NSE4 Practice Test 2 — 25 Questions

Question 1

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the threshold value. Increasing the threshold value reduces false positives by requiring a higher rate of TCP SYN packets per second before the 'tcp_syn_flood' anomaly triggers an alert or action. This allows legitimate traffic bursts to pass without being flagged, while still detecting genuine SYN flood attacks. The threshold defines the sensitivity of the anomaly detection; raising it makes the detection less sensitive to low-volume spikes.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'

Question 2

A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?

Accepted Answer

The application control profile does not have SSL inspection enabled.. BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Answer

The FortiGate is operating in Transparent mode.

Answer

The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.

Answer

The default application signatures do not include BitTorrent.

Question 3

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. A RADIUS server object defines the IP address and shared secret that the FortiGate uses to communicate with the RADIUS server for authentication requests. Option D is correct because a user group must reference the RADIUS server to map authenticated users to policies; without this group, the FortiGate cannot apply firewall rules based on RADIUS authentication.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user

Question 4

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The output shows that the IKE packet is being sent and received (no proposal mismatch or interface down), but the negotiation fails due to a timeout. This indicates that the packet is leaving the local FortiGate but the response is not arriving back, which is classic behavior when a firewall (or ACL) between the peers is blocking UDP 500 or 4500. The timeout occurs because the remote peer never receives the initial packet or the local peer never receives the reply, preventing any IKE exchange from completing.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down

Question 5

Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?

Accepted Answer

Tunnel mode. Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.

Answer

Web mode

Answer

Split tunneling mode

Answer

Clientless mode

Question 6

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 7

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 8

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 9

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

Accepted Answer

The VIP is configured for port forwarding only for HTTP (port 80). The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Answer

The web server is not listening on HTTPS

Answer

The VIP is using overload mode instead of one-to-one

Answer

The firewall policy allowing traffic to the VIP only permits HTTP

Question 10

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN. The hub has multiple Phase 2 selectors for each spoke. What is the recommended way to simplify configuration on the hub when adding new spokes?

Accepted Answer

Use a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote. Using a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote simplifies hub configuration because it allows the hub to accept traffic for any subnet from any spoke without needing to define specific selectors per spoke. This is recommended in hub-and-spoke topologies to avoid manual updates when adding new spokes, as the hub's Phase 2 configuration becomes generic and automatically matches all spoke traffic.

Answer

Configure each spoke in a separate VDOM

Answer

Use aggressive mode for Phase 1

Answer

Use policy-based VPN instead of route-based

Question 11

A FortiGate administrator is configuring IPsec VPN between two sites. The Phase 1 negotiation fails with the error 'no proposal chosen'. Which two settings must match on both VPN peers?

Accepted Answer

Encryption algorithm and authentication algorithm. The 'no proposal chosen' error during IPsec Phase 1 negotiation indicates that the two VPN peers cannot agree on a common set of security parameters for the IKE (Internet Key Exchange) SA. The encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-256, MD5) are mandatory components of the Phase 1 proposal; if they do not match on both peers, the IKE negotiation fails immediately.

Answer

Pre-shared key and local ID

Answer

Dead peer detection interval and retry count

Answer

Remote gateway IP and Phase 2 selectors

Question 12

An admin wants to block all traffic from a specific geographic region. Which address object type should be used in the firewall policy source?

Accepted Answer

Geography. FortiGate firewalls include a built-in Geography address object type that allows policies to match traffic based on the source or destination IP address's registered country or region. This object uses GeoIP databases to classify IP addresses, enabling administrators to block or allow traffic from entire geographic areas without needing to manually list individual subnets or ranges.

Answer

FQDN

Answer

Subnet

Answer

IP range

Question 13

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

Accepted Answer

The firewall policy for HTTPS traffic is missing or has incorrect destination. The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.

Answer

The server's HTTPS service is not running

Answer

VIPs cannot share the same public IP address

Answer

The HTTPS VIP is configured with the wrong internal port

Question 14

An administrator sees the following CLI output when checking an IPS sensor: 'config ips sensor edit test config entries edit 1 set severity medium set action block set target default end'. However, attacks with severity medium are still passing. The IPS sensor is applied to a policy with flow-based inspection. What is the likely issue?

Accepted Answer

The IPS sensor rule has 'target' set to 'default' which may not apply to the traffic direction. The 'set target default' command in the IPS sensor configuration means the rule is applied to traffic that matches the default target, which is typically the 'client-to-server' direction. If the attack traffic is flowing in the opposite direction (server-to-client), the rule will not trigger. This is a common misconfiguration when using flow-based inspection, where the target direction must match the actual traffic flow for the action to be enforced.

Answer

The IPS sensor is not enabled in the policy

Answer

The FortiGate needs a FortiSandbox for IPS to work

Answer

The severity level is set too high

Question 15

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only

Question 16

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

Accepted Answer

The VIP does not have NAT reflection enabled. The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.

Answer

The server is not responding to internal requests

Answer

The firewall policy for internal to VIP is missing

Answer

The VIP is configured on a different interface

Question 17

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 18

A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?

Accepted Answer

Change the SSL VPN type from web mode to tunnel mode. Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.

Answer

Enable split tunneling on the SSL VPN portal

Answer

Add the server IP addresses to the portal's bookmarks

Answer

Configure a firewall policy allowing the client's IP to the servers

Question 19

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

Accepted Answer

The port range for each IP in the pool is exhausted. With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Answer

The firewall policy has 'set nat enable' disabled

Answer

The route to the internet is missing

Answer

The pool does not have enough IPs to cover all users

Question 20

A FortiGate admin wants to ensure that traffic from the internal network (192.168.1.0/24) to the internet uses a specific public IP (203.0.113.10) for source NAT, and that the same public IP is also used for inbound connections to an internal web server (10.0.1.10) on port 443. Which TWO configurations are required? (Choose two.)

Accepted Answer

Configure an IP Pool with type Overload using 203.0.113.10. An IP Pool with type Overload allows multiple internal hosts to share a single public IP (203.0.113.10) for source NAT when traffic goes to the internet. This is the standard method for PAT (Port Address Translation) in FortiGate, enabling many-to-one NAT.

Answer

Create a firewall policy with source NAT enabled and the IP Pool selected

Answer

Configure Central SNAT with the same public IP