NSE4 Practice Test 39 — 15 Questions

Question 1

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.. When the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Answer

The SD-WAN zone does not include the backup interface wan2.

Answer

The static routes have the same distance, so failover does not occur.

Answer

The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.

Question 2

During a security audit, the administrator runs the command 'diagnose firewall policy list' and sees the following output:
policy id=1: allow from port1 to port2, src=10.0.0.0/8, dst=any, action=accept
policy id=2: deny from port1 to port2, src=10.0.0.0/8, dst=172.16.0.0/12, action=deny
policy id=3: allow from port1 to port2, src=any, dst=any, action=accept
A host with IP 10.0.1.5 sends traffic to 172.16.0.1. Which policy will match?

Accepted Answer

Policy 1. Policy 1 matches first because FortiGate evaluates policies sequentially by ID. The source 10.0.1.5 is within 10.0.0.0/8 and the destination is any, so policy 1 matches and accepts the traffic. Although policy 2 would also match (172.16.0.1 is within 172.16.0.0/12), it is not evaluated because the first matching policy is applied.

Answer

Policy 3

Answer

Implicit deny

Answer

Policy 2

Question 3

A FortiGate administrator is setting up a new FortiGate in a network that requires the firewall to bridge traffic between two subnets without routing. Which operating mode should the administrator select?

Accepted Answer

Transparent mode. Transparent mode allows the FortiGate to act as a Layer 2 bridge, forwarding traffic between two subnets without performing any routing or NAT. In this mode, the firewall operates like a 'bump in the wire,' inspecting and filtering traffic based on MAC addresses and Layer 2 headers, while the IP addresses of connected devices remain unchanged. This is ideal for scenarios where the FortiGate must be inserted into an existing network without altering the IP topology.

Answer

NAT/Route mode

Answer

HA mode

Answer

VLAN mode

Question 4

Which security profile type is used to prevent sensitive data such as credit card numbers from being sent out of the network via email or web traffic?

Accepted Answer

DLP profile. A DLP (Data Loss Prevention) profile is specifically designed to inspect content in transit (e.g., email, web traffic) and block or alert on sensitive data patterns such as credit card numbers, Social Security numbers, or other regulated data. Unlike other security profiles, DLP uses predefined or custom data identifiers and pattern matching to enforce data protection policies, making it the correct choice for preventing sensitive data exfiltration.

Answer

Email filter profile

Answer

Antivirus profile

Answer

Web filter profile

Question 5

You execute 'get firewall policy 5' and see the following output:
policyid=5
name="test"
status=enable
schedule="always"
logtraffic=all
What does 'logtraffic=all' mean?

Accepted Answer

All traffic matching the policy will be logged, regardless of action. 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

Answer

Only the first packet of each session will be logged

Answer

Only traffic that triggers a security profile will be logged

Answer

Only traffic that is denied by the policy will be logged

Question 6

A FortiGate admin configures a captive portal for guest users on a wireless network. Users can connect to the SSID but cannot access the internet. The admin verifies the firewall policy permits traffic from the captive portal interface to the internet. What is missing?

Accepted Answer

The firewall policy must have 'Enable Captive Portal' selected. For a captive portal to redirect unauthenticated users to the authentication page, the firewall policy that permits traffic from the captive portal interface to the internet must have the 'Enable Captive Portal' option selected. Without this setting, the FortiGate will not intercept HTTP/HTTPS requests and redirect them to the captive portal login page, so users remain unauthenticated and cannot access the internet even though the policy allows traffic.

Answer

A DNS server must be configured on the FortiGate

Answer

The users must be added to the local user database

Answer

The wireless controller must be configured with a RADIUS server

Question 7

A FortiGate admin runs 'diagnose sys session filter src 10.0.0.10' and gets no output. What does this indicate?

Accepted Answer

The source IP 10.0.0.10 is not currently active in any session table. The 'diagnose sys session filter' command in FortiGate is used to filter and display active session entries in the session table. When the command 'diagnose sys session filter src 10.0.0.10' returns no output, it means that no session in the session table matches the source IP address 10.0.0.10, indicating that this IP is not currently involved in any active session. This does not imply the session table is full, a policy block, or a syntax error.

Answer

The session table is full

Answer

The firewall policy is blocking traffic from 10.0.0.10

Answer

The diagnose command syntax is incorrect

Question 8

Which IPsec VPN mode is typically used for site-to-site VPNs and is more secure because it negotiates Phase 1 in six messages?

Accepted Answer

Main mode. Main mode is the correct answer because it is the IPsec VPN mode typically used for site-to-site VPNs and is considered more secure due to its use of six messages during Phase 1 (IKE) negotiation. This mode protects the identities of both peers by encrypting the identity payloads after the Diffie-Hellman exchange, making it resistant to man-in-the-middle attacks and identity disclosure.

Answer

Quick mode

Answer

Aggressive mode

Answer

IKEv2

Question 9

A FortiGate administrator is troubleshooting why antivirus scanning is not working for HTTPS traffic. Which TWO steps should be verified?

Accepted Answer

Ensure the firewall policy has SSL/TLS deep inspection enabled. HTTPS traffic is encrypted, so the FortiGate must decrypt it using SSL/TLS deep inspection before the antivirus engine can scan the payload. Without deep inspection, the antivirus profile sees only encrypted packets and cannot detect threats within the HTTPS stream.

Answer

Ensure the antivirus profile is set to proxy-based inspection

Answer

Confirm that the web filter profile is also applied

Answer

Check that the FortiSandbox is online for advanced scanning

Question 10

A FortiGate admin wants to implement ZTNA to secure access to an internal application. Which TWO components are required for a basic ZTNA configuration?

Accepted Answer

A ZTNA rule (policy) that specifies access conditions. Option C is correct because a ZTNA rule (policy) is the enforcement point on the FortiGate that defines the access conditions—such as user/device identity, posture tags, and application—that must be met before traffic is allowed to the protected resource. Option D is correct because the ZTNA application gateway (configured as a ZTNA server with a virtual host, real server, and access proxy) is the component that publishes the internal application and brokers the client connection through the FortiGate. Options A, B, and E are not required for a basic ZTNA configuration: FortiClient EMS is only needed for advanced posture/tag-based checks, an IPsec VPN tunnel is a separate remote-access method rather than a ZTNA requirement, and a static route is ordinary routing that does not constitute a ZTNA component.

Answer

A FortiClient EMS server

Answer

An IPsec VPN tunnel to the client

Answer

A static route to the application server

Question 11

A FortiGate administrator wants to synchronize the system time with an external NTP server. Which CLI command should be used to configure the NTP server?

Accepted Answer

config system ntp. The `config system ntp` command enters the NTP configuration context in FortiOS, where you can specify NTP servers, authentication, and synchronization settings. This is the standard CLI path for configuring NTP on FortiGate devices, as opposed to other commands that only display status or set the date manually.

Answer

execute date

Answer

diagnose ntp status

Answer

config system global

Question 12

An administrator configures an LDAP user group for firewall authentication. Users are able to authenticate, but the FortiGate does not retrieve group membership information. What is likely misconfigured?

Accepted Answer

The LDAP bind account does not have permission to read group attributes. The LDAP bind account must have sufficient permissions to read the memberOf or group membership attributes from the directory. If the bind account can authenticate users but cannot query group membership, the FortiGate will not be able to enforce policies based on LDAP groups. This is the most common cause when authentication succeeds but group information is missing.

Answer

The LDAP server's IP address is incorrect

Answer

SSL is not enabled for LDAP

Answer

The FortiGate is not joined to the domain

Question 13

Which web filtering feature allows an administrator to force web search engines to filter explicit content in search results, regardless of the user's browser settings?

Accepted Answer

Safe search. Safe search is a web filtering feature that forces supported search engines (e.g., Google, Bing, Yahoo) to filter explicit content from search results by appending specific query parameters (such as `safe=active` for Google) to the search request. This enforcement occurs at the FortiGate proxy level, overriding the user's browser settings and ensuring compliance with acceptable use policies.

Answer

DNS filter

Answer

URL filter

Answer

Application control

Question 14

A company has two FortiGate 100F units in an active-passive HA cluster with firmware version 7.2.5. The cluster is configured with session pickup and all interfaces are monitored. The network consists of three VLANs: VLAN10 (Users), VLAN20 (Servers), and VLAN30 (DMZ). The cluster is connected to two ISPs: ISP1 (port1) and ISP2 (port2). The internal network uses a single aggregated link (port3 and port4) as a LAG to the core switch. One day, the primary FortiGate experiences a hardware failure and the secondary takes over. After the primary is replaced and rejoins the cluster, the administrator notices that traffic passing through the cluster is intermittently dropping for a few seconds every minute. The administrator checks the cluster status and sees that the new primary (previously secondary) is in 'primary' state and the old primary (newly replaced) is in 'secondary' state. What is the most likely cause of the intermittent traffic drops?

Accepted Answer

The LAG configuration on the new FortiGate does not match the active cluster configuration.. The most likely cause is that the LAG configuration on the newly replaced FortiGate does not match the active cluster configuration. In an HA cluster, all LAG member interfaces (port3 and port4) must have identical settings—including LACP mode, speed, duplex, and VLAN membership—on both units. When the secondary FortiGate became primary and the replaced unit rejoined as secondary, any mismatch in the LAG configuration would cause the cluster to continuously renegotiate or flap the aggregated link, leading to intermittent traffic drops every few seconds as the HA cluster attempts to synchronize and stabilize the interface state.

Answer

Session pickup is not enabled on the new FortiGate.

Answer

The HA cluster is in split-brain state.

Answer

The heartbeat interface is configured on the LAG, causing HA instability.

Question 15

A FortiGate with antivirus in flow-based inspection mode is not detecting a known virus in HTTP traffic. The same virus is detected when using proxy-based inspection. What is the most likely reason?

Accepted Answer

Flow-based inspection does not reassemble files or unpack archives, so it misses some viruses. Flow-based inspection processes traffic as a stream without performing full file reassembly or unpacking archives that proxy-based inspection performs. This allows some viruses to evade detection.

Answer

Flow-based inspection requires FortiSandbox integration to detect viruses

Answer

The antivirus signature database is outdated for flow-based inspection

Answer

Flow-based inspection only scans on explicit proxy policies