmware and being unable to access the GUI indicates the upgrade did not complete successfully, triggering this rollback.

Answer

The firmware image was corrupted during upload.

Answer

The administrator booted from the wrong partition.

Answer

The administrator did not perform a factory reset before upgrading.

Question 7

A FortiGate admin wants to ensure that traffic destined to a specific web server is inspected by an IPS profile. Which configuration is necessary?

Accepted Answer

Create a security profile group containing the IPS profile and apply it to the policy. In FortiGate, IPS inspection is applied via a security profile group that includes the IPS profile, which is then attached to a firewall policy. The firewall policy itself does not have a direct 'enable IPS' toggle; instead, IPS profiles are part of the security profiles that must be explicitly assigned to the policy to inspect traffic.

Answer

Enable IPS on the firewall policy directly

Answer

Set the policy's action to 'IPS'

Answer

Configure a VIP for the web server

Question 8

An administrator is setting up SNMP monitoring on a FortiGate. Which two configurations are necessary for a basic SNMP setup? (Choose two.)

Accepted Answer

Configure an SNMP community with read-only access. An SNMP community with read-only access defines the basic authentication and access control for SNMPv1/v2c queries, which is essential for monitoring. Option C is correct because the SNMP agent must be enabled on the FortiGate to process SNMP requests from the monitoring server.

Answer

Create a firewall policy to allow SNMP traffic from the monitoring server

Answer

Set the SNMP trap destination IP

Answer

Configure a user for SNMPv3

Question 9

An administrator configures an IPS profile to block SQL injection attacks. However, SQL injection traffic is still passing through the FortiGate. The administrator confirms the IPS profile is applied to the correct policy. What is the most likely reason?

Accepted Answer

IPS signatures for SQL injection are disabled in the profile. IPS profiles in FortiGate consist of a set of IPS signatures that can be individually enabled or disabled. If the administrator configured an IPS profile to block SQL injection attacks but the specific SQL injection signatures are disabled within that profile, the FortiGate will not inspect or block that traffic, even if the profile is correctly applied to the policy.

Answer

The firewall policy is in proxy-based mode

Answer

The IPS profile is configured for anomaly detection only

Answer

Deep inspection is required for IPS to work

Question 10

Which SSL/TLS inspection mode only validates the server certificate without decrypting the traffic?

Accepted Answer

Certificate inspection. Certificate inspection is the correct answer because it validates the server certificate's authenticity and expiration without decrypting the traffic. This mode checks the certificate chain and revocation status using OCSP or CRLs, but the encrypted payload remains untouched, preserving end-to-end encryption.

Answer

Deep inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 11

An admin needs to allow inbound SMTP traffic from the internet to a mail server in the DMZ. The public IP is 203.0.113.10, and the mail server's private IP is 10.0.0.5. Which VIP configuration is correct?

Accepted Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 25. It configures a Virtual IP (VIP) that maps the public IP 203.0.113.10 on TCP port 25 (SMTP) to the internal mail server IP 10.0.0.5 on port 25. This allows inbound SMTP traffic from the internet to reach the mail server in the DMZ, performing both destination NAT (DNAT) and port forwarding for the specific SMTP service.

Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 80

Answer

VIP: external IP 203.0.113.10 all ports -> internal IP 10.0.0.5 all ports

Answer

VIP: external IP 203.0.113.10 port 80 -> internal IP 10.0.0.5 port 80

Question 12

A FortiGate admin configures a remote user for SSL VPN tunnel mode. The user can connect but cannot access resources on the internal network. The admin checks the SSL VPN settings: tunnel mode enabled, split tunneling disabled. What is the issue?

Accepted Answer

The firewall policy from the SSL VPN interface to the internal network is missing or incorrectly configured. When split tunneling is disabled, all traffic from the SSL VPN client is expected to be routed through the FortiGate. However, even with the tunnel established, the FortiGate must have a firewall policy that permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network interface, with the appropriate source (the user's assigned IP pool) and destination. Without this policy, packets are dropped by the FortiGate's implicit deny rule, preventing access to internal resources.

Answer

The user's FortiClient is outdated

Answer

The SSL certificate is expired

Answer

The user's client software is not configured to route all traffic through the tunnel

Question 13

An admin wants to apply different QoS markings to traffic from two different departments. The admin creates two firewall policies: one for Sales (policy ID 1) and one for Engineering (policy ID 2). Both policies have traffic shaping enabled. However, traffic from both departments receives the same QoS marking. What is the MOST likely mistake?

Accepted Answer

The admin applied the same traffic shaper to both policies. If the same traffic shaper is applied to both firewall policies, the QoS marking defined in that shaper will be identical for all matched traffic, regardless of the policy. Each policy must reference a distinct traffic shaper with the desired DSCP or 802.1p marking to differentiate the departments.

Answer

The policies are in the wrong order

Answer

QoS marking is only applied at the interface level

Answer

The traffic shaping policy is applied globally

Question 14

A FortiGate administrator needs to allow remote management of a FortiGate from the internet. Which administrative access protocols should be enabled on the WAN interface? (Choose the best single answer.)

Accepted Answer

HTTPS and SSH. HTTPS (port 443) and SSH (port 22) are the only secure administrative access protocols that provide encrypted communication for remote management over the internet. HTTP and Telnet transmit credentials and data in plaintext, making them unsuitable for WAN-facing interfaces. FortiGate best practices mandate disabling all insecure protocols on external interfaces and enabling only HTTPS and SSH for administrative access.

Answer

Ping and SNMP

Answer

HTTP and Telnet

Answer

FTP and TFTP

Question 15

An administrator configures a DLP profile to detect Social Security numbers in outbound traffic. The profile is applied to an outbound HTTP policy. Which TWO additional configurations are necessary for the DLP to inspect HTTPS traffic?

Accepted Answer

Enable SSL/TLS deep inspection on the firewall policy. DLP inspection of HTTPS traffic requires the firewall to decrypt the encrypted payload. Enabling SSL/TLS deep inspection on the firewall policy allows FortiGate to perform man-in-the-middle decryption, re-encrypt, and then inspect the decrypted content for sensitive data like Social Security numbers. Without deep inspection, the DLP engine sees only encrypted traffic and cannot match patterns.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Add an SSL exemption for the destination servers

Answer

Configure a web filter profile to allow the traffic