NSE4 Practice Test 26 — 15 Questions

Question 1

A FortiGate administrator wants to block outgoing DNS requests to known malware domains. Which security profile should be used?

Accepted Answer

DNS filter. DNS Filter is the correct security profile because it is specifically designed to inspect and block DNS queries based on domain names, IP addresses, or categories. By configuring a DNS filter policy with a custom list of known malware domains, the FortiGate can intercept outgoing DNS requests and drop those matching the malicious entries, preventing the resolution of malware domains.

Answer

Application control

Answer

Web filter

Answer

IPS

Question 2

An administrator wants to send FortiGate logs to a FortiAnalyzer for centralized logging and reporting. Which configuration step is required on the FortiGate?

Accepted Answer

Under Log & Report, configure the FortiAnalyzer settings and set the log forwarding. FortiGate uses the Log & Report section to configure FortiAnalyzer settings, specifically under 'Log Settings' or 'Log Forwarding'. This enables the FortiGate to forward logs to a FortiAnalyzer device for centralized logging and reporting, using the FortiGate-FortiAnalyzer protocol (based on syslog over TCP with Fortinet extensions).

Answer

Enable SNMP traps to the FortiAnalyzer

Answer

Create a firewall policy to allow traffic to the FortiAnalyzer

Answer

Configure a syslog server under System > Settings

Question 3

An admin wants to ensure that VoIP traffic (UDP ports 5060-5061) from the internal network to the internet is prioritized over other traffic when the WAN link is congested. Which feature should be configured on the firewall policy?

Accepted Answer

Traffic shaping policy with a guaranteed bandwidth allocation and high priority. A traffic shaping policy with guaranteed bandwidth allocation and high priority ensures that VoIP traffic (UDP ports 5060-5061) receives the necessary bandwidth and is prioritized over other traffic during WAN congestion. Traffic shaping policies on FortiGate allow you to set guaranteed bandwidth, maximum bandwidth, and priority levels, which directly address congestion by reserving resources for critical traffic like VoIP.

Answer

Enable NAT on the policy

Answer

QoS marking only (DSCP)

Answer

Configure a security profile with QoS settings

Question 4

A FortiGate admin needs to block all traffic from the 'Guest' VLAN (192.168.100.0/24) to the internal network (10.0.0.0/8) except for DNS traffic (UDP 53) to the internal DNS server at 10.0.0.10. Which TWO firewall policy configuration elements are required to achieve this? (Choose two.)

Accepted Answer

A firewall policy with source 'Guest' VLAN, destination 'Internal network', service 'ALL', action 'deny'. A deny policy with source 'Guest' VLAN (192.168.100.0/24), destination 'Internal network' (10.0.0.0/8), and service 'ALL' will block all traffic from the Guest VLAN to the internal network. Option C is correct because an explicit accept policy for DNS (UDP 53) to the internal DNS server (10.0.0.10) must be placed before the deny policy, as FortiGate firewall policies are evaluated in order from top to bottom, and the first matching policy determines the action.

Answer

An address group for the internal DNS server

Answer

A traffic shaper to limit DNS traffic

Answer

A schedule object to apply the policies only during business hours

Question 5

A company with multiple remote sites uses IPsec VPNs. One site reports intermittent connectivity. The administrator checks the logs and sees 'IPsec phase 2 negotiation failed' messages. Which configuration change is most likely to resolve the issue?

Accepted Answer

Enable Dead Peer Detection (DPD) on the Phase 1 interface.. Intermittent IPsec phase 2 negotiation failures often occur when one peer's Phase 2 security association (SA) expires while the other peer still considers it valid, causing a mismatch. Enabling Dead Peer Detection (DPD) on the Phase 1 interface allows the FortiGate to actively probe the peer's liveness and renegotiate Phase 1 and Phase 2 SAs before they expire, preventing the state mismatch that leads to intermittent failures.

Answer

Change the encryption algorithm from AES256 to 3DES.

Answer

Increase the Phase 2 lifetime.

Answer

Enable NAT traversal.

Question 6

A FortiGate with multiple VDOMs has a policy that allows traffic from VDOM A to VDOM B. The admin notices that traffic from VDOM A to a specific server in VDOM B is being dropped. The session log shows 'deny by forward policy check'. What is the MOST likely cause?

Accepted Answer

The policy in VDOM B to allow traffic from VDOM A is missing or misconfigured. The session log message 'deny by forward policy check' indicates that the traffic was explicitly denied by a firewall policy rule, not by a routing or resource issue. In a multi-VDOM setup, traffic from VDOM A to VDOM B must be permitted by a policy in VDOM B (the destination VDOM) that allows traffic from the inter-VDOM link or from VDOM A. If that policy is missing or misconfigured, the FortiGate will drop the traffic and log this exact denial.

Answer

The inter-VDOM link is down

Answer

NAT is required for inter-VDOM traffic

Answer

The source VDOM has exceeded its session limit

Question 7

You are troubleshooting an IPsec VPN between two FortiGates. The Phase 1 is up, but Phase 2 is not coming up. You check the Phase 2 configuration on both sides. What is a common cause of this issue?

Accepted Answer

Mismatch in Phase 2 settings such as encryption algorithm, authentication algorithm, or PFS group. When Phase 1 is up but Phase 2 fails, the most common cause is a mismatch in Phase 2 parameters. Phase 2 uses IPsec SA proposals that must match exactly on both sides, including encryption algorithm (e.g., AES256), authentication algorithm (e.g., SHA256), and Perfect Forward Secrecy (PFS) group (e.g., DH14). Even a single mismatch, such as one side using PFS and the other not, will prevent Phase 2 from establishing.

Answer

Firewall policy not allowing ESP traffic

Answer

Incorrect local or remote gateway IP

Answer

Mismatch in Phase 1 pre-shared key

Question 8

When creating a firewall policy, an admin wants to ensure that traffic from a specific user group is allowed only during business hours (Monday to Friday, 09:00-18:00). Which object type must be configured and applied to the policy?

Accepted Answer

A schedule object with a recurring schedule. To restrict traffic based on time, a firewall policy must reference a schedule object. A recurring schedule defines specific days and hours (e.g., Monday–Friday, 09:00–18:00) and is applied directly to the policy. This allows the FortiGate to permit or deny traffic based on the current time without additional profiles or user group modifications.

Answer

A security profile with time-based filtering

Answer

A user group object with time restrictions

Answer

A traffic shaping policy with a time-based rule

Question 9

A FortiGate administrator is troubleshooting an SSL VPN issue where remote users cannot access internal resources after successful authentication. Which TWO steps should the admin take to resolve the issue? (Select two.)

Accepted Answer

Verify that a firewall policy exists allowing traffic from the SSL VPN interface to the internal network. After successful SSL VPN authentication, traffic from the remote user must be permitted by a firewall policy that allows traffic from the SSL VPN interface (e.g., ssl.root) to the destination internal network interface. Without this policy, packets are dropped even if authentication succeeds. Option C is correct because the FortiGate must have a route back to the SSL VPN client IP pool (or the client's virtual IP) in its routing table; if the return route is missing, the FortiGate cannot forward reply traffic to the remote user, causing asymmetric routing and connectivity failure.

Answer

Increase the authentication timeout

Answer

Restart the FortiGate

Answer

Disable the SSL VPN portal

Question 10

A FortiGate administrator configures a Central SNAT policy to translate internal IPs to a single public IP for internet access. However, traffic from a specific internal server (10.0.1.100) must use a different public IP. The administrator also creates a policy-based NAT rule in the firewall policy for that server. Which NAT method takes precedence?

Accepted Answer

Central SNAT takes precedence over policy-based NAT. In FortiGate, when both Central SNAT and policy-based NAT (configured within a firewall policy) are present, Central SNAT takes precedence. This is because Central SNAT is evaluated before policy-based NAT in the NAT processing order, and once a match is found in Central SNAT, the system applies it and does not proceed to policy-based NAT. The specific server's traffic (10.0.1.100) would still be subject to the Central SNAT rule unless a more specific Central SNAT rule is created for that IP.

Answer

Policy-based NAT takes precedence because it is more specific

Answer

Central SNAT takes precedence because it is evaluated after policy-based NAT

Answer

The most recently created rule takes precedence

Question 11

An admin needs to create a firewall policy that matches traffic based on the destination being a specific geographic location (e.g., France). Which address object should be used?

Accepted Answer

A geography object. A geography object is specifically designed to match traffic based on geographic location (country, continent, or region) using the GeoIP database integrated into FortiOS. When a firewall policy needs to allow or deny traffic to or from a specific country like France, a geography object is the correct address object type because it dynamically resolves IP ranges assigned to that country by IANA/RIRs.

Answer

An FQDN object

Answer

A subnet object

Answer

A wildcard FQDN object

Question 12

A FortiGate administrator needs to authenticate VPN users against an LDAP server. What is the primary purpose of the 'CN=,OU=,DC=' distinguished name (DN) configured in the LDAP server settings?

Accepted Answer

It specifies the bind user credentials to connect to the LDAP server. The DN configured in the LDAP server settings on FortiGate specifies the bind user credentials (username and password) that the FortiGate uses to authenticate itself to the LDAP server before performing user searches. This bind DN is required because LDAP servers typically require a valid authenticated session to query the directory; the bind DN provides the necessary identity and privileges for the FortiGate to search for VPN users.

Answer

It is used to encrypt LDAP communication

Answer

It defines the IP address of the LDAP server

Answer

It specifies the base DN for searching users

Question 13

A FortiGate admin is creating a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network. The admin wants to ensure that traffic is inspected by security profiles (antivirus, web filter). Which THREE of the following must be configured on the firewall policy to achieve this?

Accepted Answer

Set the action to ACCEPT. Setting the action to ACCEPT is mandatory for the firewall policy to allow traffic through. Without ACCEPT, the policy would deny traffic by default, preventing any inspection by security profiles. The ACCEPT action enables the FortiGate to process the traffic through the configured security profiles.

Answer

Set the schedule to always

Answer

Enable NAT on the policy

Question 14

An administrator is configuring an IPsec VPN between two FortiGates using IKEv1. The tunnel must use main mode and support multiple subnets behind each gate. Which Phase2 settings are required to allow multiple subnets? (Choose two.)

Accepted Answer

Create multiple Phase2 selectors, each with different local and remote subnets. IKEv1 main mode requires that each pair of local and remote subnets be defined in its own Phase2 selector. This allows the VPN to establish separate security associations (SAs) for each subnet pair, enabling multiple subnets behind each FortiGate. Option E is also correct because using address objects that contain multiple subnets (e.g., a subnet group or address range) in a single Phase2 definition is a supported method to negotiate a single SA covering all those subnets, reducing the number of Phase2 selectors needed.

Answer

Set the Phase2 keylife to a higher value

Answer

Set the Phase2 proposal to include multiple encryption algorithms

Answer

Enable NAT traversal on the Phase2

Question 15

You run the following command on a FortiGate: 'diagnose sys session filter dport 443' and see:
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate?

Accepted Answer

The session is in SYN_SENT state and the three-way handshake is not yet complete. The output shows `proto=6`, which indicates TCP, and `proto_state=01`, which corresponds to the TCP state SYN_SENT (0x01). This means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `duration=3600` and `expire=3599` indicate the session has been tracked for 3600 seconds and will expire in 3599 seconds, but the state confirms it is not yet established.

Answer

The session is using UDP and the duration is 3600 seconds

Answer

The session is being torn down and will expire in 3599 seconds

Answer

The session is fully established and has been active for 3600 seconds