NSE4 Practice Test 28 — 15 Questions

Question 1

A FortiGate administrator wants to see real-time debugging output for traffic matching a specific source IP address. Which command sequence would achieve this?

Accepted Answer

diagnose debug flow filter src 10.0.1.10 ; diagnose debug flow show function-name ; diagnose debug enable. The 'diagnose debug flow' command sequence is specifically designed for real-time debugging of traffic flows, allowing filtering by source IP with the 'filter src' option. Enabling debug output with 'diagnose debug enable' then shows flow trace information for packets matching the filter, which is the standard method for live traffic debugging on FortiGate.

Answer

diagnose sys session filter src 10.0.1.10 ; diagnose sys session list

Answer

diagnose sniffer packet any 'host 10.0.1.10' 4

Answer

diagnose debug reset ; diagnose debug enable ; diagnose debug flow show iprope

Question 2

Which address object type allows you to match traffic based on the domain name in the HTTPS SNI field?

Accepted Answer

Wildcard FQDN. The Wildcard FQDN address object type in FortiGate allows you to match traffic based on the domain name in the HTTPS Server Name Indication (SNI) field. Unlike a standard FQDN, which matches the exact domain, the Wildcard FQDN supports patterns like *.example.com, enabling policy enforcement for subdomains and dynamic hostnames within a domain.

Answer

Geography

Answer

Subnet

Answer

FQDN

Question 3

An organization uses LDAP authentication for firewall policies. Users complain that they are frequently prompted for credentials. Which TWO settings can reduce the frequency of authentication prompts?

Accepted Answer

Increase the authentication timeout on the firewall policy.. Increasing the authentication timeout on the firewall policy (Option A) allows the firewall to cache the user's authentication state for a longer period, so users are not re-prompted for credentials as frequently when traffic matches that policy. Enabling single sign-on (SSO) authentication (Option C) leverages Kerberos or NTLM to automatically authenticate users based on their domain logon, eliminating repeated manual credential prompts.

Answer

Increase the idle timeout on the LDAP server.

Answer

Disable captive portal on the interface.

Answer

Use a longer password for LDAP accounts.

Question 4

An admin runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in the SYN_SENT state and is not yet fully established. The output shows 'proto=6' (TCP), 'proto_state=01', 'duration=3600', and 'expire=3599'. In FortiGate's session table, proto_state=01 for TCP indicates the SYN_SENT state, meaning the session has sent a SYN but has not yet received the SYN-ACK. This confirms the session is not fully established. Option B correctly identifies this as a half-open session in the SYN_SENT state.

Answer

The session is stuck in a half-open state due to a firewall policy misconfiguration

Answer

The session is fully established and has been active for 3600 seconds

Answer

The session is using UDP protocol

Question 5

An administrator wants to configure a DNS filter to block access to known malicious domains and also enforce safe search on search engines. Which THREE settings are required in the DNS filter profile? (Choose three.)

Accepted Answer

Add entries to the static domain blocklist. Adding entries to the static domain blocklist allows the administrator to manually specify known malicious domains that should be blocked regardless of FortiGuard category ratings. This provides a hard-coded block for domains that may not yet be categorized or that the administrator wants to ensure are always blocked.

Answer

Configure a DNS sinkhole IP address

Answer

Specify external DNS servers for resolution

Question 6

Refer to the exhibit. An administrator configures the policies as shown. Traffic from 10.0.0.0/8 to the internet on HTTP is denied. What is the most likely reason?

Accepted Answer

The Deny-All policy is placed above the Allow-HTTP policy. In FortiGate firewall policies, the first matching policy is applied to traffic. The Deny-All policy is placed above the Allow-HTTP policy, so traffic from 10.0.0.0/8 to the internet on HTTP matches the Deny-All policy first and is denied before reaching the Allow-HTTP policy. This is a classic policy ordering issue.

Answer

The Allow-HTTP policy uses service HTTP but the traffic uses HTTPS

Answer

The Allow-HTTP policy has the wrong source interface

Answer

The Allow-HTTP policy is disabled

Question 7

A FortiGate administrator wants to block access to gambling websites using web filtering. Which FortiGuard category should be blocked?

Accepted Answer

Gambling. FortiGuard web filtering uses pre-defined categories to classify websites. To block gambling sites, the administrator must select the 'Gambling' category in the web filter profile. This category specifically includes domains and URLs related to online betting, casinos, and other gambling activities.

Answer

Spam

Answer

Malware

Answer

Pornography

Question 8

An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)

Accepted Answer

Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).. FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Answer

Enable SNMP on the FortiGate to allow FortiManager to monitor.

Answer

Configure a VPN tunnel between FortiGate and FortiManager.

Answer

Set the FortiGate's operation mode to transparent.

Question 9

An admin wants to block traffic from a specific geographic region (e.g., North Korea) from reaching the FortiGate's external interface. Which address object type should be used in the firewall policy?

Accepted Answer

Geography address object. A geography address object allows the firewall to match traffic based on the source or destination IP address's registered country. FortiGate uses a built-in GeoIP database to map IP addresses to geographic regions, making it the correct choice for blocking traffic from a specific country like North Korea.

Answer

Subnet address object

Answer

FQDN address object

Answer

Wildcard FQDN address object

Question 10

Which TWO of the following are required for full SSL inspection to work correctly?

Accepted Answer

The FortiGate's CA certificate installed in the Trusted Root Certification Authorities store on client machines.. For full SSL inspection, the FortiGate must generate a session certificate on-the-fly for each HTTPS connection after decrypting it. This requires a CA certificate on the FortiGate to sign those session certificates. Additionally, client machines must trust this CA certificate, so it must be installed in their Trusted Root Certification Authorities store; otherwise, browsers will show certificate warnings and block the connection.

Answer

The private key of each server certificate that will be inspected.

Answer

An intermediate CA certificate imported from the enterprise PKI.

Answer

A certificate signed by a public CA installed on the FortiGate.

Question 11

What is the purpose of a schedule object in a firewall policy?

Accepted Answer

To specify the time of day when the policy is effective. A schedule object in a FortiGate firewall policy defines the time range (e.g., specific hours, days of the week, or recurring intervals) during which the policy is active. When the current time falls outside the schedule, the policy is automatically disabled, allowing administrators to enforce time-based access control without manual intervention. This is distinct from other policy attributes like bandwidth shaping or session limits.

Answer

To set the bandwidth limit for the policy

Answer

To prioritize traffic based on application

Answer

To limit the number of concurrent sessions

Question 12

A FortiGate admin has configured FSSO (Fortinet Single Sign-On) using Active Directory polling. Users authenticate to the domain but when accessing the internet through the FortiGate, they are still prompted for credentials. What is the MOST likely cause?

Accepted Answer

The FortiGate is not polling the AD domain controllers. In FSSO with Active Directory polling, the FortiGate must be configured to poll the domain controllers to retrieve user logon events. If polling is not set up or fails, the FortiGate will not have the user-to-IP mapping, and thus cannot bypass authentication for domain users, causing them to be prompted for credentials when accessing the internet.

Answer

The users are using non-Windows machines

Answer

The firewall policy does not have FSSO authentication enabled

Answer

The FortiGate is not joined to the domain

Question 13

An administrator is troubleshooting a FortiGate that is not passing traffic. The policy allows traffic, but the session table shows no sessions. Which THREE steps should the administrator take to diagnose the issue? (Choose three.)

Accepted Answer

Verify the interface status and link state.. If the interface is down or has a link issue, the FortiGate cannot send or receive any traffic, resulting in no sessions being created even if the policy allows traffic. Verifying interface status and link state is a fundamental first step in troubleshooting connectivity issues, as it ensures the physical or logical layer is operational before checking higher-layer configurations.

Answer

Run 'diagnose npu np6 show' to check offloading.

Answer

Disable the firewall policy and check if traffic flows.

Question 14

A FortiGate is configured in NAT/Route mode. Which statement is correct about this mode?

Accepted Answer

The FortiGate routes traffic between different subnets and can perform NAT.. In NAT/Route mode, the FortiGate operates as a Layer 3 router, forwarding traffic between different subnets while also performing Network Address Translation (NAT) when configured. This is the default operational mode for most FortiGate deployments, enabling both routing and NAT capabilities on the same device.

Answer

Only one interface can be used for traffic.

Answer

VLAN interfaces are not supported in this mode.

Answer

The FortiGate acts as a Layer 2 bridge.

Question 15

An administrator is troubleshooting an IPsec VPN that is not passing traffic. The Phase 1 and Phase 2 are both up. Which TWO CLI commands can be used to verify the VPN tunnel status and traffic flow? (Choose two.)

Accepted Answer

diagnose vpn tunnel list. 'diagnose vpn tunnel list' displays the status of all IPsec VPN tunnels, including Phase 1 and Phase 2 security associations (SAs), their uptime, and the number of packets transmitted and received. This allows the administrator to verify that the tunnel is established and to check for any packet drops or errors that might indicate a traffic flow issue.

Answer

execute ping-options source

Answer

diagnose vpn ike config

Answer

diagnose netlink interface list