NSE4 Practice Test 33 — 15 Questions

Question 1

Which THREE statements about FortiGate's 'config system global' settings are true? (Choose three.)

Accepted Answer

The 'admin-login-retry-limit' setting limits the number of failed login attempts before lockout.. The 'admin-login-retry-lockout' setting (often referred to as 'admin-login-retry-limit' in older firmware) defines the number of consecutive failed administrative login attempts before the administrator account is locked out for a specified duration. This is a security feature to prevent brute-force attacks against the management interface.

Answer

The 'trusthost' setting restricts administrative access to specific source IPs.

Answer

The 'allowaccess' setting controls which protocols are allowed on an interface.

Question 2

A FortiGate is configured with an active-passive HA cluster. The admin notices that when the primary unit fails, the secondary takes over, but after the primary recovers, it does not automatically become active again. What is the most likely reason?

Accepted Answer

Override is not enabled. In FortiGate HA, when the primary unit recovers after a failover, it does not automatically reclaim the primary role unless 'override' is enabled. Without override, the current primary (formerly secondary) retains the active role, and the recovered unit becomes the secondary. Enabling override allows the unit with the higher priority (or lower monitor priority value) to take over as primary when it comes back online.

Answer

The primary has a lower priority than the secondary

Answer

Session pickup is disabled

Answer

The heartbeat interface is down

Question 3

An administrator needs to configure destination NAT for multiple internal servers using a single public IP address by differentiating based on destination port. The public IP 203.0.113.10 should map to: (A) 10.0.0.1:80 for HTTP, (B) 10.0.0.2:443 for HTTPS. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a VIP for HTTP mapping port 80 to 10.0.0.1. A Virtual IP (VIP) is required to map the public IP 203.0.113.10 and destination port 80 to the internal server 10.0.0.1:80. This is the standard FortiGate method for destination NAT (port forwarding) when multiple internal servers share a single public IP, differentiated by destination port.

Answer

Create an IP pool for the public IP

Answer

Configure policy-based routing for each server

Answer

Use Central SNAT with port forwarding

Question 4

An administrator needs to configure outbound NAT for 200 internal users using a single public IP (203.0.113.1). The public IP provides 2000 ports. Some applications require a deterministic source port range for logging. Which TWO NAT settings should be used?

Accepted Answer

IP Pool type: Overload. (IP Pool type: Overload) is correct because it enables Port Address Translation (PAT), allowing 200 internal users to share a single public IP (203.0.113.1) by multiplexing sessions across the 2000 available ports. Option E (Set 'Fixed Port Range' on the IP Pool) is correct because it assigns a deterministic source port range to each user, which is required for logging and auditing applications that expect consistent port mappings.

Answer

IP Pool type: One-to-One

Answer

Configure a VIP for the public IP

Answer

Enable session helper for application

Question 5

An administrator wants to block all peer-to-peer (P2P) file sharing applications such as BitTorrent and eMule on the network. Which THREE steps should the administrator take?

Accepted Answer

Enable deep inspection on the firewall policy to detect encrypted P2P traffic. Enabling deep inspection on the firewall policy allows the FortiGate to decrypt and inspect encrypted P2P traffic, such as BitTorrent or eMule using TLS/SSL. Without deep inspection, the firewall cannot see inside encrypted packets to identify P2P signatures, making application control ineffective for encrypted flows.

Answer

Configure a web filter profile to block P2P websites

Answer

Enable antivirus to block P2P protocols

Question 6

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Accepted Answer

Review the firewall policies that apply to the traffic and modify as needed. The debug flow output shows the packet was received on port1 and then hit 'Deny by policy', meaning a firewall policy explicitly blocked the traffic. The next logical step is to review the firewall policies that match the traffic's source, destination, service, and incoming interface, and adjust them to permit the intended flow.

Answer

Check the routing table for the destination

Answer

Restart the FortiGate to clear session table

Answer

Enable session helper for the protocol

Question 7

A FortiGate administrator wants to send logs to both a local disk and a remote FortiCloud account. Which two conditions must be met for this to work? (Choose two.)

Accepted Answer

The FortiGate must have a valid FortiCloud subscription. The FortiGate must have local storage (disk) to store logs locally. It also must have connectivity to FortiCloud servers, and logging to FortiCloud must be enabled. The local disk logging is a separate configuration.

Answer

The FortiGate must be configured to log to both destinations simultaneously

Answer

The FortiGate must be in NAT mode

Answer

The FortiGate must have a policy to allow outbound traffic to FortiCloud

Question 8

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

Accepted Answer

Overload NAT. Overload NAT (also known as Port Address Translation or PAT) is the correct method because it allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is exactly what the administrator needs: translating all internal-to-internet traffic to one public IP.

Answer

Central SNAT

Answer

One-to-one NAT

Answer

Fixed port range NAT

Question 9

An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?

Accepted Answer

The heartbeat interface is not configured. For a FortiGate HA cluster to form, the heartbeat interfaces must be properly configured and connected. The heartbeat interface is used for HA synchronization and monitoring between the units. If the heartbeat interface is not configured, the FortiGates cannot communicate, and the cluster will not form, leaving both units in a non-active state. Since both units have the same model and firmware, and the issue is that neither becomes active, the most likely cause is that the heartbeat interface is not configured.

Answer

The management interface is used as a heartbeat

Answer

The HA password is incorrect

Answer

The HA group-id does not match

Question 10

An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The command 'diagnose sniffer packet' is used on FortiGate to perform real-time packet capture on an interface. It allows administrators to see packet details, including headers and payloads, to troubleshoot traffic flow issues and identify dropped packets.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose debug flow

Question 11

Which FortiGate feature allows administrators to verify if a specific IP address is being blocked by a security policy?

Accepted Answer

diagnose debug flow. The 'diagnose debug flow' command allows administrators to trace the path of a packet through the FortiGate, showing which security policy, routing, and other checks it matches. By filtering on a specific IP address, administrators can see if traffic from that IP is being blocked by a policy and the reason for the block.

Answer

diagnose sys session list

Answer

get system ha status

Answer

diagnose sniffer packet

Question 12

Given the above IPS sensor configuration, what will happen when traffic matching a high-severity IPS signature is detected?

Accepted Answer

The traffic will be allowed because no entry exists for high severity.. The IPS sensor configuration shown does not include an entry for high-severity signatures. Without a specific action defined for high severity, the sensor defaults to allowing the traffic while still generating a log entry. This is a common behavior in FortiGate IPS where only explicitly configured severity levels have defined actions.

Answer

The traffic will be logged but not blocked.

Answer

The traffic will be blocked only if the signature is enabled globally.

Answer

The traffic will be blocked because the sensor has a block action.

Question 13

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
The output shows many sessions with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the traffic?

Accepted Answer

The sessions are in the SYN_SENT state and have not completed the three-way handshake. The proto=6 indicates TCP, and proto_state=01 indicates a TCP session in the SYN_SENT state (i.e., the three-way handshake is not complete). The long duration suggests these are half-open sessions, possibly indicating a SYN flood attack.

Answer

The sessions are fully established and idle

Answer

The sessions are for UDP traffic

Answer

The sessions are being inspected by SSL deep inspection

Question 14

What is the purpose of the 'override' setting in FortiGate HA?

Accepted Answer

It enables the higher-priority unit to reclaim the primary role after recovery. The 'override' setting in FortiGate HA allows a higher-priority unit to reclaim the primary role after it recovers from a failure. Without override, the primary role does not automatically revert to the original unit even if it comes back online with a higher priority. This ensures predictable failback behavior.

Answer

It allows management access to the cluster via a virtual IP

Answer

It disables HA failover during maintenance windows

Answer

It forces the secondary unit to become primary immediately

Question 15

Which FortiGate log type records information about firewall policy matches and traffic statistics?

Accepted Answer

Traffic logs. FortiGate traffic logs record information about firewall policy matches, including source and destination IP addresses, ports, protocols, and the action taken (allow/deny). They also include traffic statistics such as bytes sent and received. Therefore, traffic logs are the correct log type for this information.

Answer

Event logs

Answer

Audit logs

Answer

Security logs