NSE4 Practice Test 27 — 15 Questions

Question 1

Which TWO statements about IPS in FortiGate are true?

Accepted Answer

IPS can be applied to individual firewall policies via IPS sensors.. IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

Answer

An IPS sensor can only be applied to one firewall policy.

Answer

IPS is not supported in transparent mode.

Answer

IPS only works in flow-based inspection mode.

Question 2

An administrator configures an email filter profile to block spam. Users complain that legitimate emails from a specific partner are being blocked. The admin wants to allow emails from that partner's domain without disabling spam filtering for other domains. What is the BEST approach?

Accepted Answer

Add the partner's domain to the IP allowlist in the email filter profile. Adding the partner's domain to the IP allowlist in the email filter profile is the best approach because it creates a specific exception for that domain while keeping spam filtering active for all other traffic. The allowlist overrides the spam detection engine for matching senders, ensuring legitimate emails are not blocked without weakening the overall security posture.

Answer

Increase the spam threshold until the emails pass

Answer

Disable spam filtering for the entire firewall policy

Answer

Create a separate firewall policy for the partner's traffic without email filtering

Question 3

A mid-sized company has a FortiGate 100F running FortiOS 7.2. They have two internal networks: Trusted (10.1.1.0/24) for employees and Guest (10.2.2.0/24) for visitors. The Guest network has a firewall policy that allows internet access only, with an application control profile that blocks all peer-to-peer and gaming applications. Recently, users on the Guest network have been able to play online games (e.g., Fortnite) despite the block. The administrator checks the application control profile and confirms that 'Fortnite' is listed as blocked. There are no other policies allowing Guest traffic. The administrator also notices that the Guest policy has 'set utm-status enable' and the application control profile is applied. What is the most likely reason that Fortnite is not being blocked?

Accepted Answer

The application control signatures are outdated and do not include the latest Fortnite signatures.. If the Application Control signatures are outdated, the FortiGate may not recognize the latest Fortnite traffic patterns or encrypted handshakes, allowing the game to bypass the block. Even though the policy has UTM enabled and the profile is applied, stale signatures cannot match new application variants or updates. Regularly updating the IPS/Application Control database via FortiGuard is essential to maintain effective blocking.

Answer

The firewall policy is missing 'set deep-inspection enable' for application control to work.

Answer

SSL inspection is required to block encrypted game traffic, and it is not enabled.

Answer

The application control profile is not applied to the correct policy.

Question 4

A FortiGate administrator is troubleshooting a high CPU usage issue. The 'get system performance status' command shows that the CPU usage is consistently above 80% with no traffic. Which of the following is the most likely cause?

Accepted Answer

A process such as the IPS engine is stuck in an infinite loop.. When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.

Answer

An interface is in error-disable state causing CPU interrupts.

Answer

The firewall policy is misconfigured, causing packet drops.

Answer

A DDoS attack is overwhelming the CPU.

Question 5

An administrator runs the command shown in the exhibit and sees anomalies detected from 10.1.1.100 to 10.2.2.200. The IPS sensor's anomaly settings are configured with the default actions. What will be the default action for the ICMP Flood anomaly?

Accepted Answer

Block. By default, FortiGate IPS sensors set the action for ICMP Flood anomalies to 'Block'. This default action is defined in the IPS sensor configuration and is applied when the anomaly threshold is exceeded, as indicated by the detected anomalies from 10.1.1.100 to 10.2.2.200.

Answer

Monitor

Answer

Pass

Answer

Quarantine

Question 6

An organization requires that outbound HTTP and HTTPS traffic from the internal network be translated to a single public IP address (203.0.113.1) using overload NAT (PAT). Which TWO configurations are necessary?

Accepted Answer

Create an IP pool with type 'Overload' and specify the public IP address. Overload NAT (PAT) allows multiple internal hosts to share a single public IP by translating source ports. To achieve this, you must create an IP pool with type 'Overload' that specifies the public IP address (203.0.113.1) and then enable NAT on the firewall policy, selecting that IP pool. This configuration ensures outbound HTTP/HTTPS traffic is translated to the single public IP with unique source ports.

Answer

Disable 'Allow Traffic' on the implicit deny policy

Answer

Configure a one-to-one NAT IP pool

Answer

Configure a VIP for the public IP

Question 7

You run the following CLI command on a FortiGate: 'diagnose vpn ike config list'. The output includes: 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0'. What does this indicate?

Accepted Answer

The Phase 2 configuration is using 10.0.1.0/24 as local subnet and 192.168.1.0/24 as remote subnet. The 'diagnose vpn ike config list' command displays the Phase 2 configuration for an IPsec VPN tunnel. The output 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0' directly indicates the local and remote subnets defined in the Phase 2 selector, where 'src' is the local subnet and 'dst' is the remote subnet. This confirms that the Phase 2 configuration is using 10.0.1.0/24 as the local subnet and 192.168.1.0/24 as the remote subnet.

Answer

The firewall policy is allowing traffic from 10.0.1.0/24 to 192.168.1.0/24

Answer

The Phase 1 configuration is using 10.0.1.0/24 as local address

Answer

The tunnel is in dial-up mode with dynamic remote subnet

Question 8

Which protocol does FortiGate use to synchronize sessions between HA cluster members?

Accepted Answer

FGCP. FortiGate uses the FortiGate Cluster Protocol (FGCP) to synchronize session tables, configuration, and state information between HA cluster members. FGCP is a proprietary protocol that ensures seamless failover by replicating session data in real time, allowing the backup unit to take over active sessions without interruption.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 9

An administrator wants to use ZTNA (Zero Trust Network Access) to secure access to an internal application. Which component is required on the client device to enforce ZTNA policies?

Accepted Answer

FortiClient. FortiClient is the required endpoint component for ZTNA because it acts as the ZTNA agent on the client device, establishing a secure tunnel (via IPSec or SSL VPN) to the FortiGate and enforcing posture checks (e.g., OS version, antivirus status) before granting access. Without FortiClient, the FortiGate cannot verify the device's trust level or enforce ZTNA access policies at the endpoint.

Answer

FortiManager

Answer

FortiToken

Answer

FortiAnalyzer

Question 10

An admin needs to configure a FortiGate to send logs to a FortiAnalyzer. Which TWO steps must be performed? (Choose two.)

Accepted Answer

Configure the FortiAnalyzer IP under config system log-fortianalyzer. The FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

Answer

Set the log aggregation interval

Answer

Configure SNMP trap destinations

Answer

Create a firewall policy to allow traffic to FortiAnalyzer

Question 11

Which command is used to back up the full FortiGate configuration including all settings and objects?

Accepted Answer

execute backup config. The 'execute backup config' command is the correct method to back up the full FortiGate configuration, including all settings and objects, to a TFTP or FTP server. This command exports the entire running configuration in a text format that can be restored later. It is the standard CLI command for a complete configuration backup.

Answer

execute backup full-config

Answer

config backup tftp

Answer

system backup configuration

Question 12

Which TWO configuration changes can reduce the risk of unauthorized administrative access to a FortiGate?

Accepted Answer

Restrict administrative access to trusted hosts. Restricting administrative access to trusted hosts (Option B) is a fundamental security best practice that limits the source IP addresses allowed to connect to the FortiGate management interface. By configuring a trusted host list, the FortiGate will only accept administrative sessions (e.g., HTTPS, SSH, or Telnet) from specified IP addresses or subnets, effectively blocking all unauthorized sources. This reduces the attack surface and prevents brute-force or credential-stuffing attacks from untrusted networks.

Answer

Use the default 'admin' account for all administrators

Answer

Set a simple password for ease of use

Answer

Disable both HTTPS and HTTP administrative access

Question 13

An administrator needs to upgrade the firmware on a FortiGate from version 6.4.10 to 7.0.1. The device currently runs FortiOS 6.4.10. Which upgrade path should be followed?

Accepted Answer

Upgrade to 7.0.0 first, then to 7.0.1. Fortinet requires a sequential upgrade path for major version jumps. FortiOS 6.4.10 can upgrade directly to 7.0.0, and then to 7.0.1, because 7.0.0 is the first release in the 7.0 branch. Upgrading directly from 6.4.10 to 7.0.1 is not supported as it skips the required intermediate version.

Answer

Downgrade to 6.2.0 then upgrade to 7.0.1

Answer

Upgrade directly from 6.4.10 to 7.0.1 via the GUI

Answer

Upgrade to 6.4.99 (if exists) then to 7.0.1

Question 14

An administrator wants to limit the bandwidth for a specific application (e.g., YouTube) across all users. The administrator creates a traffic shaper and applies it to the firewall policy. What additional configuration is needed to identify YouTube traffic?

Accepted Answer

Apply an Application Control profile to the policy. Application Control profiles are specifically designed to identify and control traffic based on application signatures, such as YouTube. A traffic shaper limits bandwidth, but it requires an Application Control profile to classify the traffic as YouTube before the shaping can be applied. Without this profile, the firewall cannot distinguish YouTube from other web traffic.

Answer

Enable deep inspection and create a URL filter

Answer

Create a custom service object for YouTube

Answer

Use a geography object to block non-local traffic

Question 15

A FortiGate administrator wants to restrict access to a sensitive server (10.0.0.100) such that only users who authenticate via LDAP can access it. Which firewall policy configuration is required?

Accepted Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP, set groups "LDAP-Users". It combines the required firewall policy elements: enabling authentication, setting the authentication type to LDAP, and restricting access to members of the LDAP group 'LDAP-Users'. This ensures that only users who successfully authenticate via LDAP and belong to the specified group can reach the sensitive server at 10.0.0.100. Without the group restriction, any authenticated LDAP user could access the server, which does not meet the requirement of restricting access to only authenticated users.

Answer

Policy: source any, destination 10.0.0.100, service any, action accept

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable FSSO authentication