NSE4 Practice Test 30 — 15 Questions

Question 1

An administrator is configuring ECMP (Equal-Cost Multi-Path) on a FortiGate. Which TWO conditions are required for ECMP to load balance traffic across multiple routes?

Accepted Answer

Routes must have the same priority setting. ECMP requires that multiple routes have the same priority (also known as 'distance' in some contexts) to be considered equal-cost. In FortiGate, priority is a metric that determines route preference; only routes with identical priority can be used simultaneously for load balancing. Option C is also correct because administrative distance must be the same for routes to be considered equal; if administrative distances differ, the route with the lower distance is preferred, and ECMP will not apply.

Answer

Routes must use different next-hop IP addresses

Answer

Routes must be static routes only

Answer

Routes must be through different interfaces

Question 2

A company sets up a hub-and-spoke IPsec VPN where all spokes must communicate through the hub. The hub uses policy-based IPsec. Which THREE configurations are required on the hub to allow spoke-to-spoke traffic? (Select three.)

Accepted Answer

Separate phase2 selectors defining traffic between each pair of spokes. In a hub-and-spoke policy-based IPsec VPN, the hub must have separate phase2 selectors for each spoke-to-spoke traffic flow because policy-based VPNs define encryption domains per pair of subnets. Without these selectors, the hub cannot match spoke-to-spoke traffic to a specific IPsec SA, and the traffic will be dropped or sent unencrypted.

Answer

Configure IKEv2 instead of IKEv1

Answer

Enable NAT on the hub for spoke-to-spoke traffic

Question 3

An administrator wants to back up the FortiGate configuration to a remote FTP server. Which command should be used?

Accepted Answer

execute backup config ftp . The `execute backup config ftp` command is the specific FortiGate CLI command designed to back up the configuration file to a remote FTP server. This command directly initiates an FTP transfer of the current system configuration, ensuring the backup is stored externally for disaster recovery.

Answer

execute restore config ftp

Answer

copy running-config startup-config

Answer

execute backup system ftp

Question 4

An administrator configures Central SNAT with a dynamic IP pool for internet-bound traffic. Some users report that certain applications fail when they should be translated to a specific public IP. The administrator checks the policy-based NAT rules and finds none. What is the most likely reason for the failure?

Accepted Answer

A higher priority Central SNAT rule matches the traffic first. Central SNAT rules are evaluated in order of priority, and the first matching rule is applied. If a higher-priority Central SNAT rule matches the traffic before the intended rule with the specific public IP, the traffic will be translated to the IP defined in that higher-priority rule, causing the applications to fail. Since no policy-based NAT rules exist, the issue lies in the Central SNAT rule priority order.

Answer

The traffic is being dropped by a security profile

Answer

The firewall policy has NAT disabled

Answer

The IP pool is configured on the wrong interface

Question 5

Which log severity level indicates a failure that requires immediate attention?

Accepted Answer

Emergency. In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.

Answer

Debug

Answer

Warning

Answer

Information

Question 6

A FortiGate administrator is troubleshooting a connectivity issue where internal clients cannot reach a public web server. The administrator has confirmed that routing is correct and there are no security profiles blocking traffic. Which TWO debugging steps should the administrator take? (Choose two.)

Accepted Answer

Run a packet capture on the internal interface. Running a packet capture on the internal interface (Option B) allows the administrator to verify whether the client's request is actually reaching the FortiGate and whether the firewall is processing the traffic correctly. This step isolates whether the issue is before, at, or after the FortiGate, which is essential when routing is already confirmed as correct.

Answer

Reboot the FortiGate

Answer

Change the NAT mode to Central SNAT

Answer

Disable the antivirus profile

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is about to expire in 3599 seconds. The 'expire=3599' field indicates the session will be removed from the session table in 3599 seconds. The 'duration=3600' shows the session has been active for 3600 seconds, so the total session lifetime is 7200 seconds (3600 + 3599). This is a normal TCP session (proto=6) in state 01 (SYN_SENT), not an error or idle condition.

Answer

The session is in an error state

Answer

The session has been idle for 3600 seconds

Answer

The session is to port 3600

Question 8

An administrator wants to restrict access to a web server from only specific countries. The FortiGate is located at the network edge. Which address object type should be used in the source field of the firewall policy?

Accepted Answer

Geography address object. A Geography address object allows the FortiGate to match traffic based on the source IP's country of origin, using the built-in GeoIP database. This is the only address object type that can restrict access by country without requiring manual IP range updates.

Answer

FQDN address object

Answer

Wildcard FQDN address object

Answer

Subnet address object

Question 9

A FortiGate is configured with policy-based NAT and multiple IP pools. The administrator wants traffic from the 192.168.1.0/24 subnet to use IP pool 'POOL1' (203.0.113.1-203.0.113.10) and traffic from 192.168.2.0/24 to use IP pool 'POOL2' (203.0.113.11-203.0.113.20). Which THREE steps are necessary?

Accepted Answer

Create two firewall policies, one for each subnet. Policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Answer

Configure a single firewall policy with both subnets in the source address group

Answer

Enable Central NAT and define two NAT policies

Question 10

An administrator wants to log all traffic that is denied by the implicit deny rule. How can this be achieved?

Accepted Answer

Create a firewall policy with action DENY and enable logging, placed above the implicit deny. The implicit deny rule at the bottom of the firewall policy list cannot be modified to enable logging. To log traffic denied by the implicit deny, you must create an explicit firewall policy with action DENY and logging enabled, placed above the implicit deny rule. This explicit deny policy will match traffic that would otherwise hit the implicit deny, and because it is an explicit policy, logging can be enabled on it.

Answer

Configure a firewall policy with action ACCEPT and enable logging

Answer

Enable logging on the implicit deny rule

Answer

Use the 'diagnose debug flow' command to capture all traffic

Question 11

A network administrator needs to allow only HTTPS traffic from the internal network (10.0.0.0/8) to the public DNS server (8.8.8.8). Which firewall policy configuration BEST enforces this restriction?

Accepted Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: HTTPS, Action: Accept. It specifies the internal network (10.0.0.0/8) as the source, the public DNS server (8.8.8.8) as the destination, and HTTPS (TCP/443) as the service, with an Accept action. This precisely matches the requirement to allow only HTTPS traffic from the internal network to that specific destination, blocking all other traffic by default via the implicit deny rule.

Answer

Source: ALL, Destination: 8.8.8.8, Service: HTTPS, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: ALL, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: ALL, Service: HTTPS, Action: Accept

Question 12

An administrator wants to back up the FortiGate configuration to a TFTP server at 10.10.10.10. Which CLI command should be used?

Accepted Answer

execute backup config tftp 10.10.10.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp <server-ip>'. This is because 'execute' is the FortiOS CLI keyword for initiating operational commands, and 'backup config tftp' specifies the action and protocol. The syntax is case-sensitive and must include the 'execute' prefix to be recognized by the FortiGate CLI.

Answer

backup config tftp 10.10.10.10

Answer

copy config tftp 10.10.10.10

Answer

execute save config tftp 10.10.10.10

Question 13

A FortiGate administrator is implementing a policy to allow outbound traffic from the internal network to the internet. The requirements are: (1) all traffic from internal users must be source NATed to the external interface IP, (2) traffic from a specific server must use a different public IP, (3) HTTP traffic must be shaped to 10 Mbps. Which THREE configuration elements should the administrator create? (Choose three.)

Accepted Answer

A traffic shaper for HTTP traffic. A traffic shaper is required to enforce bandwidth limits on HTTP traffic. In FortiGate, traffic shaping policies allow you to define per-policy bandwidth constraints, such as capping HTTP traffic to 10 Mbps, by applying a shaper to the firewall policy that matches HTTP traffic.

Answer

A VIP for the server

Answer

A policy-based routing rule for the server

Question 14

An administrator runs the CLI command: 'diagnose sys session list | grep -i dns' and sees sessions with dst port 53. The administrator has configured a DNS filter profile on the firewall policy. However, DNS requests are not being filtered. What is the MOST likely cause?

Accepted Answer

DNS filtering requires proxy-based inspection mode on the policy. DNS filtering on FortiGate requires proxy-based inspection mode because it needs to reassemble and inspect the full DNS transaction (request and response) to apply filtering rules. Flow-based inspection only examines individual packets and cannot perform the deep application-layer analysis needed for DNS filtering. Therefore, even if the DNS filter profile is correctly applied to the policy, it will not work unless the policy's inspection mode is set to proxy-based.

Answer

The DNS filter profile is applied to the wrong policy direction

Answer

The DNS filter profile has no rules defined

Answer

The FortiGate is in transparent mode

Question 15

You receive an alert that a user's FortiToken synchronization is off. You need to resynchronize the token. Which CLI command achieves this?

Accepted Answer

execute fortitoken-resync . The correct command to resynchronize a FortiToken on a FortiGate is `execute fortitoken-resync `. This CLI command triggers the token to synchronize its time-based one-time password (TOTP) seed with the FortiGate, correcting drift caused by clock skew or battery depletion. Options A, B, and C either use incorrect syntax, perform a different function, or do not exist in the FortiOS CLI.

Answer

diagnose user fortitoken resync <token-serial>

Answer

config user fortitoken edit <token-serial> set status activate

Answer

execute fortitoken-update <token-serial>