NSE4 Practice Test 36 — 15 Questions

Question 1

A FortiGate is configured with a firewall policy that applies an Application Control profile and a Web Filter profile. The administrator wants to log all traffic blocked by the Web Filter profile. Which TWO configurations are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Log All Blocked Sites' in the Web Filter profile. The Web Filter profile has a specific setting called 'Log All Blocked Sites' that, when enabled, generates log entries for all traffic that the web filter blocks. This is the direct mechanism to log blocked web traffic at the profile level. Option D is also correct because the firewall policy itself must have logging enabled—either 'Log All Traffic' or 'Log Violation Traffic'—to ensure that the log entries generated by the Web Filter profile are actually recorded and sent to the FortiGate's log system.

Answer

Set the global 'Logging' setting to 'Verbose'

Answer

Configure the Application Control profile to log blocked traffic

Answer

Enable 'Log All Allowed Sites' in the Web Filter profile

Question 2

A network administrator has two FortiGate units that need to be configured as an HA cluster. Which TWO of the following are prerequisites for HA formation?

Accepted Answer

Both units must have the same FortiOS firmware version.. FortiGate HA clusters require all members to run the exact same FortiOS firmware version to ensure protocol compatibility and configuration synchronization. Mismatched firmware versions can cause cluster instability, failover failures, or split-brain scenarios, as the HA heartbeat protocol relies on consistent state machine behavior across units.

Answer

Both units must have the same hostname.

Answer

Both units must be in NAT/Route mode.

Answer

The HA priority must be set to 0 on both units.

Question 3

A FortiGate administrator is configuring intrusion prevention (IPS) for a web server. The administrator wants to both block known exploits and detect anomalous traffic patterns. Which TWO features should be enabled? (Choose two.)

Accepted Answer

IPS signatures. IPS signatures (A) are correct because they contain predefined patterns of known exploits, allowing the FortiGate to match and block malicious traffic against a web server. Anomaly detection (D) is correct because it establishes a baseline of normal traffic and alerts on deviations, enabling detection of zero-day or unusual patterns that signatures may miss.

Answer

Web filter

Answer

Antivirus

Answer

Application control

Question 4

An admin needs to create a firewall policy that allows SMTP traffic (TCP/25) from the internal network (10.0.0.0/24) to a mail server in the DMZ (172.16.1.10). Additionally, the admin wants to ensure that the mail server can only be accessed by the internal network, not from the internet. Which THREE settings must be configured in the firewall policy? (Choose three.)

Accepted Answer

Source interface set to 'internal'. The source interface must be set to 'internal' to restrict the firewall policy to traffic originating from the internal network (10.0.0.0/24). This ensures that only hosts on the internal interface can reach the mail server, effectively blocking any internet traffic that would arrive on a different interface like 'wan'.

Answer

Set schedule to 'always'

Answer

Enable NAT to translate source IP

Question 5

Which FortiGate feature allows the administrator to scan SMTP, IMAP, and POP3 traffic for spam and apply actions such as tagging or discarding?

Accepted Answer

Email filter profile. The Email Filter profile is the correct feature because it is specifically designed to scan SMTP, IMAP, and POP3 traffic for spam and phishing content. It allows administrators to apply actions such as tagging the subject line, discarding the email, or quarantining based on spam scores, blacklists, and heuristics.

Answer

Application control profile

Answer

Antivirus profile

Answer

Web filter profile

Question 6

An administrator is troubleshooting an SSL VPN connection. Users can connect but cannot access internal resources. Which TWO commands would help diagnose the issue?

Accepted Answer

get router info routing-table. The 'get router info routing-table' command displays the FortiGate's routing table, which is essential for verifying that the FortiGate has a route to the internal resources the SSL VPN users are trying to access. If the route is missing or incorrect, traffic from the SSL VPN tunnel will not be forwarded to the internal network. Option B is correct because 'diagnose vpn ssl list' shows active SSL VPN sessions, including the assigned virtual IP (VIP) and tunnel interface, which helps confirm that the user is properly connected and has received an IP address from the correct address pool.

Answer

diagnose vpn ike status

Answer

execute ping 8.8.8.8

Answer

diagnose debug application dnsproxy

Question 7

An administrator is troubleshooting why traffic from a specific VLAN (192.168.10.0/24) to the internet is not being NATed correctly. The firewall policy allows the traffic with NAT enabled and uses an IP Pool (overload) for the source translation. The IP Pool is configured with the address 203.0.113.10. However, the traffic still shows the original source IP. Which THREE of the following could cause this issue? (Choose three.)

Accepted Answer

The firewall policy does not have the IP Pool selected in the NAT section. The IP Pool must be explicitly selected in the NAT section of the firewall policy for the pool to be used for source translation. Without this selection, the firewall will use the default NAT behavior (typically the outgoing interface IP) or no NAT at all, even if NAT is enabled on the policy.

Answer

There is a Central SNAT rule with higher priority that does not match the traffic

Answer

The IP Pool uses one-to-one NAT instead of overload

Question 8

A network administrator notices that a FortiGate IPS sensor is not detecting any attacks, even though there is known malicious traffic on the network. Which initial troubleshooting step should the administrator take?

Accepted Answer

Verify that the IPS engine is running and signatures are up to date.. The first step in troubleshooting a non-functional IPS sensor is to verify that the IPS engine is running and that the IPS signatures are up to date. If the engine is stopped or signatures are outdated, the sensor cannot detect known malicious traffic regardless of other configurations. This foundational check ensures the detection mechanism itself is operational before investigating policy or mode settings.

Answer

Ensure the firewall policy is set to flow-based inspection.

Answer

Disable any DoS policies that might be blocking traffic.

Answer

Check that the FortiGate is configured in NAT mode.

Question 9

A FortiGate administrator is configuring a hub-and-spoke IPsec VPN with three spokes. Each spoke has a dial-up connection to the hub. The hub uses a dynamic DNS name. Which THREE settings are necessary on each spoke to establish the VPN?

Accepted Answer

The pre-shared key or certificate for authentication. In a hub-and-spoke IPsec VPN with dial-up spokes, each spoke must authenticate with the hub. The pre-shared key or certificate (Option B) is required for IKE Phase 1 authentication, ensuring the spoke is trusted before the tunnel is established. Without this, the hub will reject the connection attempt.

Answer

A static route on the spoke for the hub's local networks

Answer

NAT enabled on the spoke tunnel interface

Question 10

The output of 'diagnose debug application ike -1' shows 'no proposal chosen' for a Phase1 negotiation. Which action should the administrator take to resolve this?

Accepted Answer

Check and align the Phase1 encryption, authentication, and DH group settings. The 'no proposal chosen' error in Phase 1 IKE negotiation indicates that the two VPN peers cannot agree on a common set of security parameters (proposal). The administrator must check and align the Phase 1 settings, specifically the encryption algorithm, authentication method, and Diffie-Hellman group, because these are the mandatory parameters matched during the IKE SA negotiation. Option C directly addresses this by ensuring both sides use identical Phase 1 proposals.

Answer

Increase the Phase1 lifetime on both sides

Answer

Verify the pre-shared key is correct

Answer

Change the IKE version from v1 to v2

Question 11

Which TWO actions can cause SSL inspection to fail with certificate errors on client browsers? (Choose two.)

Accepted Answer

The FortiGate's CA certificate has expired.. The FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Answer

The firewall policy allows the traffic.

Answer

The web server's certificate is signed by a public CA.

Answer

The client browser has the FortiGate CA certificate installed.

Question 12

A network administrator configured an IPsec VPN between two FortiGates. Phase 1 is up, but Phase 2 fails to establish. The diagnose output shows 'no matching proposal'. What is the MOST likely cause?

Accepted Answer

The Phase 2 encryption and authentication algorithms do not match between peers. The 'no matching proposal' error in Phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two FortiGate peers. Phase 2 uses these proposals to negotiate the IPsec SA for protecting data traffic, and a mismatch prevents the tunnel from establishing. Since Phase 1 completed successfully, the pre-shared keys and gateway IP are already verified, isolating the issue to Phase 2 configuration.

Answer

The firewall policy allowing the VPN traffic is missing

Answer

The pre-shared keys do not match

Answer

The remote gateway IP address is incorrect

Question 13

A FortiGate administrator needs to configure source NAT for a group of internal servers (10.0.1.100-10.0.1.110) so that each server uses a unique public IP from the range 203.0.113.20-203.0.113.30. The requirement is that each internal IP maps to a fixed external IP (one-to-one mapping) and not port overload. Which TWO settings should be configured in the IP Pool? (Choose two.)

Accepted Answer

External IP Range: 203.0.113.20-203.0.113.30. The External IP Range must be set to 203.0.113.20-203.0.113.30 to define the pool of public IPs that will be mapped one-to-one to the internal servers. Option D is correct because Type: One-to-One ensures each internal IP is permanently mapped to a unique external IP, without port address translation (PAT), meeting the requirement of fixed one-to-one mapping.

Answer

Type: Overload

Answer

Enable 'Fixed Port Range'

Answer

Use Central SNAT instead of IP Pool

Question 14

A FortiGate administrator is troubleshooting why traffic from a specific host (10.0.1.100) to a web server (203.0.113.50) is being denied. The administrator has confirmed that a firewall policy exists that should allow the traffic. Which TWO diagnostic commands would help identify the issue?

Accepted Answer

diagnose firewall policy list. 'diagnose firewall policy list' displays the effective policy table, including policy IDs, match criteria, and action (accept/deny). This helps verify whether the policy intended for the traffic is actually present and in the correct order. Option C is correct because 'diagnose debug flow' enables real-time packet flow tracing, showing exactly which policy is matched (or not) and why the traffic is denied, such as a policy hit with action 'deny' or a session table lookup failure.

Answer

get system performance status

Answer

execute ping-options source 10.0.1.100

Answer

diagnose sniffer packet any 'host 203.0.113.50' 4

Question 15

An administrator is configuring a FortiGate in a transparent mode. Which of the following features is NOT available in transparent mode?

Accepted Answer

Source NAT. In transparent mode, the FortiGate operates as a Layer 2 bridge without routing capabilities, meaning it cannot perform Source NAT (SNAT) because SNAT requires Layer 3 routing to translate source IP addresses. Transparent mode does not have an IP address on its interfaces for routing, so features dependent on Layer 3 forwarding, such as NAT, are unavailable.

Answer

VLAN tagging

Answer

Intrusion Prevention System (IPS)

Answer

Security profiles (AV, web filter)