NSE4 Practice Test 31 — 15 Questions

Question 1

An administrator configures a firewall policy allowing traffic from the internal network to the internet with NAT enabled. Users report that some outbound connections fail intermittently. The administrator runs 'diagnose sys session list' and sees many sessions in 'proto_state=01' with a short TTL. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP pool used for SNAT has exhausted its address range. The 'diagnose sys session list' output showing many sessions in 'proto_state=01' with a short TTL indicates that sessions are failing to establish properly. When the IP pool used for Source NAT (SNAT) exhausts its address range, new outbound connections cannot obtain a translated source IP, causing them to fail intermittently. This matches the symptom of intermittent failures as the pool becomes temporarily depleted.

Answer

The firewall policy has the wrong source interface

Answer

The destination port is blocked by an implicit deny rule

Answer

The antivirus profile is blocking the connections

Question 2

An administrator needs to ensure that all traffic from the internal network to the internet goes through a web proxy for content filtering. Which configuration is required on the FortiGate?

Accepted Answer

Configure an explicit web proxy and create a proxy policy.. To enforce web proxy-based content filtering for all internal-to-internet traffic, the FortiGate must be configured with an explicit web proxy (which listens on a specific IP and port, typically 8080) and a corresponding proxy policy that defines the traffic matching criteria and action. This setup ensures that client browsers are configured to send requests to the proxy, and the proxy policy applies content filtering rules.

Answer

Enable the proxy feature and set the web proxy port to 80.

Answer

Enable web proxy in the firewall policy and set action to accept.

Answer

Configure a transparent proxy by using an SSL inspection profile.

Question 3

You are troubleshooting a FortiGate HA cluster that is not failing over correctly. The cluster has two units in active-passive mode. You check the HA status and see both units are in 'standalone' mode. Which THREE configurations could cause this? (Choose three.)

Accepted Answer

The HA group ID is different on each unit. The HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Answer

The FortiGate is configured in transparent mode

Answer

The firmware versions are different but both are 7.0.x

Question 4

A FortiGate in HA active-passive cluster is experiencing failover events. The administrator runs 'get system ha status' and sees that the 'sync status' is 'out of sync'. What is the most likely cause?

Accepted Answer

The passive unit has a different firmware version.. In an HA active-passive cluster, the 'sync status' indicates whether configuration and session data are synchronized between the primary and secondary units. When the passive unit has a different firmware version, the FortiGate cannot synchronize its configuration or sessions because the data structures and features may differ between versions, leading to an 'out of sync' status. This is a common prerequisite: both units must run the exact same firmware image for HA synchronization to function.

Answer

The HA mode is set to active-active.

Answer

The session synchronization is disabled.

Answer

The heartbeat interface is down.

Question 5

A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?

Accepted Answer

Policy ID 2, because it matches the source interface and destination. Policy ID 2 is matched because it allows all traffic from the DMZ interface to the WAN destination interface without any service restriction. The packet originates from the DMZ interface and is destined to the internet (WAN), so the source and destination interfaces match Policy ID 2. Since Policy ID 2 does not specify a service, it implicitly permits all protocols, including HTTPS.

Answer

Policy ID 1, because it is first in order

Answer

Policy ID 2, but only if it has a service allowing HTTPS

Answer

Implicit deny, because no policy matches HTTPS traffic

Question 6

A FortiGate administrator needs to configure a static route to reach a remote network 192.168.100.0/24 via next-hop 10.0.0.1. Which CLI command should be used?

Accepted Answer

config router static
edit 1
set dst 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
next
end. It uses the proper FortiGate CLI syntax for configuring a static route. The command 'config router static' enters the static route configuration context, and 'set dst' specifies the destination network with a subnet mask (not CIDR notation), while 'set gateway' defines the next-hop IP address. This matches the FortiGate CLI structure for static routes.

Answer

config network route
edit 1
set ip 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
end

Answer

config route static
edit 1
set destination 192.168.100.0/24
set next-hop 10.0.0.1
end

Answer

config router static
edit 1
set dst 192.168.100.0/24
set next-hop 10.0.0.1
end

Question 7

A FortiGate is configured with an IPS profile to detect and block anomalous network behavior. Which THREE types of detection does IPS anomaly detection include? (Choose three.)

Accepted Answer

Port scan detection. Port scan detection is a type of anomaly detection in FortiGate's IPS profile that identifies reconnaissance attempts by monitoring for multiple connection attempts to different ports from a single source. This behavior deviates from normal traffic patterns and is flagged as anomalous, allowing the IPS to block potential scanning activity before an attack progresses.

Answer

Protocol decoding

Answer

Signature-based detection

Question 8

Which TWO are valid types of SSL/TLS inspection available on FortiGate?

Accepted Answer

Full SSL Deep Inspection. FortiGate supports two primary SSL/TLS inspection methods: Certificate Inspection, which validates certificates without decrypting traffic, and Full SSL Deep Inspection, which decrypts, inspects, and re-encrypts traffic to apply security profiles. Option C is correct because Full SSL Deep Inspection is the only method that allows the FortiGate to inspect the payload of encrypted sessions for threats like malware or data leakage.

Answer

Off-box SSL Inspection

Answer

Proxy SSL Inspection

Answer

Passive SSL Inspection

Question 9

An administrator wants to configure SNMPv3 on a FortiGate for secure monitoring. Which configuration is required?

Accepted Answer

Create an SNMPv3 user with authentication and privacy protocols.. SNMPv3 requires a user-based security model (USM) with authentication (e.g., SHA) and privacy (e.g., AES) protocols to provide integrity, authentication, and encryption. Without these, SNMPv3 cannot secure monitoring traffic, making option A the mandatory configuration.

Answer

Enable SNMP agent on the WAN interface only.

Answer

Configure an access control list for SNMP.

Answer

Set SNMP community string to 'public' and enable SNMPv1/v2c.

Question 10

Which FortiGate security feature can be used to block outgoing emails that contain specific keywords, such as confidential information?

Accepted Answer

Email Filter. Email Filter is the correct answer because it is the FortiGate security profile specifically designed to inspect SMTP, POP3, and IMAP traffic for content violations. It can block outgoing emails based on keyword patterns, such as 'confidential', by matching against defined filter rules in the email filter profile, which operates at the application layer.

Answer

Web Filter

Answer

Application Control

Answer

Antivirus

Question 11

A FortiGate needs to resolve DNS names for outbound traffic. The administrator configures DNS servers under System > DNS. However, internal DNS queries for private domains fail. What additional configuration is required?

Accepted Answer

Create a DNS database entry for the private domain.. When a FortiGate is configured with DNS servers under System > DNS, it can resolve public DNS names for outbound traffic. However, for private domains (e.g., internal.company.local), the FortiGate cannot resolve these because they are not registered in public DNS. Creating a DNS database entry for the private domain allows the FortiGate to act as an authoritative DNS server for that domain, providing local resolution for internal queries.

Answer

Add a static route for DNS traffic.

Answer

Configure a DNS server on the WAN interface.

Answer

Enable DNS proxy on the FortiGate.

Question 12

A FortiGate has two firewall policies: Policy 1 (ID 1) allows HTTP from any to 10.0.0.0/8, and Policy 2 (ID 2) denies all traffic from 192.168.1.0/24 to any. Traffic from 192.168.1.10 to 10.0.0.5 on port 80 is received. Which policy will match first?

Accepted Answer

Policy 1 (ID 1) will match and accept the traffic. Policy 1 (ID 1) matches first because FortiGate evaluates firewall policies in sequential order from top to bottom (lowest ID to highest ID) until a match is found. The source IP 192.168.1.10 falls within the 'any' source of Policy 1, and the destination 10.0.0.5 is within 10.0.0.0/8, with HTTP (port 80) matching the service. Since Policy 1 matches, it is applied and the traffic is accepted, even though Policy 2 would also match if reached.

Answer

Both policies will match, and the traffic will be denied

Answer

Policy 2 (ID 2) will match and deny the traffic

Answer

Neither policy matches, so the traffic is dropped by default deny

Question 13

An administrator notices that VoIP traffic (SIP) is not being inspected by the IPS profile applied to the firewall policy. The administrator suspects the traffic is being accelerated by NPU offloading. Which TWO actions can prevent NPU offloading for SIP traffic to ensure IPS inspection? (Choose two.)

Accepted Answer

Change the policy inspection mode to 'Proxy-Based'. Changing the inspection mode to 'Proxy-Based' forces the firewall to reassemble and inspect the entire SIP session in software, bypassing NPU offloading. NPU offloading accelerates traffic by processing packets in hardware, which skips deep inspection like IPS. Proxy-based inspection ensures the firewall acts as a proxy for the SIP traffic, allowing IPS to inspect the payload.

Answer

Enable 'Set SNAT' on the policy

Answer

Enable 'Deep Inspection' on the policy

Answer

Create a separate VIP for SIP

Question 14

An administrator is configuring a FortiGate for ZTNA (Zero Trust Network Access). Which TWO components are essential for ZTNA to function? (Choose two.)

Accepted Answer

FortiClient EMS for endpoint compliance. FortiClient EMS is essential for ZTNA because it enforces endpoint compliance by collecting device posture data (e.g., OS version, antivirus status, disk encryption) and communicating this to FortiGate via the FortiTelemetry protocol. Without EMS, the FortiGate cannot verify that endpoints meet security requirements before granting ZTNA access, which is a core principle of Zero Trust.

Answer

A firewall policy with ZTNA tags

Answer

A captive portal

Answer

An IPsec VPN tunnel

Question 15

An administrator needs to allow internal users to access a public web server using the server's private IP address, while external users access it via a public IP. Which TWO components are required?

Accepted Answer

A VIP (Virtual IP) mapping the public IP to the private IP. A VIP (Virtual IP) is required to map the public IP address to the private IP address of the web server, enabling external users to reach the server via the public IP while the FortiGate performs destination NAT (DNAT). A firewall policy must allow traffic from internal users to the server's private IP, as internal traffic does not traverse the VIP and must be permitted directly to the private address.

Answer

Central SNAT policy

Answer

An IP pool for source NAT

Answer

A static route on the FortiGate for the public IP