NSE4 Practice Test 34 — 15 Questions

Question 1

A FortiGate administrator needs to capture packets on the DMZ interface to troubleshoot a connectivity issue. Which CLI command should be used to start a packet capture?

Accepted Answer

diagnose sniffer packet. The correct CLI command to start a packet capture on a FortiGate is 'diagnose sniffer packet'. This command allows you to capture packets on a specific interface with various filters and verbosity levels. It is the standard tool for troubleshooting connectivity issues at the packet level.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

execute packet-capture start

Question 2

An administrator is troubleshooting why traffic from a specific source IP is not being matched by a policy route. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify the source address object in the policy route matches the traffic's source IP.. The most fundamental step in troubleshooting a policy route mismatch is to verify that the source address object defined in the policy route exactly matches the source IP of the traffic. If the object is misconfigured (e.g., wrong subnet mask, incorrect IP range, or a typo), the traffic will never hit the policy route, regardless of other settings.

Answer

Disable all firewall policies to test routing.

Answer

Change the administrative distance of the default route to 0.

Question 3

An administrator configures a dial-up IPsec VPN with IKEv1 main mode. Remote clients can connect successfully, but the administrator notices that the Phase 1 negotiation takes a long time. Which change would most improve the negotiation speed without compromising security?

Accepted Answer

Enable IKEv2 instead of IKEv1. IKEv2 reduces Phase 1 negotiation time by using a single exchange of two messages (request/response) instead of IKEv1 main mode's six messages. This eliminates the extra round trips required for identity protection and SA negotiation, speeding up the process without reducing security. The question specifies IKEv1 main mode, so switching to IKEv2 directly addresses the slow negotiation while maintaining strong cryptographic protections.

Answer

Switch from main mode to aggressive mode

Answer

Reduce the IKE SA lifetime

Answer

Increase the number of Phase 1 proposals

Question 4

A FortiGate admin wants to authenticate VPN users against an existing Microsoft Active Directory. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. (LDAP) is correct because Microsoft Active Directory natively supports LDAP (Lightweight Directory Access Protocol) for authentication and directory lookups. FortiGate can directly bind to AD using LDAP to verify VPN user credentials against the AD database without requiring an additional RADIUS server or agent. This method is efficient for direct user authentication in a Windows domain environment.

Answer

RADIUS

Answer

FSSO

Answer

TACACS+

Question 5

Match each Fortinet product to its primary role.

Accepted Answer

FortiGate: Provides next-generation firewall and security gateway capabilities.. FortiGate is the NGFW, FortiManager handles centralized management, FortiAnalyzer provides logging/reporting, and FortiSandbox performs advanced threat detection. Common confusions include swapping management with firewall roles or logging with threat detection.

Answer

FortiGate: Centralized management and orchestration.

Answer

FortiManager: Advanced threat detection through behavioral analysis.

Question 6

Which of the following security profiles is used to prevent malicious files from being downloaded via HTTP, FTP, or email by inspecting the content of the traffic?

Accepted Answer

Antivirus. Antivirus (option A) is the correct security profile because it performs deep content inspection of files transferred via HTTP, FTP, or email protocols. It uses signature-based detection and heuristics to identify and block malicious files (e.g., executables, scripts, or archives) before they reach the user, directly preventing malware downloads.

Answer

Application Control

Answer

Web Filter

Answer

Intrusion Prevention System (IPS)

Question 7

A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?

Accepted Answer

Policy 5 has a higher priority because it is above policy 10 in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. Since policy 5 with source 'all' and destination 'all' is listed above policy 10, traffic from 10.0.1.0/24 to the internet matches policy 5 first, preventing policy 10 from ever being evaluated. This is the most likely reason the intended policy is not being matched.

Answer

Policy 10 is configured with an expired security certificate

Answer

The source address object 'internal_subnet' is incorrectly configured

Answer

Policy 10 has a schedule that is not active

Question 8

An administrator wants to block all traffic from the 'P2P' application category but allow traffic from 'File Sharing' applications like Dropbox. Which THREE configurations are required to achieve this?

Accepted Answer

Create an application control profile that sets 'P2P' category to 'block' and 'File Sharing' category to 'allow'. An application control profile directly manages application categories, allowing you to set 'P2P' to 'block' and 'File Sharing' to 'allow'. This profile is then applied to a firewall policy to enforce the desired traffic filtering. Without this profile, the firewall cannot differentiate between these application categories.

Answer

Set the firewall policy inspection mode to proxy-based

Answer

Apply a web filter profile to override the application control

Question 9

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. Which two configurations are required? (Choose two.)

Accepted Answer

Configure FortiAnalyzer IP under config system central-management. The FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.

Answer

Enable log transfer under config log fortianalyzer setting

Answer

Configure a firewall policy to allow logs to leave

Answer

Create a log filter to send all logs

Question 10

An administrator needs to block all traffic from a specific geographic region. Which object type should be used as the source in the firewall policy?

Accepted Answer

Geography address. A geography address object (also known as a geolocation object) allows the firewall to match traffic based on the source IP's registered country or region using GeoIP databases. This is the correct object type when the requirement is to block all traffic from a specific geographic region, as it evaluates the source IP against the FortiGate's built-in geolocation mapping.

Answer

FQDN address

Answer

IP range address

Answer

Wildcard FQDN address

Question 11

An administrator wants to apply a safe search policy to enforce strict search results on Google, Bing, and Yahoo. Which security profile feature should be used?

Accepted Answer

Web filter safe search enforcement. Web filter safe search enforcement is the correct feature because it directly integrates with search engines (Google, Bing, Yahoo) to force the use of their built-in safe search parameters (e.g., Google's 'safe=active' parameter appended to URLs). This ensures that explicit content is filtered at the source, regardless of the user's browser settings or search engine choice.

Answer

Application control to block search engines

Answer

DNS filter to block search engine domains

Answer

Web filter URL filter with keyword blocking

Question 12

Which security profile component is specifically designed to prevent data exfiltration by inspecting outgoing traffic for sensitive data patterns?

Accepted Answer

Data Leak Prevention (DLP). Data Leak Prevention (DLP) is the security profile component specifically designed to inspect outgoing traffic for sensitive data patterns, such as credit card numbers, social security numbers, or custom regex patterns. It uses deep packet inspection (DPI) to analyze content in emails, web uploads, and file transfers, blocking or alerting on matches to prevent unauthorized data exfiltration.

Answer

Application Control

Answer

Antivirus

Answer

Web Filter

Question 13

An administrator is configuring a new FortiGate and wants to allow management access from the internal network via HTTPS. The internal interface is port2 with IP 192.168.1.1/24. Which CLI command correctly enables HTTPS administrative access on port2?

Accepted Answer

config system interface
 edit port2
 set allowaccess https
 end. The `config system interface` command is the proper context to set the `allowaccess` parameter, which controls the administrative protocols (such as HTTPS) permitted on a specific FortiGate interface. By editing port2 and setting `allowaccess https`, the administrator enables HTTPS management access on that interface, allowing internal users to reach the FortiGate's web GUI via 192.168.1.1.

Answer

config firewall policy
 edit 1
 set allowaccess https
 end

Answer

config system admin
 edit admin
 set https enable
 end

Answer

config system global
 set admin-https enable
 end

Question 14

A FortiGate administrator wants to create a firewall policy that matches traffic based on the destination domain name (e.g., *.example.com). Which type of address object should be used?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object (option B) is the correct choice because it allows pattern matching with a leading asterisk (e.g., *.example.com) to match any subdomain of example.com. Standard FQDN objects require an exact, fully qualified domain name and do not support wildcard patterns, making them unsuitable for matching traffic based on a domain pattern like *.example.com.

Answer

FQDN object

Answer

Subnet object

Answer

Geography object

Question 15

A FortiGate administrator needs to ensure that all DNS queries from internal clients are forwarded to a specific DNS server for security filtering. Which configuration should be applied?

Accepted Answer

Enable DNS forwarding under Network > DNS and set the system DNS to the desired server. DNS forwarding on FortiGate allows the device to act as a DNS relay, intercepting DNS queries from internal clients and forwarding them to a specified DNS server for security filtering. This is configured under Network > DNS by setting the system DNS to the desired server, which ensures all DNS traffic is redirected without requiring policy routing or firewall rule changes.

Answer

Use policy routing to redirect DNS traffic to the server

Answer

Create a firewall policy to allow DNS traffic to the external server only

Answer

Configure a DNS database on the FortiGate