NSE4 Practice Test 25 — 15 Questions

Question 1

A network admin has configured a firewall policy allowing traffic from the 'internal' zone to the 'external' zone. The policy uses a service object 'HTTP' (TCP/80). Users report they can access HTTP websites but not HTTPS. The admin confirms no other policies block HTTPS. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HTTPS traffic is being dropped by implicit deny because no policy matches it. The firewall policy explicitly allows only HTTP (TCP/80) traffic from the internal zone to the external zone. HTTPS uses TCP/443, which is not included in the service object 'HTTP'. Since no other policy permits HTTPS, the traffic hits the implicit deny rule at the end of the policy list, which drops all unmatched traffic. This is the default behavior on FortiGate firewalls.

Answer

The FortiGate needs to perform SSL inspection on HTTPS traffic

Answer

There is a policy ordering issue; a later policy might block HTTPS

Answer

The service object 'HTTP' also includes TCP/443 by default

Question 2

What is the purpose of policy-based routing (PBR) in FortiGate?

Accepted Answer

To route traffic based on source address, destination, or other attributes instead of the routing table. Policy-based routing (PBR) in FortiGate allows you to override the default routing table lookup by forwarding traffic based on criteria such as source IP address, destination IP address, protocol, or even application. This is configured under the 'policy route' feature and is evaluated before the routing table, enabling granular control over traffic paths that static or dynamic routes cannot provide.

Answer

To load balance traffic across multiple WAN links

Answer

To filter traffic based on application signatures

Answer

To authenticate users before allowing traffic

Question 3

An administrator wants to allow users to override a blocked category (e.g., Social Networking) by entering an administrator-defined password. Which of the following must be configured?

Accepted Answer

Enable 'Override' in the Web Filter profile and configure an authentication scheme. To allow users to override a blocked web category by entering an administrator-defined password, you must enable the 'Override' feature within the Web Filter profile and configure an authentication scheme (e.g., using a local user or LDAP group). This allows users to bypass the block temporarily after authenticating with the defined password, rather than permanently changing the policy or filter mode.

Answer

Configure a DNS filter to bypass the block

Answer

Create a separate firewall policy with a higher priority that permits the traffic

Answer

Set the web filter profile to 'Monitor' mode instead of 'Block'

Question 4

A large enterprise uses a FortiGate 600E in NAT mode to protect its internal network. The security team has implemented an Application Control profile that categorizes applications and allows only 'Business' and 'General-Interest' categories. They have also applied an IPS sensor with default settings and enabled SSL inspection for outbound traffic. Recently, the helpdesk has received reports that some users cannot access a critical cloud-based CRM application, while others can. The CRM uses HTTPS on port 443. The Application Control profile is applied to the firewall policy for outbound traffic. The IPS sensor is also applied. The FortiGate is not configured for load balancing. Which of the following is the most likely cause of the issue?

Accepted Answer

The CRM application is not categorized in the Application Control database.. The Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Answer

The IPS sensor is detecting and blocking the CRM traffic as an attack.

Answer

The FortiGate is performing load balancing and some users are directed to a different path.

Answer

SSL inspection is blocking the CRM traffic due to certificate validation failure.

Question 5

You run 'get system performance status' and see CPU usage at 95% with high context switch rate. The FortiGate is not passing any traffic. What is the most likely cause?

Accepted Answer

A routing loop is causing continuous packet processing. A routing loop causes the FortiGate to continuously process and re-process packets as they are forwarded in a cycle between routers, leading to high CPU usage and context switch rates. The loop prevents traffic from being successfully delivered, resulting in zero traffic passing through the FortiGate. This matches the observed symptoms of 95% CPU usage and high context switching.

Answer

The FortiGate is under a DDoS attack

Answer

The antivirus engine is updating signatures

Answer

The FortiGate is in transparent mode

Question 6

A FortiGate receives a file via SMTP that contains a virus. The antivirus profile is set to 'Block' for viruses and the action is set to 'Quarantine'. However, the email is delivered to the user with the infected attachment. What could be the reason?

Accepted Answer

The antivirus profile is using flow-based inspection and the SMTP scan is not enabled. B is correct because when an antivirus profile uses flow-based inspection, it must have SMTP scanning explicitly enabled in the profile settings. If SMTP scan is not enabled, the FortiGate will not inspect SMTP traffic for viruses, allowing infected attachments to pass through regardless of the antivirus action set to 'Block' and 'Quarantine'. Proxy-based inspection, by contrast, scans all protocols by default, but flow-based requires per-protocol enablement.

Answer

The email filter profile is overriding the antivirus action

Answer

The antivirus signatures are outdated

Answer

The file is larger than the FortiGate's virus database can handle

Question 7

A FortiGate administrator needs to allow SMTP traffic from the internal network to an external mail server. The internal network uses source NAT to the external interface IP. Which firewall policy configuration is correct?

Accepted Answer

Policy: source internal, destination external, service SMTP, enable NAT. SMTP traffic from the internal network to an external mail server requires source NAT (masquerading) to translate private source IPs to the FortiGate's external interface IP. This ensures return traffic is routed back correctly. The default SMTP service uses TCP port 25, and enabling NAT on the policy is the standard configuration for outbound traffic to the internet.

Answer

Policy: source internal, destination external, service SMTP, disable NAT

Answer

Policy: source internal, destination external, service SMTP (port 587), enable NAT

Answer

Policy: source internal, destination external, service SMTP (UDP), enable NAT

Question 8

A network administrator needs to configure a FortiGate to participate in SNMP monitoring. Which CLI command enables SNMP agent on the FortiGate?

Accepted Answer

config system snmp
set status enable. The correct command to enable the SNMP agent on a FortiGate is 'config system snmp' followed by 'set status enable'. This enters the SNMP configuration context and activates the SNMP agent, which is required for the FortiGate to respond to SNMP queries from management systems. Without this command, the SNMP service remains disabled regardless of other SNMP settings.

Answer

set system snmp enable

Answer

set snmp agent enable

Answer

enable snmp service

Question 9

An organization needs to restrict internet access for employees to business hours only (Monday to Friday, 8:00 to 18:00). Which object should the admin use in the firewall policy?

Accepted Answer

A schedule object with recurring time. A schedule object with recurring time is the correct choice because FortiGate firewall policies use schedule objects to define time-based access control. A recurring schedule allows you to specify days of the week and a time range (e.g., Monday to Friday, 8:00-18:00) that repeats weekly, which perfectly matches the requirement for business hours only.

Answer

A time-range object

Answer

An on-time schedule

Answer

A calendar object

Question 10

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Accepted Answer

1. Select source and destination interfaces, 2. Select source and destination addresses, 3. Select service (HTTP), 4. Set action to accept and enable logging. Firewall policies require defining interfaces, source/destination addresses, and services before enabling.

Answer

1. Select source and destination addresses, 2. Select source and destination interfaces, 3. Select service (HTTP), 4. Set action to accept and enable logging

Answer

1. Select service (HTTP), 2. Select source and destination interfaces, 3. Select source and destination addresses, 4. Set action to accept and enable logging

Answer

1. Set action to accept and enable logging, 2. Select source and destination interfaces, 3. Select source and destination addresses, 4. Select service (HTTP)

Question 11

An administrator configures a VIP for port forwarding: public IP 203.0.113.10 port 8080 to internal server 10.0.1.10 port 80. External users can connect to http://203.0.113.10:8080 but receive a timeout. The firewall policy allows traffic from any to the VIP on destination port 8080. The internal server is reachable from internal hosts. What is the most likely problem?

Accepted Answer

The policy destination service is set to HTTP (port 80) instead of port 8080. The firewall policy must match the destination port of the incoming traffic. External users connect to port 8080 on the VIP, but if the policy's destination service is set to HTTP (port 80), the policy will not match traffic destined for port 8080. Even though the VIP translates the destination to port 80 on the internal server, the firewall policy evaluation occurs before NAT translation, so the policy must match the original destination port (8080).

Answer

The internal server is not running a web server

Answer

The VIP is not associated with the policy

Answer

The source NAT is not configured

Question 12

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

Accepted Answer

ADVPN (Auto-Discovery VPN). ADVPN (Auto-Discovery VPN) is the correct technology because it dynamically establishes direct IPsec tunnels between spoke sites in a hub-and-spoke topology, eliminating the need to route inter-spoke traffic through the hub. It uses IKEv2 with short-cut messages (via the hub as a signaling broker) to allow spokes to learn each other's public IP addresses and negotiate a direct tunnel, reducing latency and hub load.

Answer

Site-to-site VPN between each spoke pair manually

Answer

Policy-based VPN with multiple Phase 2 selectors

Answer

SSL VPN tunnel mode

Question 13

Which security profile is used to detect and prevent spam email messages?

Accepted Answer

Email filter profile. The Email Filter profile is specifically designed to detect and prevent spam by analyzing SMTP traffic, applying techniques such as DNS-based Blackhole Lists (DNSBL), email reputation filtering, and heuristic analysis to identify unsolicited bulk email. Unlike other security profiles, it operates at the application layer for email protocols (SMTP, POP3, IMAP) to enforce anti-spam policies.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 14

A FortiGate is configured with multiple policies. The first policy allows traffic from 10.0.0.0/8 to any destination. The second policy denies traffic from 10.0.1.0/24 to any destination. What happens when a packet from 10.0.1.5 to 8.8.8.8 arrives?

Accepted Answer

The packet is allowed by the first policy. FortiGate firewall policies are evaluated in sequential order from top to bottom. The first policy matches source 10.0.0.0/8, which includes 10.0.1.5, and allows the traffic to any destination. Since the packet matches this policy first, it is accepted and the second policy is never evaluated. Therefore, the packet is allowed by the first policy.

Answer

The packet is denied by implicit deny

Answer

The packet matches both policies and is allowed

Answer

The packet is denied by the second policy

Question 15

You run the following diagnose command on a FortiGate and see the output:

diagnose sys session filter dport 443
diagnose sys session list

... proto=6 proto_state=01 duration=3600 expire=3599 ...

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in a half-open state (SYN_SENT). In FortiGate session diagnostics, 'proto_state=01' for a TCP session (proto=6) indicates the session is in a half-open state, specifically SYN_SENT, meaning the initial SYN packet has been sent but the three-way handshake has not yet completed. This is a transient state before the session becomes fully established (proto_state=02).

Answer

The session is UDP, indicated by proto_state 01

Answer

The session has been fully established

Answer

The session is being terminated