NSE4 Practice Test 3 — 10 Questions

Question 1

Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?

Accepted Answer

Tunnel mode. Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.

Answer

Web mode

Answer

Split tunneling mode

Answer

Clientless mode

Question 2

You run the following CLI command on a FortiGate:
# diagnose debug flow filter saddr 192.168.1.10
# diagnose debug flow show function enable
# diagnose debug enable
You then initiate a ping from 192.168.1.10 to 8.8.8.8. The output shows 'no matching policy'. What does this indicate?

Accepted Answer

The traffic is dropped by the implicit deny rule. The 'no matching policy' output from the debug flow indicates that the FortiGate evaluated the packet against its firewall policy table and found no explicit policy permitting the traffic from source 192.168.1.10 to destination 8.8.8.8. Since no matching policy exists, the packet is implicitly denied by the default deny-all rule at the end of the policy table, which drops the traffic without logging unless explicitly configured. This is the expected behavior when no permit policy is configured for the traffic flow.

Answer

The traffic is being NAT'd but not logged

Answer

The debug filter is incorrectly configured

Answer

There is a routing issue preventing the traffic

Question 3

An administrator needs to back up the FortiGate configuration to a remote server using SCP. Which command is correct?

Accepted Answer

execute backup config scp . The correct command is 'execute backup config scp ' because SCP (Secure Copy Protocol) is the only option listed that provides encrypted file transfer over SSH, which is required for securely backing up the FortiGate configuration to a remote server. FortiGate uses this CLI command to initiate an SCP session to the specified server and save the configuration file with the given filename.

Answer

execute backup config copy

Answer

execute backup config tftp

Answer

execute backup config ftp

Question 4

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 5

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 6

An admin needs to allow traffic from a specific IP to a web server on port 8080. The web server is behind a VIP that forwards port 80 to port 8080. When configuring the security policy, which destination should be used?

Accepted Answer

The VIP object. When a VIP is used to translate the destination IP and port (e.g., from public IP:80 to private server IP:8080), the security policy must reference the VIP object as the destination. FortiGate matches the policy using the original destination IP before destination NAT is applied. The VIP object represents the original destination (the external IP) that clients use, so referencing it ensures the policy correctly permits the traffic.

Answer

The virtual IP address of the FortiGate

Answer

The real server IP address

Answer

Any destination, because the VIP translates automatically

Question 7

An administrator wants to block users from uploading sensitive documents through webmail. Which security profile should be configured on the FortiGate to achieve this goal?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the correct security profile because it is specifically designed to inspect content (e.g., file names, patterns, or keywords) in traffic such as webmail uploads and block sensitive data from leaving the network. DLP sensors can be configured with rules to match patterns like credit card numbers, social security numbers, or custom keywords, and then take action such as blocking or logging the session.

Answer

Antivirus

Answer

Application control

Answer

Web filter

Question 8

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

Accepted Answer

The VIP is configured for port forwarding only for HTTP (port 80). The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Answer

The web server is not listening on HTTPS

Answer

The VIP is using overload mode instead of one-to-one

Answer

The firewall policy allowing traffic to the VIP only permits HTTP

Question 9

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN. The hub has multiple Phase 2 selectors for each spoke. What is the recommended way to simplify configuration on the hub when adding new spokes?

Accepted Answer

Use a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote. Using a single Phase 2 selector with 0.0.0.0/0.0.0.0 for both local and remote simplifies hub configuration because it allows the hub to accept traffic for any subnet from any spoke without needing to define specific selectors per spoke. This is recommended in hub-and-spoke topologies to avoid manual updates when adding new spokes, as the hub's Phase 2 configuration becomes generic and automatically matches all spoke traffic.

Answer

Configure each spoke in a separate VDOM

Answer

Use aggressive mode for Phase 1

Answer

Use policy-based VPN instead of route-based

Question 10

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Certificate Inspection only examines the SSL/TLS certificate presented during the handshake, without decrypting the traffic. Because the FortiGate can read the certificate's Common Name (CN) or Subject Alternative Name (SAN), it can block HTTPS connections based on that information, such as by using a URL filter or application control rule that matches the certificate's CN. This is the only deep inspection action possible without full decryption.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic