NSE4 Practice Test 35 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting an IPsec VPN that is dropping traffic intermittently. The administrator runs 'diagnose vpn ike log' and sees many 'DPD' messages. Which THREE conditions could cause frequent DPD (Dead Peer Detection) retransmissions? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

High network latency causing DPD timeouts. High network latency can cause DPD packets to exceed the configured timeout interval, triggering retransmissions. DPD relies on timely responses; if the round-trip time (RTT) consistently exceeds the DPD retry interval, the FortiGate will send repeated DPD messages, leading to intermittent traffic drops as the tunnel may be torn down.

Answer

Mismatched IKE version

Answer

Incorrect Phase 2 proxy IDs

Question 2

Match each FortiGate routing concept to its definition.

Accepted Answer

Static routing: manually configured routes. In FortiGate, static routing relies on manual configuration, while dynamic routing uses protocols like OSPF and BGP. Policy-based routing forwards based on packet characteristics, and ECMP load-balances over equal-cost paths. Common confusions involve swapping the definitions of static and dynamic routing, or confusing dynamic routing with policy-based routing.

Answer

Static routing: routes learned via routing protocols

Answer

Dynamic routing: routing based on packet attributes

Question 3

An administrator is configuring email filtering on FortiGate to block spam. Which of the following is required for FortiGate to filter inbound email directly?

Accepted Answer

The FortiGate must be configured as an SMTP proxy. FortiGate can filter inbound email directly only when it is configured as an SMTP proxy, which allows it to intercept and inspect SMTP traffic at the application layer. This proxy mode enables the FortiGate to apply email filtering profiles, including anti-spam and antivirus, to SMTP sessions without requiring a separate appliance.

Answer

FortiMail must be deployed as a separate appliance

Answer

SSL deep inspection must be enabled for SMTP traffic

Answer

The email filtering profile must be applied to a policy covering port 110

Question 4

Which authentication server type can be used with FortiGate to authenticate remote VPN users with two-factor authentication using FortiTokens?

Accepted Answer

RADIUS. RADIUS is the correct authentication server type because it supports two-factor authentication with FortiTokens, including the ability to forward token challenges (e.g., one-time passwords) between FortiGate and the RADIUS server. FortiGate acts as a RADIUS client, sending authentication requests to a RADIUS server that validates both the user's primary credentials and the FortiToken OTP, enabling secure remote VPN access.

Answer

POP3

Answer

LDAP

Answer

TACACS+

Question 5

An administrator needs to back up the FortiGate configuration to a TFTP server at 10.0.0.10. Which command should be used?

Accepted Answer

execute backup config tftp mybackup.conf 10.0.0.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp

'. This is a standard FortiOS CLI command that uses TFTP (Trivial File Transfer Protocol) to transfer the configuration file to the specified server at 10.0.0.10. Option B matches this syntax exactly.

Answer

tftp -p -l mybackup.conf 10.0.0.10

Answer

execute backup config ftp mybackup.conf 10.0.0.10

Answer

copy config tftp://10.0.0.10/mybackup.conf

Question 6

A FortiGate administrator is configuring IPS to protect against a known exploit targeting a web server. The administrator wants to ensure that the IPS engine can decode the HTTP protocol. Which TWO actions are necessary?

Accepted Answer

Enable the HTTP protocol decoder in the IPS sensor. The HTTP protocol decoder must be enabled in the IPS sensor because the IPS engine uses protocol decoders to normalize traffic and apply signatures correctly. Without the HTTP decoder, the IPS engine cannot parse HTTP headers, methods, or URIs, making it blind to web-based exploits. This is a prerequisite for any HTTP-specific IPS inspection.

Answer

Configure an IP pool for the web server

Answer

Set the IPS action to 'block'

Answer

Disable the FTP protocol decoder

Question 7

You have a hub-and-spoke IPsec VPN with 10 spokes. The central FortiGate (hub) has 10 phase2 selectors, one for each spoke. You need to add a new spoke. What is the MOST efficient way to configure the hub?

Accepted Answer

Configure a route-based VPN and use dynamic routing protocols to advertise routes. A route-based VPN with dynamic routing (e.g., BGP or OSPF) is the most efficient approach because it eliminates the need to manually add a new phase2 selector for each new spoke. The hub can automatically learn the spoke's routes via the dynamic routing protocol, and the single phase2 selector (0.0.0.0/0) covers all traffic, simplifying configuration and scaling. This design also supports redundancy and load balancing across multiple spokes without reconfiguring the hub.

Answer

Add another phase2 selector for the new spoke

Answer

Replace all phase2 selectors with a single policy-based VPN

Answer

Use a single phase2 selector with 0.0.0.0/0.0.0.0 for all spokes

Question 8

An admin needs to allow outbound HTTP and HTTPS traffic from the internal network to the internet. Which two built-in service objects can be used in a single firewall policy to achieve this?

Accepted Answer

HTTP and HTTPS. HTTP (TCP/80) and HTTPS (TCP/443) are the two built-in service objects that specifically match outbound web traffic. A single firewall policy can include both service objects to allow HTTP and HTTPS traffic from internal users to the internet, which is the most precise and secure way to permit web browsing without opening unnecessary ports.

Answer

WEB and SSL

Answer

ANY and HTTPS

Answer

ALL_TCP and ALL_UDP

Question 9

A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?

Accepted Answer

DNS resolution for the Domain Controller is failing. The polling connector relies on the FortiGate communicating with the Domain Controller (DC) to retrieve user logon events. If DNS resolution for the DC fails, the FortiGate cannot resolve the DC's hostname to an IP address, preventing the polling connector from establishing the necessary LDAP or NetAPI connections to collect user session data. This is the most likely cause because the polling connector is configured correctly, but network-level name resolution is a prerequisite for any communication.

Answer

The FSSO agent is not installed on the Domain Controller

Answer

The user group filter is too restrictive

Answer

The FortiGate is not in the same subnet as the users

Question 10

An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The correct command is 'execute backup config tftp ' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.

Answer

diagnose debug config-error-log read

Answer

show full-configuration

Answer

execute restore config tftp

Question 11

A FortiGate administrator needs to upgrade the firmware from FortiOS 6.4 to 7.0. The administrator downloads the upgrade image but when uploading via the GUI, the FortiGate reboots and comes back with the same firmware version. What is the most likely cause?

Accepted Answer

The administrator uploaded the wrong image (e.g., for a different FortiGate model).. Uploading a firmware image intended for a different FortiGate model will cause the upgrade to fail silently. The FortiGate validates the image against its hardware platform; if the image does not match, the device rejects it and reboots with the existing firmware. This is a common issue when administrators accidentally download the image for a different series (e.g., FortiGate 100F vs. 200F).

Answer

The firmware image was corrupted during download.

Answer

The FortiGate does not support firmware upgrade via GUI; CLI must be used.

Answer

The administrator must first upgrade to an intermediate version before 7.0.

Question 12

An administrator wants to block access to websites that host malware. Which FortiGate feature should be configured to achieve this goal?

Accepted Answer

Web Filtering profile with FortiGuard categories. FortiGate's Web Filtering profile with FortiGuard categories is the correct feature because it allows administrators to block access to websites based on URL categories, including those known to host malware. FortiGuard maintains a continuously updated database of malicious URLs, and applying a web filtering profile that blocks the 'Malicious Websites' category directly prevents users from accessing such sites. This is the most straightforward and effective method for blocking malware-hosting websites at the proxy or flow-based inspection level.

Answer

IPS profile

Answer

DNS Filter profile

Answer

Application Control profile

Question 13

A FortiGate is configured in active-active HA mode. An administrator notices that session failover is not working properly during a failover event. Which THREE configurations should be checked?

Accepted Answer

Ensure the load-balance method is set to 'load-balance' or 'weighted-load-balance'.. In active-active HA mode, the load-balance method must be set to 'load-balance' or 'weighted-load-balance' to ensure that session ownership is properly distributed and that session failover can occur. If the method is set to 'hub' or 'spoke', session synchronization and failover may not function as expected, as these modes are designed for different topologies.

Answer

Increase the session TTL.

Answer

Set the HA mode to 'active-passive'.

Question 14

An administrator wants to use FortiManager to manage multiple FortiGates. Which three steps must be performed to establish communication between a FortiGate and FortiManager? (Choose THREE.)

Accepted Answer

Ensure network connectivity between the FortiGate and FortiManager. FortiManager communicates with managed FortiGates over TCP/541 (FGFM protocol). Without IP-level connectivity between the two devices, the registration and management tunnel cannot be established. This is a prerequisite before any configuration steps can succeed.

Answer

Place the FortiGate in transparent mode

Answer

Configure the FortiGate's management interface with an IP address

Question 15

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure voice traffic uses the interface with the lowest latency. Which SD-WAN configuration should be used?

Accepted Answer

Configure an SD-WAN rule with a performance SLA that monitors latency and set strategy to 'Best Quality'. SD-WAN rules with a performance SLA allow the FortiGate to monitor real-time latency on each WAN interface and dynamically route voice traffic to the interface with the lowest latency. The 'Best Quality' strategy selects the best-performing interface based on the SLA metrics, ensuring optimal voice quality.

Answer

Set the strategy to 'Manual'

Answer

Set the strategy to 'Load Balance'

Answer

Use policy-based routing with a higher priority for voice traffic