NSE4 Practice Test 37 — 15 Questions

Question 1

Which FortiGate feature allows you to block access to specific URL categories such as 'Social Media' or 'Gambling'?

Accepted Answer

Web Filtering. FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.

Answer

Antivirus

Answer

Intrusion Prevention System (IPS)

Answer

Application Control

Question 2

An organization wants to implement ZTNA (Zero Trust Network Access) on their FortiGate. Which TWO components are essential for ZTNA? (Select two.)

Accepted Answer

Client certificates for device posture verification. Client certificates are essential for ZTNA because they enable device posture verification, ensuring that only trusted and compliant devices can access protected resources. FortiGate uses client certificates to validate the device's identity and health status before granting access, which is a core principle of Zero Trust.

Answer

A dedicated VPN tunnel

Answer

A static IP address for the client

Answer

A RADIUS server for two-factor authentication

Question 3

An admin needs to configure an SSL VPN for remote users that only provides access to specific internal applications, not full network access. What feature should be configured?

Accepted Answer

Split tunneling. Split tunneling (Option C) is the correct feature because it allows the SSL VPN to route only traffic destined for specific internal applications through the encrypted tunnel, while all other traffic goes directly to the internet. This meets the requirement of providing access to specific internal applications without granting full network access, as split tunneling uses routing policies to selectively forward traffic based on destination IP addresses or application ports.

Answer

Full tunneling

Answer

Client certificate authentication

Answer

Web mode portal

Question 4

A FortiGate is configured with an IPS profile that includes a signature with a 'Pass' action. The firewall policy uses this IPS profile. What will happen when traffic matching that signature is detected?

Accepted Answer

The traffic is allowed without logging. When a signature with a 'Pass' action is triggered in an IPS profile applied to a firewall policy, FortiGate allows the traffic to pass through without any further inspection or logging for that specific signature. The 'Pass' action explicitly overrides the default IPS behavior, meaning the traffic is permitted and no log entry is generated for that signature match, as logging is only performed when the action is set to 'Block' or 'Reset'.

Answer

The traffic is allowed, but the session is reset

Answer

The traffic is blocked and logged

Answer

The traffic is blocked and the session is reset

Question 5

What is the primary function of protocol decoders in the FortiGate IPS engine?

Accepted Answer

They normalize traffic for specific protocols to enable signature matching.. Protocol decoders in the FortiGate IPS engine analyze and normalize traffic for specific protocols (e.g., HTTP, DNS, SMTP) by parsing the protocol fields and reconstructing the data stream. This normalization allows IPS signatures to match against a consistent representation of the traffic, regardless of evasion techniques like fragmentation or encoding. Thus, their primary function is to enable accurate signature matching.

Answer

They block malicious IP addresses based on reputation.

Answer

They rate-limit traffic to prevent DoS attacks.

Answer

They decrypt SSL/TLS traffic for inspection.

Question 6

A network administrator wants to authenticate VPN users against an existing LDAP server. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. To authenticate VPN users against an existing LDAP server, the FortiGate must be configured to query the LDAP directory directly for user credentials. The LDAP authentication method (option B) allows the FortiGate to bind to the LDAP server using the user's DN and password, verifying identity against the directory. This is the correct choice because the question explicitly specifies an LDAP server, and FortiGate supports native LDAP authentication for SSL/IPsec VPNs without requiring an intermediate RADIUS or FSSO server.

Answer

FSSO

Answer

RADIUS

Answer

Local

Question 7

An administrator is configuring policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet (172.16.1.0/24) through a different internet connection (wan2) instead of the default route via wan1. The administrator has created a PBR rule matching source 172.16.1.0/24 and set the gateway to the next-hop IP on wan2. The traffic is still using wan1. Which THREE of the following could be causing the issue? (Choose three.)

Accepted Answer

The PBR rule's gateway is not reachable from the FortiGate. PBR requires the specified next-hop gateway to be reachable via a directly connected route or a static route; if the gateway IP on wan2 is not reachable (e.g., due to a missing ARP entry or link failure), the FortiGate will fall back to the routing table and use the default route via wan1. The FortiGate performs a reachability check on the PBR gateway before applying the rule.

Answer

The PBR rule's priority is set too high (e.g., 100) and a static route with lower priority is used instead

Answer

The PBR rule's destination is set to 'all' but the traffic's destination is not covered

Question 8

A FortiGate administrator needs to integrate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection status: disconnected'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the FortiAnalyzer.. The most likely cause is that the FortiGate does not have a route to the FortiAnalyzer. Even with the correct IP and logging enabled, the FortiGate must be able to reach the FortiAnalyzer over the network; without a valid route, the TCP connection (typically on port 514 for syslog or port 443/541 for FortiGate-FortiAnalyzer protocol) will fail, resulting in a 'disconnected' status.

Answer

The FortiGate is in transparent mode.

Answer

The FortiAnalyzer firmware version is newer than the FortiGate's.

Answer

The administrator forgot to enable HTTPS for log upload.

Question 9

Match each FortiGate NAT type to its description.

Accepted Answer

Source NAT: Translates source IP addresses of packets originating from a private network.. Source NAT modifies source IP of outgoing packets; Destination NAT modifies destination IP of incoming packets; Static NAT provides one-to-one mapping; PAT enables many-to-one translation via ports. Distractors swap the descriptions of Source and Destination NAT.

Answer

Source NAT: Translates destination IP addresses of incoming packets.

Answer

Destination NAT: Translates source IP addresses of outgoing packets.

Question 10

An administrator wants to allow remote users to access internal resources using a web browser without installing any client software. Which VPN type should be configured on the FortiGate?

Accepted Answer

SSL VPN web mode. SSL VPN web mode (option D) is correct because it provides clientless remote access to internal resources via a web browser, requiring no software installation. The FortiGate acts as a reverse proxy, translating HTTPS requests from the user's browser to internal HTTP/HTTPS servers, which matches the requirement for browser-only access without client software.

Answer

ZTNA access proxy

Answer

IPsec VPN with dial-up mode

Answer

SSL VPN tunnel mode

Question 11

A remote user reports that they can connect to the FortiGate SSL VPN portal but cannot access internal resources. The administrator checks the SSL VPN settings and sees that the tunnel mode is enabled with split tunneling. What is the most likely cause?

Accepted Answer

The routing table on the client is missing the internal network routes.. With split tunneling enabled, the FortiGate SSL VPN portal connection succeeds, but the client's routing table does not automatically include routes for the internal network. Without those routes, traffic to internal resources is sent to the default gateway instead of through the VPN tunnel, causing access failure. This is the most likely cause because the user can authenticate and establish the tunnel but cannot reach internal subnets.

Answer

The IP pool is exhausted and no IP address was assigned.

Answer

The firewall policy allowing SSL VPN traffic to internal resources is missing.

Answer

The SSL VPN authentication timeout is too short.

Question 12

You run 'diagnose debug application ike -1' and see the following output: 'Initiator: no acceptable proposal'. What is the MOST likely cause of this error?

Accepted Answer

The Phase 1 encryption or hash algorithm is mismatched. The error 'no acceptable proposal' indicates that the IKE Phase 1 negotiation failed because the two VPN peers could not agree on a common set of security parameters. This is most commonly caused by a mismatch in the encryption algorithm (e.g., AES128 vs AES256) or the hash algorithm (e.g., SHA1 vs SHA256) configured on the FortiGate versus the remote peer. The pre-shared key is not checked until after Phase 1 completes, so it would not cause this specific error.

Answer

The pre-shared key is incorrect

Answer

The remote gateway is not reachable

Answer

The firewall policy is blocking UDP port 500

Question 13

An administrator needs to implement two-factor authentication for SSL VPN access using FortiToken. Which configuration steps are required?

Accepted Answer

Assign a FortiToken to the user and set the user's authentication method to two-factor. To implement two-factor authentication for SSL VPN using FortiToken, you must assign a FortiToken to the user and set the user's authentication method to two-factor. This is done in the user configuration (e.g., under User & Authentication > User Definition) by selecting 'FortiToken' as the second factor and linking the token serial number. This ensures that during SSL VPN login, the user must provide both their password and a one-time password from the FortiToken, which is validated locally by the FortiGate without requiring an external RADIUS server.

Answer

Configure the RADIUS server to send FortiToken challenges

Answer

Enable FortiToken on the firewall policy

Answer

Enable two-factor authentication on the SSL VPN portal settings

Question 14

A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?

Accepted Answer

DNS filter profile. To block DNS queries to known malware domains, the FortiGate must apply a DNS filter profile to the firewall policy that allows DNS traffic. The DNS filter profile uses FortiGuard's DNS threat database to block or redirect queries to malicious domains, botnets, and phishing sites. This is the purpose-built profile for DNS-layer protection.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 15

Which IPsec VPN mode uses IP addresses and ports to define interesting traffic, and requires a separate security policy for each tunnel?

Accepted Answer

Policy-based VPN. Policy-based VPN (B) is correct because it defines interesting traffic using source/destination IP addresses and ports, and each tunnel requires a separate security policy to specify which traffic should be encrypted. This contrasts with route-based VPNs, which use virtual interfaces and routing tables to determine traffic, allowing a single policy to handle multiple tunnels.

Answer

Hub-and-spoke VPN

Answer

Dial-up VPN

Answer

Route-based VPN