NSE4 Practice Test 30 — 15 Questions

Question 1

A FortiGate is configured with FSSO using a DC agent. Users authenticate to the domain, but the firewall policy using FSSO groups is not matching traffic. The admin runs 'diagnose debug authd fsso list' and sees user entries. However, the traffic is being denied by the default deny policy. What is the most likely issue?

Accepted Answer

The session was established before the user logged in and is not updated with the user identity. FSSO collects user login events but does not automatically update existing sessions. If a session was established before the user logged in (or before FSSO learned the user), the session will not be associated with the user until the session is refreshed or re-established. The default deny policy catches unmatched traffic.

Answer

The FSSO session timeout is too short

Answer

The firewall policy has the wrong schedule applied

Answer

The user is not a member of the correct FSSO group in Active Directory

Question 2

An administrator wants to block all traffic to websites in the 'Pornography' category but allow an exception for a specific research site that falls under that category. The FortiGuard category is set to block. How should the administrator configure the exception?

Accepted Answer

Add a URL filter entry with the site's domain set to 'Allow'. In FortiGate, to allow a specific site that is blocked by a category, you add a URL filter entry with the action 'Allow' above the category block. URL filter entries are evaluated first and can override the category action.

Answer

Set the FortiGuard category to 'Monitor' and create a URL filter to block all other sites

Answer

Use the DNS filter to allow the site's FQDN

Answer

Add the site to the FortiGuard category override list with action 'Allow'

Question 3

A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?

Accepted Answer

It monitors AD logon events and sends user-IP mappings to the FortiGate. The FSSO collector agent monitors Active Directory for user logon events (via NetAPI or security event logs) and sends this information to the FortiGate, allowing it to map users to IP addresses.

Answer

It acts as a RADIUS proxy between FortiGate and AD

Answer

It polls the FortiGate for user information

Answer

It directly authenticates users to the FortiGate

Question 4

An administrator is configuring an IPsec VPN between two FortiGates using IKEv1. The tunnel must use main mode and support multiple subnets behind each gate. Which Phase2 settings are required to allow multiple subnets? (Choose two.)

Accepted Answer

Create multiple Phase2 selectors, each with different local and remote subnets. To support multiple subnets, you can either configure multiple Phase2 selectors (one per subnet pair) or define the local/remote subnets in the Phase2 configuration. Modern FortiOS allows multiple subnets in a single Phase2. Option B is correct (multiple Phase2 entries), and Option D (using address objects with multiple addresses) is also correct.

Answer

Set the Phase2 keylife to a higher value

Answer

Set the Phase2 proposal to include multiple encryption algorithms

Answer

Enable NAT traversal on the Phase2

Question 5

An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?

Accepted Answer

The remote network in Phase 2 is set to 10.0.0.0/8. In dial-up VPN, the Phase 2 selector on the FortiGate must be set to 0.0.0.0/0 to accept traffic from any remote IP, or the specific remote subnet must match the user's assigned IP pool. If the remote network is set to anything other than 0.0.0.0/0, it may mismatch the client's proposal.

Answer

The remote network in Phase 2 is set to 0.0.0.0/0

Answer

The Phase 1 encryption algorithm is mismatched

Answer

The authentication type requires EAP instead of certificate

Question 6

An administrator needs to configure two-factor authentication for SSL VPN users using FortiToken. Which configuration is required on the FortiGate?

Accepted Answer

Enable FortiToken on the user account and configure the authentication scheme to require token. FortiToken two-factor authentication requires the user account to have a FortiToken assigned. The user can then be required to enter a token code during authentication. The firewall policy itself must use an authentication scheme that enforces two-factor.

Answer

Enable two-factor authentication globally on the FortiGate

Answer

Install the FortiToken mobile app on the FortiGate

Answer

Create a separate firewall policy for token-based authentication

Question 7

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. ZTNA requires a proxy-based policy that inspects traffic, and a ZTNA rule that defines the access conditions (tags, endpoint compliance, etc.).

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 8

An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)

Accepted Answer

ZTNA proxy (application gateway). ZTNA requires a ZTNA proxy to protect the application, a ZTNA rule (policy) to define access criteria, and an access proxy (or application) that listens for incoming connections. Option A, C, and D are correct.

Answer

IPsec VPN tunnel

Answer

Captive portal

Question 9

An administrator wants to configure SSL VPN web mode to allow remote users to access a specific internal web application without installing any client software. Which authentication method is required?

Accepted Answer

Any supported authentication method (local, LDAP, RADIUS, certificates). SSL VPN web mode requires user authentication to grant access. The local database or remote authentication server (LDAP, RADIUS) must be used to authenticate users before they can access the web portal.

Answer

Certificate-based authentication only

Answer

No authentication is required for web mode

Answer

Two-factor authentication with FortiToken is mandatory

Question 10

An administrator wants to authenticate VPN users against an external LDAP server. Which authentication method should be configured in the user group for the SSL VPN portal?

Accepted Answer

LDAP. To authenticate users against an LDAP server, the administrator must create an LDAP server object and then create a user group that references that LDAP server. The group membership is typically based on LDAP group membership.

Answer

RADIUS

Answer

FSSO

Answer

Local

Question 11

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The Phase 1 status shows 'init' and then resets. The administrator runs 'diagnose debug application ike -1' and sees the message 'no acceptable proposal'. Which TWO parameters are MOST likely mismatched?

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The 'no acceptable proposal' error in Phase 1 indicates that the local and remote peers cannot agree on a set of parameters. The encryption algorithm and Diffie-Hellman group are common mismatched parameters.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)

Question 12

A FortiGate is configured for SSL VPN tunnel mode with split tunneling enabled. The administrator wants to ensure that traffic to the corporate DNS server (10.0.1.10) goes through the tunnel while all other traffic goes directly to the internet. Which THREE configuration steps are required?

Accepted Answer

Add the DNS server subnet (10.0.1.0/24) to the split tunneling destinations. For split tunneling with specific destinations routed through the VPN, the administrator must configure the SSL VPN settings to include the DNS server subnet in the split tunneling list, enable split tunneling, and ensure the firewall policy allows the traffic.

Answer

Disable NAT on the tunnel interface

Answer

Configure a static route on the client for 10.0.1.0/24 via the virtual adapter

Question 13

An administrator is configuring email filtering on FortiGate to block spam. Which of the following is required for FortiGate to filter inbound email directly?

Accepted Answer

The FortiGate must be configured as an SMTP proxy. Option A is correct. FortiGate can be configured as an SMTP proxy in the email filter profile to intercept and filter email.

Answer

FortiMail must be deployed as a separate appliance

Answer

SSL deep inspection must be enabled for SMTP traffic

Answer

The email filtering profile must be applied to a policy covering port 110

Question 14

An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?

Accepted Answer

Data Leak Prevention (DLP) with a credit card number sensor. DLP can inspect traffic content for patterns like credit card numbers and block or log the transmission. Antivirus handles malware, application control identifies apps, and web filter blocks URLs.

Answer

Antivirus with FortiSandbox integration

Answer

Web Filter to block all upload sites

Answer

Application Control to block web forms

Question 15

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Option C is correct. Certificate inspection only validates the server certificate's Common Name (CN) and expiration; it does not decrypt the traffic payload, so the antivirus and IPS cannot inspect encrypted content.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic