NSE4 Practice Test 3 — 10 Questions

Question 1

A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

There is no firewall policy permitting traffic from the dial-up interface to the destination network. Even when Phase 1 and Phase 2 are up and the tunnel is established, traffic will not pass through a dial-up IPsec VPN unless a firewall policy explicitly permits traffic from the dial-up interface (often the virtual IPsec interface) to the destination network. The 'diagnose sys session list' showing no sessions for the remote user's IP confirms that the FortiGate is not processing any traffic for that user, which points to a missing or misconfigured firewall policy rather than an encryption or routing issue.

Answer

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Answer

The FortiGate's routing table does not have a route to the remote user's subnet

Answer

The remote user's FortiClient is blocking split tunneling

Question 2

A network administrator notices that HTTP traffic to a specific website is being blocked by the web filter profile, but the website is categorized as 'General – Personal' in FortiGuard, which is allowed. What could cause this block?

Accepted Answer

A URL filter entry is blocking the specific website. A URL filter entry can explicitly block a specific website regardless of its FortiGuard category. Even if the category 'General – Personal' is allowed in the web filter profile, a more specific URL filter rule with a higher priority (lower order number) can override the category-based action. This is a common scenario where an administrator creates a custom URL block for a particular domain or URL pattern, which takes precedence over the FortiGuard category lookup.

Answer

The web filter profile has an incorrect FortiGuard category override

Answer

The antivirus profile is blocking the website

Answer

DNS filter is blocking the domain

Question 3

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface

Question 4

A network administrator has configured a firewall policy allowing traffic from the internal network (10.0.0.0/8) to the internet. Users report that some websites are not loading. The administrator runs 'diagnose firewall iprope list 100000' and sees the policy listed with a hit count of zero. What is the MOST likely cause?

Accepted Answer

The policy is placed below a more specific or broader policy that matches the same traffic. A hit count of zero indicates the firewall policy has never matched any traffic. When a more specific or broader policy exists above it in the sequence, the FortiGate processes policies top-down and stops at the first match, so the lower policy never gets evaluated. This is the most likely cause given that the policy is present but unused.

Answer

The source interface or destination interface is incorrectly configured

Answer

The policy has a schedule that does not match the current time

Answer

The FortiGate has a routing issue preventing traffic from reaching the internet

Question 5

A FortiGate is configured for SSL deep inspection using a CA certificate. Users report that some websites show certificate errors. The administrator wants to allow these sites without inspection. Which setting should be used?

Accepted Answer

Add the websites to the SSL/SSH exemption list. The SSL/SSH exemption list allows administrators to specify websites that should bypass SSL deep inspection entirely, preventing certificate errors for sites that use self-signed, expired, or otherwise untrusted certificates. This is the intended mechanism in FortiOS to exclude specific destinations from inspection while maintaining inspection for all other traffic.

Answer

Disable certificate validation in the SSL inspection profile

Answer

Create a separate firewall policy without SSL inspection

Answer

Set the action for invalid certificates to 'allow'

Question 6

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Accepted Answer

Increase the threshold value. Increasing the threshold value reduces false positives by requiring a higher rate of TCP SYN packets per second before the 'tcp_syn_flood' anomaly triggers an alert or action. This allows legitimate traffic bursts to pass without being flagged, while still detecting genuine SYN flood attacks. The threshold defines the sensitivity of the anomaly detection; raising it makes the detection less sensitive to low-volume spikes.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'

Question 7

A company wants to block all peer-to-peer (P2P) traffic using Application Control on their FortiGate. They have enabled the application control profile, but users can still download files via BitTorrent. What is the most likely reason?

Accepted Answer

The application control profile does not have SSL inspection enabled.. BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Answer

The FortiGate is operating in Transparent mode.

Answer

The application control profile is applied to the outgoing policy, but BitTorrent traffic is incoming.

Answer

The default application signatures do not include BitTorrent.

Question 8

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. A RADIUS server object defines the IP address and shared secret that the FortiGate uses to communicate with the RADIUS server for authentication requests. Option D is correct because a user group must reference the RADIUS server to map authenticated users to policies; without this group, the FortiGate cannot apply firewall rules based on RADIUS authentication.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user

Question 9

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The output shows that the IKE packet is being sent and received (no proposal mismatch or interface down), but the negotiation fails due to a timeout. This indicates that the packet is leaving the local FortiGate but the response is not arriving back, which is classic behavior when a firewall (or ACL) between the peers is blocking UDP 500 or 4500. The timeout occurs because the remote peer never receives the initial packet or the local peer never receives the reply, preventing any IKE exchange from completing.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down

Question 10

Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?

Accepted Answer

Tunnel mode. Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.

Answer

Web mode

Answer

Split tunneling mode

Answer

Clientless mode