NSE4 Practice Test 5 — 25 Questions

Question 1

A FortiGate administrator is setting up a dial-up IPsec VPN for remote employees. Each employee uses a FortiClient. Which authentication method should be used to allow individual user identities?

Accepted Answer

Certificate-based authentication using local or CA-issued certificates. For dial-up IPsec VPNs where each remote user must be uniquely identified, certificate-based authentication (option B) is the correct method. Certificates bind a user's identity to a cryptographic key pair, allowing the FortiGate to authenticate each individual user independently, unlike a shared PSK which cannot distinguish between users.

Answer

Pre-shared key (PSK) for each user

Answer

IKEv2 with EAP

Answer

Aggressive mode with PSK

Question 2

Which authentication method allows FortiGate to authenticate users against an Active Directory domain without storing domain credentials locally?

Accepted Answer

LDAP authentication. LDAP authentication allows FortiGate to verify user credentials directly against an Active Directory domain controller without storing the domain passwords locally. The FortiGate sends a BIND request with the user's DN and password to the LDAP server, which validates the credentials and returns a success or failure response. This avoids local storage of domain credentials while still enabling centralized authentication.

Answer

FSSO polling

Answer

RADIUS authentication

Answer

Local user database

Question 3

An administrator wants to block users from uploading files to cloud storage services like Google Drive via HTTPS. Which security profile combination is required?

Accepted Answer

Application control profile to block cloud storage applications, with deep inspection enabled. To block file uploads to cloud storage services like Google Drive over HTTPS, an application control profile is required because it can identify and control specific application actions (e.g., file uploads) within encrypted traffic. Deep inspection must be enabled to decrypt the HTTPS traffic, allowing the FortiGate to inspect the application-layer payload and enforce the upload blocking rule.

Answer

IPS profile to block file uploads to cloud services

Answer

DNS filter to block Google Drive domain

Answer

Web filter profile with URL filter to block Google Drive

Question 4

An administrator wants to use Active Directory credentials to authenticate firewall administrators. Which authentication server type should be configured on the FortiGate?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it directly integrates with Microsoft Active Directory to authenticate firewall administrators using their existing AD credentials. FortiGate can bind to an LDAP server to verify username and password pairs, making it the native protocol for AD authentication without requiring additional services or translation layers.

Answer

TACACS+

Answer

FSSO

Answer

RADIUS

Question 5

A company wants to use captive portal authentication on a guest Wi-Fi network. The FortiGate is connected to the switchport of the access point. Which firewall configuration is required to redirect unauthenticated users to the captive portal?

Accepted Answer

Create a policy with source interface 'guest', destination 'any', and action 'ACCEPT' with 'Authentication' set to 'Captive Portal'.. Captive portal authentication on a FortiGate requires a firewall policy that matches the unauthenticated traffic (source interface 'guest', destination 'any') with action 'ACCEPT' and the 'Authentication' setting set to 'Captive Portal'. This policy triggers the FortiGate to intercept HTTP/HTTPS traffic from unauthenticated users and redirect them to the captive portal login page, enforcing authentication before allowing further access.

Answer

Set the 'Guest Management' feature in the FortiGate dashboard.

Answer

Configure a 'Landing Page' under SSL-VPN settings.

Answer

Enable 'Captive Portal' on the interface under System > Network > Interface.

Question 6

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

Accepted Answer

Create a local-in policy to allow management access only from the trusted host. A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Answer

Change the admin port to a non-standard port

Answer

Enable HTTPS and restrict admin access via admin host

Answer

Use a firewall policy with source address restriction

Question 7

A FortiGate is configured with SSL deep inspection using a self-signed CA certificate. Users report that they see a certificate warning in their browser when accessing HTTPS sites. The admin wants to eliminate these warnings. What should the admin do?

Accepted Answer

Install the FortiGate's CA certificate on each client device's trusted root certificate store. When FortiGate performs SSL deep inspection, it decrypts HTTPS traffic by acting as a man-in-the-middle, using its own CA certificate to re-encrypt the connection. If the FortiGate's self-signed CA certificate is not trusted by the client, the browser will display a certificate warning because the issuer is not in the client's trusted root store. Installing the FortiGate's CA certificate on each client device's trusted root certificate store establishes trust, eliminating the warnings.

Answer

Disable SSL deep inspection and rely on flow-based antivirus

Answer

Change the SSL inspection mode to certificate inspection only

Answer

Configure an SSL certificate exemption for all HTTPS traffic

Question 8

You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?

Accepted Answer

There is no firewall policy allowing traffic from ssl.root to the internal network. The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.

Answer

Client certificate authentication is required but not provided

Answer

Split tunneling is disabled

Answer

The SSL VPN realm is not configured correctly

Question 9

A FortiGate administrator has configured a route-based IPsec VPN. After Phase 2 is up, traffic is not passing. The administrator verifies that the firewall policy allows traffic and the routes are correct. What should the administrator check next?

Accepted Answer

The static route uses the VPN interface as the outgoing interface. In a route-based IPsec VPN, traffic is routed to the VPN tunnel interface (e.g., 'to_remote'). Even if firewall policies and static routes exist, the static route must explicitly use the VPN interface as the outgoing interface. If the static route points to a different interface or a next-hop IP instead of the tunnel interface, the kernel will not forward traffic into the IPsec tunnel, causing Phase 2 to be up but no traffic to pass. This is a common misconfiguration that breaks the route-based VPN model.

Answer

The remote gateway's IP address is reachable

Answer

The pre-shared key is correct

Answer

The Phase 2 proposal includes the correct local and remote subnets

Question 10

A network admin configures an IPsec VPN between two FortiGates using IKEv2. Phase 1 completes successfully, but Phase 2 fails to establish. The admin runs 'diagnose vpn ike log' and sees the error 'proposal mismatch'. What is the most likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match. The error 'proposal mismatch' in the 'diagnose vpn ike log' output specifically indicates that the Phase 2 parameters (encryption, authentication, or DH group) do not match between the two FortiGate peers. Since Phase 1 completed successfully, the IKE version (IKEv2) and pre-shared keys are already validated, leaving only the Phase 2 proposal as the cause. Option C correctly identifies that the encryption and authentication algorithms are mismatched, which is the most common reason for this error.

Answer

The IKE version is not compatible

Answer

The Phase 2 selectors (local and remote subnets) are misconfigured

Answer

The pre-shared keys do not match

Question 11

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

Accepted Answer

The implicit deny rule. The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Answer

The security profile group

Answer

The default route

Answer

The last explicit deny policy in the policy list

Question 12

A FortiGate administrator is configuring a data leak prevention (DLP) profile to prevent the leakage of social security numbers (SSNs) via email. Which TWO settings must be configured in the DLP profile?

Accepted Answer

Enable SSL deep inspection on the firewall policy. FortiGate's DLP profiles inspect traffic at the application layer, and without SSL deep inspection, encrypted email traffic (e.g., SMTP over TLS) cannot be decrypted for pattern matching. Enabling SSL deep inspection on the firewall policy allows the DLP sensor to see the plaintext content of emails, including SSNs. This is a prerequisite for DLP to function on encrypted sessions.

Answer

Set the email filter to quarantine

Answer

Configure IPS to block SSN patterns

Answer

Enable FortiSandbox integration

Question 13

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

Accepted Answer

The management IP is not in the same subnet as the management network.. In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Answer

Transparent mode does not support management access; only NAT/Route mode does.

Answer

The FortiGate's firewall policy blocks management traffic even in transparent mode.

Answer

The administrator must configure a management VLAN interface to access the FortiGate.

Question 14

A network administrator wants to prevent users from accessing known malicious websites using FortiGate. Which security profile should be applied to the firewall policy to achieve this goal?

Accepted Answer

Web filtering profile. Web filtering profile. FortiGate's web filtering profile uses URL rating and category-based filtering to block access to known malicious websites by leveraging FortiGuard's real-time threat intelligence. This is the specific security profile designed to control web access based on URL reputation, including blocking malicious URLs.

Answer

Antivirus profile

Answer

Application control profile

Answer

IPS profile

Question 15

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 16

A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?

Accepted Answer

Enable 'add-route' on the hub Phase 2. In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.

Answer

Set the hub as the default gateway on each spoke

Answer

Use policy-based VPN instead of route-based

Answer

Configure NAT on the hub

Question 17

An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?

Accepted Answer

LDAP. To authenticate VPN users against an external LDAP server, the user group for the SSL VPN portal must be configured with the LDAP authentication method. This directs FortiGate to bind directly to the LDAP server (e.g., Active Directory or OpenLDAP) using the configured LDAP server object, performing a simple bind or SASL bind to verify user credentials. Other methods like RADIUS, FSSO, or Local would not leverage the LDAP server directly.

Answer

RADIUS

Answer

FSSO

Answer

Local

Question 18

A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?

Accepted Answer

Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic. When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.

Answer

The FortiGate is using a proxy server that caches different results for different users

Answer

The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent

Answer

The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing

Question 19

An administrator receives reports that some internal users can access Facebook despite a web filtering profile that blocks the 'Social Networking' category. The policy is configured with deep inspection. Which THREE checks should the administrator perform to troubleshoot this issue?

Accepted Answer

Check if the users are using HTTPS and if the SSL inspection profile has an exemption for Facebook. The troubleshooting should focus on three main areas: (A) SSL inspection exemption – if users access Facebook via HTTPS and the SSL inspection profile exempts Facebook traffic, it bypasses the web filter; (C) SSL VPN bypass – traffic through an SSL VPN tunnel may not match the policy if the tunnel interface is not covered; (D) policy application and order – the web filtering profile must be applied to the correct policy and the policy order must be such that this policy is enforced before any conflicting policy. Option E is a valid check, but since the category is already set to 'Block' in the profile, the issue is more likely related to the other three.

Answer

Ensure that the antivirus profile is enabled on the policy

Answer

Confirm that the 'Social Networking' category is not set to 'Monitor' instead of 'Block'

Question 20

You run the command 'diagnose vpn ike log filter name vpn1' and then 'diagnose vpn ike log filter type phase1'. The log shows: 'IKEv1 exchange:f4470f07:00000000: responder: main mode: received IKE_SA_INIT (aggressive mode not allowed)'. What is the problem?

Accepted Answer

The responder is configured for main mode only, but the initiator is sending aggressive mode. The log message 'aggressive mode not allowed' indicates the responder (FortiGate) is configured to accept only main mode IKE phase1 negotiations, but the initiator sent an aggressive mode request. This mismatch causes the responder to reject the IKE_SA_INIT message, as aggressive mode is disabled by default or explicitly set to main mode only in the phase1 configuration.

Answer

The initiator is using IKEv2 while the responder uses IKEv1

Answer

The pre-shared key is wrong

Answer

The phase1 proposal is incompatible