NSE4 Practice Test 40 — 15 Questions

Question 1

What is the purpose of a ZTNA (Zero Trust Network Access) tag on a FortiGate?

Accepted Answer

To mark devices or users with attributes used in security policies. ZTNA tags are user- or device-specific attributes (e.g., 'OS=Windows', 'Compliant=true') that FortiGate applies to endpoints after posture assessment. These tags can then be referenced in firewall policies to enforce granular, identity-aware access control, which is the core of Zero Trust Network Access.

Answer

To enable SNMP monitoring on the device

Answer

To assign static IP addresses to clients

Answer

To tag firewall policies for logging purposes

Question 2

A FortiGate has policy-based NAT enabled. The admin wants to translate the source IP of internal users to the interface IP for internet traffic. The firewall policy has NAT enabled. However, traffic from the internal network to the internet shows the original source IP instead of the interface IP. What is the MOST likely reason?

Accepted Answer

Central NAT is enabled and overrides the per-policy NAT setting. When policy-based NAT is enabled, the per-policy NAT setting should translate the source IP to the interface IP. However, if Central NAT is also enabled, it takes precedence and overrides the per-policy NAT configuration. Central NAT uses its own rules (e.g., IP pools) and can prevent the interface IP translation from being applied, leaving the original source IP unchanged.

Answer

The destination is a VIP that disables NAT

Answer

The NGFW mode is set to profile-based

Answer

The policy is configured in proxy inspection mode

Question 3

You are configuring a route-based IPsec VPN with BGP over the tunnel. After Phase 2 is up, the BGP session does not establish. You run 'diagnose debug ipsec' and see no errors. What should you check next?

Accepted Answer

Ensure the tunnel interface is added to the BGP neighbor configuration. When Phase 2 is up and 'diagnose debug ipsec' shows no errors, the IPsec tunnel is functioning correctly at the encryption layer. The BGP session failing to establish typically indicates a routing or interface configuration issue. Option C is correct because the tunnel interface must be explicitly added to the BGP neighbor configuration (e.g., 'config router bgp -> config neighbor -> set interface <tunnel>') so that BGP knows to send its TCP packets (port 179) over that specific tunnel interface; without this, BGP may try to use the physical interface instead, causing the session to fail.

Answer

Disable anti-replay on the tunnel

Answer

Enable NAT traversal

Answer

Check the Phase 1 proposal

Question 4

What is the default administrative account on a FortiGate?

Accepted Answer

admin. The default administrative account on a FortiGate is 'admin'. This account is created automatically during the initial boot process and has full super-admin privileges, allowing complete access to the device's configuration and management interfaces. It is the only default account with administrative rights, and its password must be set during initial setup.

Answer

master

Answer

root

Answer

guest

Question 5

A user reports that a legitimate website is being blocked by FortiGate web filtering. The administrator checks and finds that the URL category is 'Unrated'. What is the most likely cause?

Accepted Answer

The website is new and not yet categorized by FortiGuard.. When a website is categorized as 'Unrated' in FortiGate web filtering, it means FortiGuard's web filtering database has not yet assigned a category to that URL. This commonly occurs for newly registered or recently launched websites that have not been crawled and classified by FortiGuard's rating infrastructure. The correct answer is B because the 'Unrated' status directly indicates the site is new and not yet categorized.

Answer

The DNS server is not resolving the domain.

Answer

The web filter is configured to block all unrated sites.

Answer

The website is in the 'Blocked' category.

Question 6

An administrator runs 'diagnose debug application fnbamd -1' on a FortiGate to troubleshoot authentication issues. The output shows that the FortiGate successfully contacts the LDAP server but the user authentication fails. What does this indicate?

Accepted Answer

The user's password is incorrect or the user account is locked. The 'diagnose debug application fnbamd -1' output shows successful contact with the LDAP server, meaning network connectivity and server reachability are fine. Since the server is reachable but authentication fails, the most likely cause is that the user's credentials (password) are incorrect or the account is locked/disabled on the LDAP server. This is a standard LDAP bind failure scenario where the server returns an 'invalid credentials' or 'account locked' error.

Answer

The LDAP server is unreachable

Answer

The LDAP bind user password is incorrect

Answer

The LDAP schema does not match what FortiGate expects

Question 7

An administrator needs to configure a loopback interface on a FortiGate for management purposes. Which of the following is true regarding loopback interfaces?

Accepted Answer

Loopback interfaces are virtual and can be used as source IP for management traffic.. Loopback interfaces are virtual interfaces that are always up and do not depend on the physical link state. They can be assigned an IP address and used as the source IP for management traffic (e.g., SNMP, syslog, NTP, or administrative access), ensuring consistent reachability even if physical interfaces fail. This makes option A correct.

Answer

Loopback interfaces require a physical port to be associated.

Answer

Loopback interfaces cannot be used in firewall policies.

Answer

Loopback interfaces are only available in transparent mode.

Question 8

A FortiGate administrator configures SNMPv2c on the FortiGate to send traps to a monitoring server. However, no traps are received. The monitoring server can ping the FortiGate. What is the MOST likely cause?

Accepted Answer

The SNMP community string does not match between FortiGate and server.. SNMPv2c uses community strings as a form of authentication. If the community string configured on the FortiGate does not match the one configured on the monitoring server, the server will reject the trap. Since the server can ping the FortiGate, network connectivity is fine, and the issue is most likely an authentication mismatch.

Answer

SNMPv2c is not supported on FortiGate; only v3 is supported.

Answer

The FortiGate's firewall policy blocks SNMP traffic from the monitoring server.

Answer

The monitoring server's IP is not in the SNMP trap receiver list on FortiGate.

Question 9

A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?

Accepted Answer

The FSSO collector agent service is not running.. If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.

Answer

The users are not members of the FSSO group.

Answer

The firewall policy uses 'All Users' instead of a specific group.

Answer

The FortiGate's LDAP server is unreachable.

Question 10

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

Accepted Answer

Create a separate IPsec VPN between each spoke pair. In a hub-and-spoke IPsec VPN topology, spoke sites cannot communicate directly by default. To enable direct spoke-to-spoke communication, the most straightforward configuration change is to create separate IPsec VPN tunnels between each spoke pair. While ADVPN (Auto Discovery VPN) with dynamic routing is a more efficient method, it is not listed as an option. Option D directly establishes the required tunnels, allowing traffic to bypass the hub for spoke-to-spoke traffic. Other options are insufficient: Option A only adds routes for the hub, Option B only propagates routes without establishing direct tunnels, and Option C forces traffic through the hub.

Answer

Set the 'add-route' option to 'enable' on the spoke Phase 1 settings

Answer

Configure dynamic routing (BGP) on all sites and enable route exchange

Answer

Add static routes on the hub pointing to each spoke's subnet via the respective tunnels

Question 11

An administrator runs 'diagnose vpn ike config' and sees the output includes 'P2 proposals: aes128-sha256, aes256-sha1'. What does this indicate?

Accepted Answer

The Phase 2 encryption and authentication algorithms. The output 'P2 proposals: aes128-sha256, aes256-sha1' from the 'diagnose vpn ike config' command specifically lists the Phase 2 (IPsec) proposals, which define the encryption and authentication algorithms used for protecting data traffic. Option C is correct because these are the Phase 2 encryption (aes128, aes256) and authentication (sha256, sha1) algorithms, not Phase 1 settings or other parameters.

Answer

The Diffie-Hellman groups for Phase 2

Answer

The Phase 1 encryption settings

Answer

The lifetime settings for the VPN tunnel

Question 12

What is the primary purpose of FortiSandbox integration with FortiGate antivirus?

Accepted Answer

To detect zero-day malware by analyzing file behavior in a sandbox environment. FortiSandbox integration with FortiGate antivirus is designed to detect zero-day malware by analyzing file behavior in a sandbox environment. This allows FortiGate to forward suspicious files that evade signature-based detection to FortiSandbox for dynamic analysis, where behavioral patterns are examined to identify unknown threats. The integration enhances the existing antivirus engine rather than replacing it, providing a layered defense against advanced persistent threats.

Answer

To replace the local antivirus scanning engine

Answer

To perform SSL deep inspection

Answer

To cache antivirus signatures locally

Question 13

An administrator wants to ensure that search engine results from Google, Bing, and Yahoo are filtered to exclude explicit content when users perform searches. Which feature should the administrator configure in the web filter profile?

Accepted Answer

Safe search. Safe search is a feature within FortiGate's web filter profile that enforces search engine providers (Google, Bing, Yahoo) to filter explicit content from search results. It works by appending specific parameters to search URLs or using HTTPS inspection to inject the safe search cookie, ensuring compliance with content filtering policies.

Answer

FortiGuard category filter

Answer

URL filter

Answer

DNS filter

Question 14

A FortiGate administrator needs to allow SMTP traffic (TCP port 25) from the internal network (10.0.0.0/8) to a mail server in the DMZ (172.16.0.10). The administrator wants to apply an antivirus profile and log all sessions. Which THREE configuration steps are required?

Accepted Answer

Create a firewall policy with source: 10.0.0.0/8, destination: 172.16.0.10, service: SMTP, action: ACCEPT. A firewall policy must be created to allow SMTP traffic from the internal network (10.0.0.0/8) to the DMZ mail server (172.16.0.10) on TCP port 25. The policy must specify the source, destination, service (SMTP), and action (ACCEPT) to permit the traffic. Without this policy, the traffic would be blocked by default.

Answer

Create a schedule object and apply it to the policy

Answer

Configure NAT on the policy to translate source IPs

Question 15

A FortiGate is configured with two WAN links (port1 and port2) and uses ECMP routing. The administrator wants to ensure that traffic from a specific internal subnet (192.168.10.0/24) always uses port1, while all other traffic uses ECMP. Which configuration should be applied?

Accepted Answer

Create two static routes with equal distances to use ECMP, and add a policy route for 192.168.10.0/24 with outgoing interface port1. Policy routes override the routing table for matching traffic, allowing you to force traffic from 192.168.10.0/24 out port1 while ECMP handles all other traffic. ECMP distributes traffic across multiple equal-cost routes, but a policy route takes precedence over the routing table for specified traffic. This meets the requirement without disrupting ECMP for other traffic.

Answer

Create a separate VDOM for 192.168.10.0/24 and route it through port1

Answer

Configure a VIP to translate 192.168.10.0/24 to an IP on port1

Answer

Use a firewall policy to change the route based on source