NSE4 Practice Test 2 — 25 Questions

Question 1

An admin needs to allow traffic from a specific IP to a web server on port 8080. The web server is behind a VIP that forwards port 80 to port 8080. When configuring the security policy, which destination should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VIP object. When a VIP is used to translate the destination IP and port (e.g., from public IP:80 to private server IP:8080), the security policy must reference the VIP object as the destination. FortiGate matches the policy using the original destination IP before destination NAT is applied. The VIP object represents the original destination (the external IP) that clients use, so referencing it ensures the policy correctly permits the traffic.

Answer

The virtual IP address of the FortiGate

Answer

The real server IP address

Answer

Any destination, because the VIP translates automatically

Question 2

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 3

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

Accepted Answer

The VIP is configured for port forwarding only for HTTP (port 80). The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Answer

The web server is not listening on HTTPS

Answer

The VIP is using overload mode instead of one-to-one

Answer

The firewall policy allowing traffic to the VIP only permits HTTP

Question 4

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN. The hub has multiple Phase 2 selectors for each spoke. What is the recommended way to simplify configuration on the hub when adding new spokes?

Accepted Answer

Use a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote. Using a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote simplifies hub configuration because it allows the hub to accept traffic for any subnet from any spoke without needing to define specific selectors per spoke. This is recommended in hub-and-spoke topologies to avoid manual updates when adding new spokes, as the hub's Phase 2 configuration becomes generic and automatically matches all spoke traffic.

Answer

Configure each spoke in a separate VDOM

Answer

Use aggressive mode for Phase 1

Answer

Use policy-based VPN instead of route-based

Question 5

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Certificate Inspection only examines the SSL/TLS certificate presented during the handshake, without decrypting the traffic. Because the FortiGate can read the certificate's Common Name (CN) or Subject Alternative Name (SAN), it can block HTTPS connections based on that information, such as by using a URL filter or application control rule that matches the certificate's CN. This is the only deep inspection action possible without full decryption.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic

Question 6

What is the primary advantage of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 has built-in support for NAT traversal and MOBIKE. IKEv2 offers built-in NAT traversal (NAT-T) and MOBIKE (RFC 4555) as core features, not optional extensions. This eliminates the need for separate RFC 3947 NAT-T configuration and allows seamless IP address changes during a VPN session, making it far more robust for mobile users and dynamic environments compared to IKEv1.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires aggressive mode

Answer

IKEv2 is only for route-based VPN

Question 7

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

Accepted Answer

The firewall policy for HTTPS traffic is missing or has incorrect destination. The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.

Answer

The server's HTTPS service is not running

Answer

VIPs cannot share the same public IP address

Answer

The HTTPS VIP is configured with the wrong internal port

Question 8

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). The SSL VPN tunnel mode creates a virtual interface (typically named 'ssl.root' or 'ssl.VDOM') on the FortiGate. Even though the administrator configured a policy allowing the SSL VPN interface to internal, the incoming interface in the policy must explicitly be set to this SSL VPN interface. If it is set to a different interface (e.g., the physical WAN interface), the FortiGate will not match the traffic from the SSL VPN tunnel, resulting in the 'no matching policy' debug message.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal

Question 9

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only

Question 10

An administrator integrates FortiGate with FortiSandbox for advanced threat detection. The FortiGate is configured to send files to FortiSandbox for analysis. Despite correct configuration, files are not being submitted. The administrator runs 'diagnose debug application fortisandbox -1' and sees 'no server configured'. What is the issue?

Accepted Answer

The FortiSandbox server IP address is not configured on the FortiGate. The debug output 'no server configured' explicitly indicates that the FortiGate does not have a FortiSandbox server IP address defined in its configuration. Without the server IP configured under 'config system fortisandbox', the FortiGate cannot establish a connection or submit files, regardless of other settings. This is a prerequisite step before any file submission can occur.

Answer

The FortiSandbox license has expired

Answer

Firewall policies are blocking communication to the FortiSandbox server

Answer

The antivirus profile is not configured to submit files to FortiSandbox

Question 11

What is the primary difference between flow-based and proxy-based Antivirus inspection on a FortiGate?

Accepted Answer

Proxy-based inspection reassembles the file before scanning, while flow-based scans as the file passes through. The primary difference is that proxy-based antivirus inspection fully reassembles the file in memory before scanning, allowing for more thorough detection of threats like polymorphic viruses and archives. Flow-based inspection scans data as it passes through the FortiGate in a single pass, using pattern matching without full file reassembly, which reduces latency but may miss threats that require file-level analysis.

Answer

Flow-based inspection is only available on hardware models with CP8

Answer

Proxy-based inspection uses fewer resources than flow-based

Answer

Flow-based inspection supports virus outbreak detection, but proxy-based does not

Question 12

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

Accepted Answer

The VIP does not have NAT reflection enabled. The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.

Answer

The server is not responding to internal requests

Answer

The firewall policy for internal to VIP is missing

Answer

The VIP is configured on a different interface

Question 13

Which IPS detection method analyzes traffic patterns over time to identify attacks that are characterized by a threshold of events?

Accepted Answer

Rate-based detection. Rate-based detection (also known as threshold-based detection) monitors traffic patterns over a defined time window and triggers an alert when the number of events (e.g., connection attempts, SYN packets) exceeds a predefined threshold. This method is specifically designed to identify attacks that are characterized by a threshold of events, such as DoS/DDoS floods or brute-force login attempts, rather than relying on static signatures or protocol anomalies.

Answer

Protocol decoder-based detection

Answer

Signature-based detection

Answer

Anomaly-based detection

Question 14

What is the function of an IPS 'protocol decoder'?

Accepted Answer

Parse and normalize protocol traffic to improve detection accuracy. An IPS protocol decoder parses and normalizes traffic for a specific protocol (e.g., HTTP, SMB, DNS) to reconstruct the application-layer data stream. This normalization strips away evasion techniques like chunked encoding or whitespace obfuscation, allowing the IPS to match attack signatures against the true payload, which significantly improves detection accuracy.

Answer

Encode traffic to prevent attacks

Answer

Rate-limit traffic based on protocol

Answer

Decrypt SSL traffic for inspection

Question 15

A FortiGate with multiple VDOMs is configured for FSSO with Active Directory polling. Users in VDOM1 are authenticated correctly, but users in VDOM2 are not. What should be checked FIRST?

Accepted Answer

The FSSO collector agent settings for VDOM2. In a multi-VDOM FSSO setup with Active Directory polling, each VDOM requires its own FSSO collector agent configuration to map domain users to the correct VDOM. Since VDOM1 works but VDOM2 does not, the most likely cause is that the FSSO collector agent settings for VDOM2 are missing or misconfigured, such as the collector agent IP, port, or shared secret. This is the first item to verify because FSSO polling relies on per-VDOM agent communication to deliver user-to-IP mappings.

Answer

The DNS resolution for the domain controller in VDOM2

Answer

The firewall policy ordering in VDOM2

Answer

The LDAP server configuration in VDOM2

Question 16

A FortiGate administrator is configuring a firewall policy to allow inbound HTTPS traffic from the internet to an internal web server. The web server has a private IP address 10.0.0.10. The administrator wants to translate the destination IP to the internal server using a Virtual IP (VIP). Which TWO of the following must be configured for the VIP to work correctly? (Choose two.)

Accepted Answer

The VIP must have the external IP set to a public IP address assigned to the FortiGate's WAN interface. A Virtual IP (VIP) must map a public IP address (typically assigned to the FortiGate's WAN interface) to the internal private IP of the web server. Without setting the external IP to a public address, the VIP cannot receive inbound traffic from the internet. Option D is correct because the firewall policy must reference the VIP as the destination address object; this triggers the destination NAT translation from the public IP to the private IP 10.0.0.10.

Answer

An IP Pool must be configured for the web server's return traffic

Answer

The VIP must have port forwarding enabled with the external and internal ports set to 443

Answer

The firewall policy must have NAT enabled

Question 17

A network administrator has configured a static route on a FortiGate with a distance of 10 and a priority of 0. Later, they add another static route to the same destination with a distance of 15 and priority of 0. Which route will be used for traffic forwarding?

Accepted Answer

The route with distance 10 because it has a lower administrative distance. The FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

Answer

The route with distance 15 because it has a higher priority

Answer

Both routes will be used for ECMP load balancing

Answer

The route with distance 15 will be used because it was added last

Question 18

An admin configures a Central SNAT rule to translate internal 192.168.1.0/24 to 203.0.113.10 when accessing the internet. However, traffic from 192.168.1.100 to 8.8.8.8 shows source IP 192.168.1.100 in logs. What is the MOST likely cause?

Accepted Answer

The Central SNAT rule is applied to the wrong outgoing interface. The Central SNAT rule is not being applied to the traffic. The most likely cause is that the rule specifies an outgoing interface different from the one used to reach 8.8.8.8, so the rule does not match and no source translation occurs.

Answer

The Central SNAT rule is disabled

Answer

The firewall policy has an IP pool configured, overriding Central SNAT

Answer

The destination address in the Central SNAT rule is incorrect

Question 19

A company with 500 users has a FortiGate 1000D running FortiOS 7.2. They have configured full SSL inspection and web filtering to block malware and phishing sites. The administrator receives complaints that some users cannot access a legitimate business website (https://vendor.example.com). The administrator checks the FortiGate logs and sees that the connection is allowed by the firewall policy and web filter. However, the user's browser shows 'ERR_CERT_AUTHORITY_INVALID'. The administrator verifies that the FortiGate's CA certificate is installed on all client machines. Further investigation reveals that the vendor's website uses a certificate signed by a private CA that is not trusted by the FortiGate. The administrator wants to resolve the issue without disabling SSL inspection for the whole website or compromising security. What should the administrator do?

Accepted Answer

Import the vendor's private CA certificate into the FortiGate's trusted root CA store.. The FortiGate cannot validate the vendor's certificate because its private CA is not in the FortiGate's trusted root store. By importing that CA certificate into the FortiGate's trusted root CA store, the FortiGate will trust the vendor's certificate chain, allowing full SSL inspection to proceed without errors. This resolves the ERR_CERT_AUTHORITY_INVALID error while maintaining security inspection for the domain.

Answer

Create an SSL exemption for the vendor's domain in the SSL inspection profile.

Answer

Change the SSL inspection profile to certificate inspection only.

Answer

Install the vendor's CA certificate on the client machines.

Question 20

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

Accepted Answer

The port range for each IP in the pool is exhausted. With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Answer

The firewall policy has 'set nat enable' disabled

Answer

The route to the internet is missing

Answer

The pool does not have enough IPs to cover all users