NSE4 Practice Test 38 — 15 Questions

Question 1

What is the purpose of enabling 'Safe Search' in a web filter profile on a FortiGate?

Accepted Answer

It forces search engines to filter explicit content from search results.. Safe Search in a FortiGate web filter profile forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific URL parameters (e.g., `&safe=active` for Google) to search queries. This ensures that when users perform searches, the search engine's own safe search setting is enforced at the network level, preventing access to adult or inappropriate material regardless of the user's browser settings.

Answer

It blocks all searches containing the word 'safe'.

Answer

It redirects users to a safe landing page when a blocked site is accessed.

Answer

It encrypts search queries to protect user privacy.

Question 2

An administrator is troubleshooting a slow web application. The admin suspects that the FortiGate's session table might be full, causing new sessions to be dropped. Which command should the admin use to check the current session table utilization?

Accepted Answer

diagnose sys session stat. The command 'diagnose sys session stat' provides a summary of session table statistics, including the current session count, maximum session count, and utilization percentage. This directly answers whether the session table is full. It is the correct command to quickly assess session table utilization without listing every session.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose sys session filter

Question 3

An administrator needs to configure a FortiGate to send logs to an external FortiAnalyzer. Which setting is required?

Accepted Answer

Configuring FortiAnalyzer under Log Settings. FortiGate uses the 'Log Device' or 'FortiAnalyzer' configuration to send logs to an external FortiAnalyzer.

Answer

Setting the log disk quota

Answer

Configuring syslog server

Answer

Enabling FortiCloud logging

Question 4

A FortiGate administrator wants to authenticate VPN users against an existing LDAP server. The administrator creates an LDAP user group on the FortiGate. What additional configuration is REQUIRED to use this group for IPsec VPN authentication?

Accepted Answer

In the IPsec Phase 1 configuration, set the peer type to 'dialup' and specify the user group under authentication. For IPsec VPN authentication, the FortiGate must know which users are allowed to connect. Setting the peer type to 'dialup' in Phase 1 enables the FortiGate to accept connections from remote users rather than another gateway. Specifying the LDAP user group under authentication tells the FortiGate to validate the VPN user's credentials against that group's members, which are resolved via the LDAP server. Without this configuration, the FortiGate has no way to associate the LDAP group with the VPN tunnel.

Answer

Enable LDAP over TLS (LDAPS) on the FortiGate

Answer

Assign the LDAP user group to a firewall policy

Answer

Configure a RADIUS server as an intermediate proxy between FortiGate and LDAP

Question 5

A network admin runs 'diag sys session filter proto 6' and 'diag sys session list' and sees many sessions with state 'SYN_SENT' to a public web server. The firewall policy allows TCP/443. What is the MOST likely cause?

Accepted Answer

The destination NAT (VIP) for the web server is not configured. The 'diag sys session filter proto 6' command filters for TCP sessions (protocol 6). Seeing many sessions stuck in 'SYN_SENT' state indicates that the FortiGate is sending SYN packets to the destination but never receiving a SYN-ACK reply. Since the firewall policy allows TCP/443, the most likely cause is that the destination NAT (VIP) for the public web server is not configured. Without a VIP, the FortiGate forwards the packet with the original destination IP (the public IP), which may not be routable or may not exist on the internal network, causing the SYN to be sent into a black hole.

Answer

The web server is overloaded and dropping connections

Answer

The policy is in proxy mode but should be flow mode

Answer

The firewall policy has session TTL set too low

Question 6

An admin needs to configure NAT so that internal users (10.0.0.0/24) accessing the internet (any destination) are translated using an IP pool (203.0.113.10-203.0.113.20) with overload. The admin also needs to ensure that traffic from a specific server (10.0.0.100) always uses a fixed source port range (10000-20000) when translated. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a central SNAT rule for 10.0.0.0/24 using the IP pool with overload enabled. Central SNAT allows you to translate traffic from the entire 10.0.0.0/24 subnet using an IP pool (203.0.113.10-203.0.113.20) with overload (PAT), which is the standard method for enabling many internal users to share a smaller pool of public IPs. Option E is correct because you need a separate, more specific central SNAT rule for the server 10.0.0.100 that uses the same IP pool but with a fixed port range (10000-20000) enabled, ensuring its translated source ports always fall within that range.

Answer

Configure the IP pool with one-to-one NAT

Answer

Use policy-based NAT instead of central SNAT

Answer

Disable NAT on the firewall policy for the server

Question 7

Match each Fortinet HA mode to its description.

Accepted Answer

Active-Passive HA: One FortiGate handles traffic while the other is on standby.. Common FortiGate HA modes: Active-Passive (primary/standby) and Active-Active (both active). Distractors swap the definitions.

Answer

Active-Passive HA: Both FortiGates handle traffic simultaneously.

Answer

Active-Active HA: One FortiGate handles traffic while the other is on standby.

Question 8

Match each FortiGate firewall policy action to its result.

Accepted Answer

ACCEPT: Allows traffic that matches the policy. The correct matches are ACCEPT for allowing traffic and DENY for silently dropping traffic. Common confusions include mixing ACCEPT with REJECT (which sends a reset) and assuming DENY logs traffic.

Answer

ACCEPT: Drops traffic and sends a TCP reset

Answer

DENY: Allows traffic and logs it

Question 9

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

Accepted Answer

Virtual cluster ID. In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.

Answer

HA priority

Answer

Management IP address

Answer

Hostname

Question 10

A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?

Accepted Answer

An inter-VDOM policy on the inter-VDOM link interface. When traffic must cross from one VDOM to another on a FortiGate, an inter-VDOM policy is required. This policy is applied to the inter-VDOM link interface, which acts as the logical boundary between VDOMs. It allows the firewall to enforce separate routing and security contexts while forwarding traffic between VDOMs.

Answer

A policy using a virtual wire pair

Answer

A regular intra-VDOM policy on VDOM A with destination interface port2

Answer

A policy on each VDOM with the same source/destination

Question 11

After enabling SSL inspection, a user receives a warning 'The certificate is not trusted' in the browser. The administrator has installed the CA certificate on the client. What else could be the cause?

Accepted Answer

The CA certificate is not added to the browser's trusted root store.. Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

Answer

The firewall policy denies the traffic.

Answer

The FortiGate is not decrypting the traffic.

Answer

The web server's certificate has expired.

Question 12

An organization wants to authenticate VPN users using an LDAP server. They configure an LDAP server object and a user group. However, users are unable to authenticate. The administrator checks the logs and sees 'authentication failed' errors. What is the most common misconfiguration?

Accepted Answer

The LDAP server bind DN or password is incorrect. The most common misconfiguration when LDAP authentication fails is an incorrect bind DN or password. The FortiGate uses the bind DN to authenticate to the LDAP server before it can search for users; if these credentials are wrong, the LDAP server rejects the bind request, resulting in an 'authentication failed' log entry. This error occurs even before user credentials are checked, making it a frequent root cause.

Answer

The user group is not configured with the correct members

Answer

The LDAP server uses SSL/TLS but the FortiGate is not configured for it

Answer

The LDAP server is not reachable from the FortiGate

Question 13

Which of the following is a characteristic of policy-based NAT on a FortiGate?

Accepted Answer

NAT is configured directly in the firewall policy using the 'set nat' option. Policy-based NAT on a FortiGate is configured directly within a firewall policy using the 'set nat' command. This allows NAT to be applied selectively based on the policy's matching criteria (source, destination, service, etc.), rather than being defined as a separate rule. This approach is the traditional method on FortiGate and is distinct from Central NAT, which decouples NAT rules from firewall policies.

Answer

NAT is configured separately from firewall policies using Central NAT rules

Answer

NAT is applied to all traffic regardless of policy

Answer

NAT can only be used with IP pools

Question 14

A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?

Accepted Answer

The fixed port range is too small, causing port exhaustion. The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Answer

The external server is rate-limiting connections

Answer

The firewall policy has a timeout setting that is too low

Answer

The IP pool has run out of IP addresses

Question 15

Which command is used to display the current FortiGate firmware version?

Accepted Answer

get system status. The 'get system status' command is the correct way to display the current FortiGate firmware version. This command outputs a comprehensive summary of the system state, including the firmware version (e.g., FortiOS v7.4.0), the system uptime, serial number, and HA status. It is the standard CLI command for verifying the exact build and patch level of the FortiGate.

Answer

get system statistics

Answer

get hardware status

Answer

get system performance status