NSE4 Practice Test 32 — 15 Questions

Question 1

Which statement about the implicit deny policy at the bottom of the firewall policy list is true?

Accepted Answer

It drops all traffic that does not match any explicit policy. The implicit deny policy is a built-in, unchangeable rule at the bottom of the FortiGate firewall policy list that drops all traffic not matching any explicit policy. It ensures that only explicitly permitted traffic is allowed, enforcing a default-deny security posture. This policy cannot be edited, removed, or reordered, and it applies to all traffic regardless of source.

Answer

It only applies to traffic from the internet

Answer

It can be edited to change the action to accept

Answer

It is optional and can be removed

Question 2

Which TWO of the following are prerequisites for configuring a high availability (HA) cluster on FortiGate? (Choose two.)

Accepted Answer

The FortiGate units must be running the same firmware version.. FortiGate HA requires all cluster members to run the same firmware version to ensure configuration compatibility and consistent behavior. Mismatched firmware can lead to synchronization failures or unpredictable failover events, as the HA heartbeat and session synchronization protocols depend on identical code bases.

Answer

An HA heartbeat interface must be a dedicated interface.

Answer

All interfaces must be configured with static IP addresses.

Answer

The configuration must be identical on both units.

Question 3

An administrator receives alerts about a possible data breach. Sensitive data (credit card numbers) might be leaving the network via email. The admin wants to detect and block such emails. Which THREE security profiles should be combined?

Accepted Answer

SSL deep inspection profile. B is correct because SSL deep inspection is required to decrypt SSL/TLS-encrypted email traffic (e.g., SMTP over TLS) so that the FortiGate can inspect the content for sensitive data like credit card numbers. Without decryption, the DLP and email filter profiles cannot see the payload of encrypted emails, rendering them ineffective.

Answer

Web filter profile

Answer

Antivirus profile

Question 4

A FortiGate administrator is configuring ZTNA for a web application. Which TWO components are required for a ZTNA configuration to function?

Accepted Answer

ZTNA rules. ZTNA rules are the core policy mechanism that defines access control for ZTNA applications, specifying which users and devices can access which resources based on identity and device posture. Without ZTNA rules, the FortiGate cannot enforce the granular, identity-based access decisions that ZTNA requires.

Answer

SSL VPN

Answer

IPsec VPN

Answer

Firewall policy

Question 5

An administrator needs to translate a single internal server (192.168.1.10:8080) to a public IP (203.0.113.10:80) so that external users can access it via HTTP. Which type of VIP should be configured?

Accepted Answer

Port Forwarding VIP. Port Forwarding VIP (also called DNAT or destination NAT) is the correct choice because it translates a single internal server's IP and port (192.168.1.10:8080) to a specific public IP and port (203.0.113.10:80), allowing external HTTP users to reach the internal server. This is a one-to-one mapping of a public IP:port to a private IP:port, which is the exact definition of port forwarding in FortiGate.

Answer

Server Load Balancing VIP

Answer

Virtual IP (VIP) with no port forwarding

Answer

Static NAT (one-to-one VIP)

Question 6

Which TWO types of inspection can be used for HTTPS traffic in a FortiGate security policy?

Accepted Answer

Deep inspection. FortiGate security policies can inspect HTTPS traffic using either deep inspection or certificate inspection. Deep inspection decrypts the SSL/TLS session, inspects the full payload for threats like malware or data leakage, and re-encrypts the traffic, while certificate inspection only validates the server certificate without decrypting the content, checking for certificate validity and revocation.

Answer

Full inspection

Answer

Flow-based inspection

Answer

Proxy-based inspection

Question 7

An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?

Accepted Answer

Traffic shaper (e.g., shared or per-IP shaper). A traffic shaper (shared or per-IP) defines the bandwidth limits (e.g., maximum rate, guaranteed rate) that will be enforced on the traffic. This shaper must be created first to control YouTube streaming bandwidth.

Answer

A DNS filter to block YouTube

Answer

A static route for YouTube's IP range

Question 8

Which TWO statements about firewall policy order are true?

Accepted Answer

Policies are evaluated in the order they appear (top-down). FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Answer

If a packet does not match any policy, it is allowed by default

Answer

A more specific policy should be placed below a less specific one to avoid shadowing

Answer

Once a policy is matched, subsequent policies are still evaluated for logging purposes

Question 9

An organization is implementing two-factor authentication for SSL VPN access using FortiToken. Which THREE components are necessary for this setup?

Accepted Answer

A firewall policy that requires authentication and references the user group. A firewall policy must reference the user group that has two-factor authentication enabled. The policy enforces authentication for SSL VPN traffic, and without this reference, the FortiGate would not require the user to authenticate via FortiToken, defeating the purpose of two-factor authentication.

Answer

An LDAP server for user synchronization

Answer

A RADIUS server for token validation

Question 10

Which THREE steps are necessary when configuring SSL deep inspection on FortiGate? (Choose three.)

Accepted Answer

Create an SSL inspection profile defining the inspection mode.. An SSL inspection profile defines how FortiGate handles encrypted traffic, including the inspection mode (e.g., full or certificate-inspection). This profile is a mandatory component for deep inspection, as it specifies whether to decrypt, re-encrypt, or simply examine certificates.

Answer

Add a static route to the internet.

Answer

Configure a forward proxy server.

Question 11

A FortiGate admin runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. Protocol 6 is TCP, proto_state=01 indicates TCP SYN_SENT state (the first step of the three-way handshake). Duration and expire are in seconds. The session has been open for 3600 seconds (1 hour) and will expire in 3599 seconds, which is unusual for a TCP session that should have completed handshake quickly. This suggests the session is stuck in SYN_SENT, likely due to no SYN-ACK response.

Answer

The session is closing with a FIN flag

Answer

The session is fully established and transferring data

Answer

The session was blocked by a firewall policy

Question 12

An admin needs to authenticate remote users connecting via SSL VPN. The users are in an Active Directory domain. Which authentication method should be configured on the FortiGate to allow users to log in with their domain credentials?

Accepted Answer

LDAP server. LDAP (Lightweight Directory Access Protocol) allows FortiGate to directly query the Active Directory domain controller to authenticate users with their domain credentials. This method validates the username and password against the AD database without requiring an additional RADIUS server or local user accounts, making it the most straightforward choice for SSL VPN authentication with domain users.

Answer

Local user database

Answer

RADIUS server

Answer

FSSO

Question 13

A company has two internet connections (WAN1 and WAN2). The administrator wants to route HTTP traffic from the internal network through WAN1, and all other traffic through WAN2. Which TWO configurations are needed?

Accepted Answer

Define an SD-WAN rule that matches HTTP and sets WAN1 as preferred. SD-WAN rules allow you to define application-based routing policies. By creating an SD-WAN rule that matches HTTP traffic and sets WAN1 as the preferred interface, the FortiGate will automatically steer HTTP sessions out through WAN1 while using the default routing table (which points to WAN2) for all other traffic. This leverages the SD-WAN feature's ability to perform per-application load balancing and failover without requiring policy-based routing.

Answer

Apply NAT with IP pool on the firewall policy

Answer

Add a static route with a lower priority to WAN1

Answer

Configure load balancing between WAN1 and WAN2

Question 14

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Accepted Answer

Heartbeat interfaces must be on the same subnet.. FortiGate HA heartbeat interfaces must be on the same subnet to allow the heartbeat packets (typically UDP port 496) to be exchanged directly between the primary and secondary units. This ensures Layer 2 adjacency is maintained for reliable failure detection and synchronization.

Answer

Heartbeat interfaces must be in the same VDOM.

Answer

Heartbeat interfaces must be dedicated management ports.

Answer

Only two heartbeat interfaces can be configured.

Question 15

A FortiGate admin wants to create a firewall policy that allows traffic from the internal network to the internet. The source is a subnet 192.168.1.0/24, and the destination is 'all'. The admin wants to apply NAT to hide internal IPs. Which NAT configuration is BEST suited for this scenario?

Accepted Answer

Enable 'NAT' on the firewall policy and use the outgoing interface address. Enabling NAT on the firewall policy with the outgoing interface address is the standard method for source NAT (masquerading) in FortiGate. This configuration translates all internal source IPs (192.168.1.0/24) to the single IP address of the egress interface, hiding the internal subnet from the internet. It is the simplest and most efficient approach for typical internet-bound traffic, requiring no additional objects like IP pools or VIPs.

Answer

Configure a VIP for source NAT

Answer

Use policy-based routing to send traffic through a NAT device

Answer

Create a one-to-one IP pool and apply it to the policy