NSE4 Practice Test 29 — 15 Questions

Question 1

An administrator is planning a firmware upgrade from FortiOS 6.0 to 7.2. Which THREE steps should be performed before starting the upgrade process?

Accepted Answer

Read the release notes for the target firmware version. Reading the release notes for the target firmware version (FortiOS 7.2) is essential because they document critical upgrade-specific information, such as deprecated features, changed default behaviors, known issues, and hardware compatibility requirements. Skipping this step can lead to unexpected service disruptions or feature loss after the upgrade, as the release notes often include mandatory pre-upgrade actions like disabling certain features or adjusting configurations.

Answer

Remove all static routes to avoid routing issues

Answer

Disable all antivirus and IPS sensors

Question 2

An administrator is configuring an IPS profile on FortiGate to detect and block SQL injection attacks. The profile must be applied to inbound traffic to a web server. Which TWO settings should the administrator enable to achieve this goal? (Choose two.)

Accepted Answer

Add the 'SQL.Injection' signature to the IPS sensor and set action to 'block'.. SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Answer

Create a DoS policy to limit the number of connections per second.

Answer

Enable the HTTP protocol decoder in the application control profile.

Answer

Configure the IPS sensor to bypass traffic from trusted IP addresses.

Question 3

A FortiGate is configured with two WAN interfaces (port1 and port2) connected to different ISPs. The administrator wants to load-balance outbound traffic across both links using equal-cost routes. Which routing configuration should be applied?

Accepted Answer

Configure static routes with equal distance and enable ECMP.. ECMP (Equal-Cost Multi-Path) routing allows a FortiGate to load-balance outbound traffic across multiple interfaces when static routes have the same distance (administrative distance) and destination. By configuring two static routes with equal distance (e.g., 10) to 0.0.0.0/0 via port1 and port2, the FortiGate automatically distributes sessions across both links using a hash-based algorithm (e.g., source-destination IP), achieving the desired load balancing without dynamic routing protocols.

Answer

Configure policy routes to direct traffic based on source IP.

Answer

Enable BGP to dynamically learn routes from both ISPs.

Answer

Configure static routes with different distances (e.g., 10 and 20) to the same destination.

Question 4

Which command is used to back up the FortiGate configuration to a TFTP server?

Accepted Answer

execute backup config tftp . The correct command to back up the FortiGate configuration to a TFTP server is 'execute backup config tftp '. This is because FortiGate uses the 'execute' command for operational tasks, and 'backup config tftp' specifically instructs the system to export the running configuration to a TFTP server. The other options use incorrect syntax or commands that are not recognized by the FortiGate CLI.

Answer

save config tftp

Answer

backup tftp config

Answer

copy config tftp

Question 5

You run 'diagnose debug application sslvpn -1' and see the following output:
sslvpn: SSL VPN tunnel mode connection from 10.0.0.5:12345 to 192.168.1.100:443
sslvpn: User 'john' authenticated successfully
sslvpn: Error: no matching policy for the request. What does this indicate?

Accepted Answer

There is no SSL VPN policy that allows the user to access the destination IP/port. The error 'no matching policy for the request' indicates that the SSL VPN tunnel mode connection from user 'john' (source IP 10.0.0.5) to destination 192.168.1.100:443 did not match any SSL VPN policy configured on the FortiGate. SSL VPN policies define which users or user groups can access specific destination IP addresses and ports. Since authentication succeeded but no policy matched, the connection is denied at the policy layer, not due to authentication or interface issues.

Answer

The user's password has expired

Answer

The SSL VPN interface is administratively down

Answer

The FortiGate is not licensed for SSL VPN

Question 6

Which TWO statements about firewall policy authentication are correct?

Accepted Answer

Authentication can be configured on a per-policy basis. FortiGate firewall policies allow authentication to be enabled on a per-policy basis using the 'set auth-on-demand' or 'set auth-cert' options, which enforce user authentication before traffic is processed. This granular control enables administrators to apply authentication only to specific policies, such as those controlling access to sensitive resources, without affecting other traffic flows.

Answer

Authentication cannot be used with FSSO

Answer

Authentication is only supported for inbound traffic

Answer

Authentication is performed after the traffic is allowed by the policy

Question 7

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Accepted Answer

Enable UDP session synchronization.. UDP session synchronization must be enabled to replicate UDP session state between HA cluster members, ensuring that active sessions for voice traffic (which typically uses UDP) are seamlessly taken over by the standby unit during a failover. Without this setting, UDP sessions are not synchronized by default, and voice calls would drop.

Answer

Set HA override to enabled.

Answer

Enable configuration synchronization.

Answer

Set failover hold time to 1 second.

Question 8

An administrator runs 'diagnose firewall iprope list 100000' and sees 'action=deny' entries for traffic that should be allowed. The policy list shows an allow policy with ID 1 for that traffic. What is the most likely cause of the deny?

Accepted Answer

The firewall policy is not installed in the kernel due to an error. The 'diagnose firewall iprope list 100000' command displays the kernel-level firewall policy list. If the policy list shows an allow policy (ID 1) but the kernel entries show 'action=deny', it indicates that the policy was not successfully installed into the kernel's connection tracking or firewall engine. This typically occurs due to a policy installation error, such as a configuration inconsistency or a failure during the commit process, causing the kernel to fall back to a default deny action for that traffic.

Answer

The traffic is being blocked by a local-in policy

Answer

The implicit deny rule is being triggered because the policy is disabled

Answer

A security profile is dropping the traffic after the policy matches

Question 9

A FortiGate administrator needs to ensure that traffic from the LAN (192.168.1.0/24) to the DMZ (10.0.0.0/24) uses a specific outbound interface (port3) instead of the default route. Which feature should be configured to achieve this?

Accepted Answer

Policy-based routing (PBR) in the firewall policy. Policy-based routing (PBR) allows the FortiGate to override the routing table for specific traffic based on criteria defined in a firewall policy, such as source and destination addresses. By configuring a PBR rule that matches traffic from 192.168.1.0/24 to 10.0.0.0/24 and setting the outbound interface to port3, the administrator can force this traffic to use port3 instead of the default route. This is the correct feature for interface-based path selection that is not based on destination prefix alone.

Answer

Static route with a higher distance

Answer

Virtual IP (VIP) with port forwarding

Answer

SD-WAN rule to force traffic to port3

Question 10

A company has a FortiGate at headquarters running FortiOS 7.2 and a remote office with a FortiGate 60F running FortiOS 7.0. They have an IPsec VPN tunnel between them for site-to-site connectivity. Recently, the remote office upgraded their FortiGate from 6.4 to 7.0. After the upgrade, the VPN tunnel is down. The Phase 1 status shows 'negotiating' but never completes. The administrator has verified that the pre-shared key, IKE version (IKEv2), and authentication method are the same on both sides. The Phase 1 proposal on the headquarters is: encryption: AES256, SHA256, DH group 14, lifetime 86400. The remote office uses: encryption: AES256, SHA1, DH group 14, lifetime 86400. What is the most likely cause of the failure?

Accepted Answer

The Phase 1 hash algorithm differs; headquarters uses SHA256, remote uses SHA1.. The Phase 1 proposal mismatch on the hash algorithm (SHA256 vs. SHA1) prevents the IKEv2 peers from agreeing on a common transform set. Even though all other parameters match, the hash algorithm must be identical on both sides for the IKE SA to be established. The 'negotiating' state that never completes is a classic symptom of a proposal mismatch.

Answer

The DH group is different; headquarters uses group 14, remote uses group 5.

Answer

The IKE version is mismatched; headquarters uses IKEv2 and remote uses IKEv1.

Answer

The pre-shared key is incorrect after the upgrade.

Question 11

Refer to the exhibit. An administrator wants to enable SNMP access on the wan1 interface. Which of the following is the most efficient method?

Accepted Answer

Execute 'config system interface' and edit wan1, then set allowaccess ping https ssh snmp.. The 'allowaccess' parameter under 'config system interface' controls which management protocols (ping, https, ssh, snmp, etc.) are permitted on a given interface. By adding 'snmp' to the allowaccess list for wan1, the administrator enables SNMP access on that interface without changing its role or type.

Answer

Change the interface type to 'management' to allow SNMP.

Answer

Execute 'config system interface' and edit wan1, then set snmp-index 1.

Answer

Configure an SNMP community under 'config system snmp community'.

Question 12

A FortiGate administrator needs to block all traffic from a specific geographic region (country) from accessing the internal network. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. A Geography object is specifically designed to represent a geographic region (such as a country) based on IP address geolocation data. When used in a firewall policy, it allows the FortiGate to match traffic sources or destinations by country, enabling the administrator to block all traffic from that region. This is the correct and only address object type that supports country-based filtering.

Answer

FQDN object

Answer

Wildcard FQDN object

Answer

Subnet object

Question 13

An admin wants to ensure that traffic between two internal subnets (10.0.1.0/24 and 10.0.2.0/24) is inspected by the FortiGate but does not have its source IP translated. Which THREE configuration elements are required? (Choose three.)

Accepted Answer

NAT disabled on that policy. When traffic between two internal subnets does not require source IP translation, NAT must be explicitly disabled on the firewall policy. By default, FortiGate policies may have NAT enabled (especially on outbound interfaces), so disabling NAT ensures the original source IP (10.0.1.x) is preserved when communicating with 10.0.2.x. This is configured by setting the 'set nat enable' option to 'disable' in the policy or unchecking NAT in the GUI.

Answer

A static route for each subnet on the FortiGate

Answer

An IP pool for source NAT

Question 14

An administrator needs to allow VoIP traffic from a remote branch (192.168.2.0/24) to the main office (10.0.0.0/8) using UDP ports 5060 and 10000-20000. What is the most efficient way to define the service in the firewall policy?

Accepted Answer

Create a service group containing both service objects. Creating a service group allows you to combine two separate service objects (one for UDP 5060 and one for UDP 10000-20000) into a single logical group, which can then be applied in one firewall policy. This is the most efficient method as it avoids duplicating policies or using an overly broad port range, and it leverages FortiGate's service group feature for clean, manageable rule sets.

Answer

Use a custom service object with port range 5060-20000

Answer

Create two separate firewall policies, one for each port range

Answer

Use the predefined 'VoIP' service object

Question 15

An administrator is configuring a dialup IPsec VPN for remote users. Which two settings must be configured on the FortiGate to allow clients to connect?

Accepted Answer

Enable mode-cfg on the Phase 1 interface.. Mode-config (mode-cfg) on the Phase 1 interface is required to push network configuration parameters (such as DNS, WINS, and the virtual IP address) to remote IPsec VPN clients. This setting enables the FortiGate to act as a server in a dialup VPN scenario, dynamically assigning IP addresses and other settings to clients without requiring static configuration on each client.

Answer

Enable XAuth for user authentication.

Answer

Enable Dead Peer Detection.

Answer

Enable NAT traversal.