NSE4 Practice Test 41 — 15 Questions

Question 1

A FortiGate administrator needs to prevent employees from using peer-to-peer file sharing applications such as BitTorrent. The administrator creates an application control profile with a rule to block the 'Peer-to-Peer' application category. After applying the profile to the firewall policy, users can still use BitTorrent. What is the most likely cause?

Accepted Answer

The application control profile is set to 'Monitor' instead of 'Block' for the Peer-to-Peer category.

Answer

The application control profile is applied to the outbound policy but not to the inbound policy.

Answer

BitTorrent is not a recognized application in the FortiGuard application control database.

Answer

The firewall policy has SSL inspection set to certificate inspection, so the FortiGate cannot see the application.

Question 2

A FortiGate is configured to use a DNS filter profile to block access to malicious domains. However, users can still reach a known malicious domain. The DNS filter profile is applied to the firewall policy. Which step should the admin take FIRST to troubleshoot?

Accepted Answer

Check if DNS traffic is matching the correct firewall policy. Option D is correct. The admin should verify that DNS traffic (port 53) is matching the firewall policy with the DNS filter applied. If DNS queries bypass the policy (e.g., they are allowed by a different policy), the DNS filter will not be applied.

Answer

Enable DNS inspection logging to see if the domain is being flagged

Answer

Check if the FortiGuard DNS filter database is up to date

Answer

Verify that the domain is in the FortiGuard DNS category list

Question 3

An administrator needs to block all traffic from an application that uses a proprietary protocol not recognized by any application signature. Which security profile method should be used to block this traffic?

Accepted Answer

Use an IPS profile with a custom signature based on protocol anomalies. Option C is correct because IPS with custom signatures can detect and block traffic based on protocol anomalies or patterns, even without a pre-defined application signature.

Answer

Create an application control profile and add a custom application signature

Answer

Use a web filter profile to block by URL

Answer

Use a data leak prevention (DLP) profile to match on data patterns

Question 4

A FortiGate administrator wants to ensure that all DNS queries to known malware domains are blocked. The firewall policy allows DNS traffic. Which security profile must be applied?

Accepted Answer

DNS filter profile. Option B is correct: DNS filter is specifically designed to inspect DNS queries and block based on FortiGuard categories or custom lists.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 5

What is the purpose of the 'safe search' option in a FortiGate web filter profile?

Accepted Answer

It enforces Google SafeSearch, Bing SafeSearch, and YouTube Restricted Mode on supported search engines.. Option B is correct. Safe search enforces content filtering on supported search engines like Google, Bing, and YouTube to block explicit results.

Answer

It logs all search queries made by users.

Answer

It blocks access to all search engines except Google.

Answer

It redirects search queries to a secure HTTPS connection.

Question 6

An organization uses FortiSandbox to analyze suspicious files. The FortiGate is configured to send files to FortiSandbox for analysis when the antivirus scan fails to reach a verdict. Which antivirus inspection mode must be used on the firewall policy for this integration to work?

Accepted Answer

Proxy-based inspection. Option B is correct. Proxy-based inspection buffers the file and can hold the connection until FortiSandbox returns a verdict. Flow-based does not support this hold-and-wait mechanism.

Answer

Both flow and proxy modes support FortiSandbox equally

Answer

Deep inspection

Answer

Flow-based inspection

Question 7

A FortiGate administrator wants to integrate with FortiSandbox to analyze suspicious files detected by antivirus. The administrator configures the FortiSandbox settings under Security Fabric. However, files are not being sent to FortiSandbox. The antivirus profile is set to 'flow-based' inspection. What could be the reason?

Accepted Answer

Flow-based inspection does not support FortiSandbox integration; proxy-based inspection is required.

Answer

The antivirus profile is set to 'Monitor' instead of 'Block'.

Answer

The firewall policy is using NAT, which interferes with FortiSandbox connectivity.

Answer

The FortiGate does not have a valid FortiSandbox license.

Question 8

An administrator has configured an SSL deep inspection profile with 'certificate inspection' for a firewall policy. Users report that they receive certificate errors when accessing HTTPS sites. What is the MOST likely reason?

Accepted Answer

The FortiGate is not configured to re-sign certificates with its own CA certificate. Option A is correct. Certificate inspection only checks the server certificate but does not re-sign it. Since FortiGate does not re-issue a certificate, clients see the original server certificate, which may be valid, but if the FortiGate is performing a man-in-the-middle, the client should see the FortiGate's CA certificate. Actually, with certificate inspection, the FortiGate does not decrypt the traffic, so it cannot inspect the content; it only checks the certificate. The question might be tricky: certificate inspection does not modify the certificate chain, so users should not see certificate errors unless the FortiGate is intercepting. However, the typical cause of errors is when using full deep inspection without proper CA deployment. For certificate inspection, errors can occur if the server certificate is invalid. But the best answer is that the FortiGate is not properly configured to re-sign certificates.

Answer

The certificate installed on the FortiGate for SSL inspection is expired

Answer

The web server uses a self-signed certificate which is blocked by the inspection profile

Answer

The users' browsers do not trust the FortiGate's CA certificate

Question 9

Which FortiGate feature allows users to access internal applications without a VPN client?

Accepted Answer

ZTNA. ZTNA (Zero Trust Network Access) enables agentless access to applications based on identity and context.

Answer

IPsec VPN

Answer

SSL VPN

Answer

FortiGuard

Question 10

A FortiGate administrator wants to block access to Facebook for all internal users. However, the administrator must ensure that the CEO's computer (IP 10.0.0.100) is exempted. Which TWO steps should the administrator take? (Choose two.)

Accepted Answer

Create an application control profile with a rule to block 'Facebook' and apply it to the firewall policy for all users.. The correct answers are A and B. Create a blocking profile and apply to a policy for general users, then create a higher priority policy that allows the CEO's traffic without the blocking profile.

Answer

Add the CEO's IP to the application control profile's 'exempt IP' list.

Answer

Configure an IP exemption in the application control profile.

Answer

Use a web filter profile with a URL block for 'facebook.com' instead of application control.

Question 11

What is the purpose of the 'DNS Filter' feature on a FortiGate?

Accepted Answer

To block DNS queries to malicious domains based on FortiGuard category and allow/block lists.

Answer

To cache DNS queries for faster resolution.

Answer

To encrypt DNS traffic to prevent eavesdropping.

Answer

To filter the content of DNS responses from legitimate servers.

Question 12

An administrator configures a web filter profile to block the URL category 'Pornography'. The profile is applied to a policy for the sales department. Users report they can still access some sites that should be blocked. The administrator verifies that the FortiGuard web filter service is licensed and the FortiGate has internet connectivity. What should the administrator check next?

Accepted Answer

Ensure the web filter profile has 'FortiGuard category based filter' enabled and the action for 'Pornography' is set to 'Block'.

Answer

Verify that the antivirus profile is not interfering with web filtering.

Answer

Check if the sales department policy is using NAT that might bypass the FortiGate.

Answer

Confirm that the FortiGate has a static route to the FortiGuard servers.

Question 13

An administrator configures an IPS sensor with a signature that is triggered by traffic to a specific server. The signature is set to 'Block' but the traffic is not being blocked. The administrator verifies that the IPS sensor is applied to the correct firewall policy and that the signature is enabled. Which TWO additional checks should the administrator perform? (Choose two.)

Accepted Answer

Verify that the signature's 'Action' is not overridden by a higher-priority rule in the IPS sensor.

Answer

Ensure that the antivirus profile is not interfering with IPS.

Answer

Check if the destination server is in the 'Local-in' policy, which may bypass IPS.

Answer

Confirm that the signature has a valid CVE ID.

Question 14

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

Accepted Answer

Enable session pickup. Session synchronization (session sync) replicates active sessions to the standby unit so that sessions survive a failover.

Answer

Lower HA priority on the primary

Answer

Set HA override to enabled

Answer

Increase the heartbeat interval

Question 15

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

Accepted Answer

The maximum number of packets to capture. The fourth parameter in the diagnose sniffer packet command specifies the number of packets to capture.

Answer

The filter verbosity level

Answer

The time duration in seconds

Answer

The interface index