NSE4 Practice Test 41 — 15 Questions

Question 1

A site-to-site IPsec VPN is configured with IKEv2. The tunnel establishes but traffic does not pass. Which two troubleshooting steps should the administrator perform first?

Accepted Answer

Check the firewall policies allowing traffic through the tunnel.. Even if the IPsec tunnel is established, traffic will not pass unless firewall policies explicitly permit it. In FortiGate, a Phase 2 tunnel being up does not imply that traffic is allowed; you must have a policy that matches the source/destination and enables the action to forward traffic through the tunnel interface.

Answer

Check the Phase 2 selectors.

Answer

Verify that the Phase 1 proposal matches.

Question 2

An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?

Accepted Answer

A firewall policy allowing traffic from the captive portal interface to the internet with the user group. A captive portal authenticates users but does not automatically grant network access. A firewall policy must explicitly allow traffic from the captive portal interface to the internet and include the authenticated user group as a source. Without this policy, even after successful authentication, traffic is dropped and users are not redirected to the internet.

Answer

The DNS server is not configured on the FortiGate

Answer

The captive portal timeout is set too low

Answer

The SSID is not configured with the captive portal security mode

Question 3

An administrator needs to configure ZTNA (Zero Trust Network Access) on a FortiGate to provide secure remote access to an internal application. Which components are required for a basic ZTNA configuration? (Choose three.)

Accepted Answer

ZTNA proxy (application gateway). The ZTNA proxy (application gateway) is the core component that terminates client connections and forwards them to internal applications after verifying device and user identity. It acts as a reverse proxy, enforcing access policies before allowing any traffic to reach the protected resource. Without this gateway, the FortiGate cannot mediate ZTNA connections.

Answer

IPsec VPN tunnel

Answer

Captive portal

Question 4

A FortiGate administrator needs to allow SNMP monitoring from a management station at 10.10.10.50. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable SNMP agent globally. The SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.

Answer

Configure an SNMP trap to send alerts to 10.10.10.50

Answer

Enable SNMP on the interface connected to the management station

Answer

Configure a firewall policy allowing SNMP from the management station

Question 5

A FortiGate administrator has configured a firewall policy with SSL deep inspection using a forward trust CA certificate. When users access an HTTPS website with a valid certificate, they still receive a certificate warning. What is the MOST likely reason?

Accepted Answer

The forward trust CA certificate is not installed on the users' devices. When SSL deep inspection is configured, the FortiGate generates a new certificate for each HTTPS session, signed by the forward trust CA. If the forward trust CA certificate is not installed in the trusted root store on the users' devices, the browser will not trust the generated certificate and will display a certificate warning. This is the most common cause of such warnings even when the original website certificate is valid.

Answer

The website certificate is expired

Answer

The firewall policy is set to certificate inspection instead of deep inspection

Answer

The FortiGate's CA certificate is not trusted by the browser

Question 6

An administrator needs to block traffic from a specific geographic region (e.g., country) from reaching the corporate web server. Which type of address object should be used to define the source?

Accepted Answer

Geography object. A Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

Answer

Wildcard FQDN object

Answer

FQDN object

Answer

Subnet object

Question 7

A FortiGate administrator runs 'diagnose vpn tunnel list' and sees the following output for an IPsec tunnel: 'status: up', 'incoming: 0 packets', 'outgoing: 100 packets'. Phase 1 and Phase 2 both show state 'up'. What is the MOST likely cause of zero incoming packets?

Accepted Answer

The Phase 2 proposal includes a mismatched proxy ID. The output shows the VPN tunnel is up with outgoing packets but zero incoming packets. This indicates a Phase 2 mismatch, most commonly due to mismatched proxy IDs (local/remote subnets). When proxy IDs do not match between peers, the tunnel establishes but traffic is not correctly matched, causing the remote gateway to drop or not send traffic to the FortiGate, resulting in zero incoming packets.

Answer

The remote gateway is using aggressive mode

Answer

The FortiGate has a static route pointing to the VPN interface

Answer

The VPN is configured in policy-based mode

Question 8

An administrator is troubleshooting an issue where users cannot access an internal web server via the internet through a FortiGate. The FortiGate has a virtual IP (VIP) configured for the web server. The administrator runs 'diagnose debug flow filter daddr <public-ip>' and 'diagnose debug flow trace start 100'. The output shows 'msg: forward to x.x.x.x via intf port2' but then 'msg: policy deny'. Which TWO actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Confirm that the firewall policy's destination is set to the internal web server's IP address (or the VIP's mapped IP). Option C is correct because when a VIP is used, the firewall policy must reference the VIP object (or its mapped internal IP) as the destination; if the policy destination is left as 'all' or points to the wrong address, the flow trace will show 'policy deny' even though the packet is forwarded toward port2. Option D is correct because the policy permitting inbound access must match the actual ingress interface (the WAN interface where the public IP is reached); if the source interface is set to the internal/LAN interface or 'any' incorrectly, the policy lookup fails and produces 'policy deny'. Option A is not the issue here since the trace already shows the packet being forwarded out via intf port2, meaning routing toward the server exists and the deny occurs at policy evaluation, not at the routing stage. Option B is irrelevant because DNS resolution only affects name-to-IP mapping and would not cause a FortiGate policy deny for an already-arriving packet. Option E is unnecessary because the VIP is functioning (traffic is being forwarded), and changing the port would not fix a policy-match failure.

Answer

Ensure that a static route exists to the internet via the WAN interface

Answer

Check if the public DNS resolution for the domain is correct

Answer

Recreate the virtual IP object with a different port

Question 9

An administrator runs 'diagnose vpn ssl stat' and sees 'tun-num: 5, clients: 0'. Users are unable to connect to the SSL VPN. The SSL VPN settings are correct and the certificate is valid. What could be the cause?

Accepted Answer

The SSL VPN is listening on a non-default port and users are connecting to the default port. The 'tun-num: 5, clients: 0' output indicates that the SSL VPN tunnel interface is up but no clients are connected. If the SSL VPN settings and certificate are correct, the most likely cause is a port mismatch: the FortiGate is configured to listen on a non-default port (e.g., 10443), but users are attempting to connect to the default SSL VPN port (443). This prevents the SSL handshake from completing, resulting in zero active clients.

Answer

The FortiGate has reached the maximum number of SSL VPN users allowed by the license

Answer

The SSL VPN certificate is not trusted by the client browsers

Answer

The SSL VPN portal is configured with 'limit-scan' scanning

Question 10

A security administrator wants to ensure that all DNS queries from internal users are filtered to block access to known malicious domains. Which TWO configurations must be applied?

Accepted Answer

Apply the DNS Filter profile to the firewall policy that allows DNS traffic. Option B is correct because the DNS Filter profile only takes effect when it is attached to the firewall policy that permits the DNS traffic, so applying it to that policy is what actually enforces filtering on users' queries. Option D is correct because the DNS Filter profile itself is the object that defines which domains are blocked (e.g., via FortiGuard category-based filtering or static domain lists), so it must be created before it can be applied. Option A is not required because deep inspection applies to content/AV scanning of traffic, not to DNS query filtering. Option C is incorrect because DNS inspection is not enabled through the SSL/SSH inspection profile; DNS filtering is handled by the DNS Filter profile. Option E is not needed because configuring a DNS server on the FortiGate does not filter or block malicious domains for internal users.

Answer

Enable deep inspection on the firewall policy

Answer

Enable DNS inspection on the SSL/SSH inspection profile

Answer

Configure a DNS server on the FortiGate

Question 11

You run the following command on a FortiGate:

```
diagnose sys session filter dport 443
diagnose sys session list
```

The output shows:
```
proto=6 proto_state=01 duration=3600 expire=3599
```

What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and has 3599 seconds remaining before timeout.. The output shows `duration=3600` and `expire=3599`, which indicate the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. The `proto=6` confirms TCP (protocol 6), and `proto_state=01` represents the TCP state for an established connection (ESTABLISHED), not a handshake state.

Answer

The session is using TCP state 01 (SYN_SENT) and is still in the process of establishing.

Answer

The session has been idle for 3600 seconds and will expire in 3599 seconds.

Answer

The session is using UDP protocol and will expire in 3599 seconds.

Question 12

A FortiGate admin needs to allow inbound HTTPS traffic to a web server while also applying an application control profile to block certain web applications. The web server has a VIP configured. Which TWO components are necessary for this configuration?

Accepted Answer

A VIP configured to map the public IP to the web server's private IP. A Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

Answer

A central SNAT rule to translate the server's response

Answer

A security profile group containing only the antivirus profile

Answer

A traffic shaping policy to prioritize HTTPS

Question 13

An administrator is configuring a FortiGate HA cluster in active-passive mode with two units. Which two conditions must be met for failover to occur? (Choose two.)

Accepted Answer

A monitored interface on the primary unit goes down. Option A is correct because in an active-passive FortiGate HA cluster, failover is triggered when a monitored interface (configured under config system ha with monitor-interface) goes down on the primary unit, causing the cluster to renegotiate and the secondary to take over. Option B is correct because loss of all heartbeat communication (via the HA heartbeat interfaces, using FGCP over UDP/703 or Ethernet frames) causes the secondary to conclude the primary has failed and assume the primary role. Option C is not correct because priority is only evaluated at cluster formation or when a unit rejoins; a higher priority on the secondary does not by itself force a failover of an established cluster. Option D is not correct because CPU usage thresholds are not a native HA failover trigger in FortiOS. Option E is not correct because session synchronization packets are not heartbeats; stopping session sync alone does not trigger failover, only loss of heartbeat or a monitored interface failure does.

Answer

The secondary unit receives a higher priority configuration

Answer

The primary unit's CPU usage exceeds 90%

Answer

The primary unit stops sending session synchronization packets

Question 14

Which of the following statements about FortiGate policy lookup order is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is used. FortiGate uses a top-down sequential search for policy matching. When a packet arrives, the firewall starts at the top of the policy list and evaluates each policy in order until it finds one where all configured criteria (source, destination, service, schedule, etc.) match. The first matching policy is then applied, and no further policies are checked. This is the fundamental behavior of FortiGate's firewall policy lookup.

Answer

Policies are evaluated based on a priority number assigned to each policy

Answer

Policies are evaluated from bottom to top, and the last matching policy is used

Answer

Policies are evaluated randomly to balance load

Question 15

Which of the following is a characteristic of route-based IPsec VPN compared to policy-based IPsec VPN?

Accepted Answer

Route-based VPN can use dynamic routing protocols like OSPF. Route-based IPsec VPNs create a virtual tunnel interface (e.g., ipsec0 or tunnel) that acts as a logical routing point, allowing dynamic routing protocols such as OSPF to exchange routes over the encrypted tunnel. This is a key advantage over policy-based VPNs, which rely on static security policies and cannot support dynamic routing.

Answer

Route-based VPN is only supported in IKEv1

Answer

Route-based VPN requires Phase 2 selectors to match both local and remote subnets

Answer

Route-based VPN uses firewall policies with IPsec action