NSE4 Practice Test 42 — 15 Questions

Question 1

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a traffic shaping policy and apply it to the firewall policy. Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

Answer

Increase the bandwidth of the internet link

Answer

Configure policy-based routing for HTTPS traffic

Answer

Enable QoS on the outgoing interface

Question 2

An administrator has configured DLP sensors to detect credit card numbers in outgoing traffic. However, the administrator notices that traffic containing credit card numbers is still passing through undetected. The firewall policy uses flow-based inspection. What is the MOST likely reason DLP is not detecting the data?

Accepted Answer

DLP requires proxy-based inspection to perform data leakage detection.. DLP requires proxy-based inspection to buffer and analyze the content. Flow-based inspection does not support DLP.

Answer

The DLP sensor is not applied to the correct firewall policy.

Answer

The DLP sensor is configured with the wrong regular expression.

Answer

The credit card numbers are encrypted by SSL and deep inspection is not enabled.

Question 3

An organization wants to use FortiToken for two-factor authentication on SSL VPN logins. Which authentication method must be enabled on the FortiGate to support this?

Accepted Answer

Two-factor authentication with FortiToken. FortiToken is a hardware or software token that generates one-time passwords (OTPs) for two-factor authentication (2FA). To use FortiToken with SSL VPN logins, the FortiGate must have 'Two-factor authentication with FortiToken' enabled in the user or user group configuration. This setting tells the FortiGate to prompt for both the user's regular password and the current FortiToken OTP during the SSL VPN authentication process.

Answer

RADIUS authentication

Answer

PKI authentication

Answer

LDAP authentication

Question 4

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Accepted Answer

The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.. Policy 1 is an implicit allow-all rule that matches all traffic before policy 2 is evaluated. Since FortiGate processes policies in sequential order from top to bottom, the SSH connection to 203.0.113.10 matches policy 1 first, which permits all services, including SSH. Therefore, the connection succeeds without ever reaching policy 2.

Answer

The SSH connection will succeed because policy 2 is evaluated first.

Answer

The SSH connection will be blocked because policy 2 explicitly denies SSH.

Answer

The SSH connection will be blocked because policy 1 does not include SSH service specifically.

Question 5

An administrator is configuring a site-to-site IPsec VPN between two FortiGates. After applying the configuration, the VPN status shows 'down'. Phase 1 parameters are identical on both sides. What is the most likely cause of the failure?

Accepted Answer

The Phase 2 selectors (local and remote subnets) are mismatched.. When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.

Answer

The pre-shared keys do not match.

Answer

The firewall policies are not configured.

Answer

NAT traversal is disabled but both FortiGates are behind NAT.

Question 6

An administrator is troubleshooting an SSL VPN connection issue. Users can authenticate but receive 'No available tunnel' error. What is the most likely cause?

Accepted Answer

The SSL VPN IP pool has run out of addresses.. The 'No available tunnel' error after successful authentication indicates that the SSL VPN daemon cannot assign an IP address to the client. The most likely cause is that the SSL VPN IP pool has exhausted its available addresses, preventing the creation of a virtual tunnel interface. This is a common issue when the pool size is smaller than the number of concurrent users.

Answer

Split tunneling is misconfigured.

Answer

The firewall policy does not allow traffic from the SSL VPN interface.

Answer

The SSL VPN port is blocked on the firewall.

Question 7

An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?

Accepted Answer

The policy route is applied to the wrong incoming interface. Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

Answer

The firewall policy denies the traffic before policy routing

Answer

The default route has a higher administrative distance

Answer

The policy route destination is set to all

Question 8

An organization wants to implement least privilege for firewall policies. Which THREE best practices should be followed? (Choose three.)

Accepted Answer

Specify the exact services required (e.g., TCP/443, TCP/22). Specifying exact services (e.g., TCP/443, TCP/22) enforces least privilege by allowing only the necessary protocols and ports, reducing the attack surface. In FortiGate firewall policies, this is configured under the 'Service' field, where you can select predefined services or create custom ones to match specific TCP/UDP port numbers. This prevents overly permissive rules that could expose services like SMB (TCP/445) or RDP (TCP/3389) unintentionally.

Answer

Use a single schedule covering all days

Answer

Use any any for source and destination to simplify management

Question 9

A FortiGate administrator wants to ensure that traffic from the internal network to an external FTP server uses a specific source IP address (203.0.113.10). The internal network uses RFC 1918 addresses. Which NAT configuration should be used?

Accepted Answer

Policy-based NAT using an IP pool with type 'Overload' and the IP address 203.0.113.10. Policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

Answer

Policy-based NAT using an IP pool set to 'Fixed Port Range'

Answer

Virtual IP (VIP) mapping the internal server to 203.0.113.10

Answer

Central SNAT with dynamic IP pool

Question 10

An administrator creates a firewall policy with a traffic shaper to limit bandwidth for guest wireless users. After applying the policy, users can still consume high bandwidth. The administrator confirms the policy is matching. What is the MOST likely reason the traffic shaper is not effective?

Accepted Answer

The traffic shaper is configured but not applied to the policy's 'Traffic Shaper' field. In FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Answer

The traffic shaper's maximum bandwidth is set too high

Answer

The traffic shaper is applied to the wrong direction (egress vs ingress)

Answer

The traffic shaper is a per-IP shaper but the policy applies to a subnet

Question 11

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

Accepted Answer

Move the allow policy above the deny policy. FortiGate policies are evaluated sequentially from top to bottom (lowest ID to highest ID). The first matching policy is applied. If an explicit deny policy appears above an allow policy for the same subnet, the deny policy will match first and drop the traffic. Moving the allow policy above the deny policy ensures it is evaluated first, allowing the traffic.

Answer

Add a new policy with a higher ID

Answer

Disable the deny policy

Answer

Delete the deny policy

Question 12

A FortiGate administrator wants to configure a captive portal to authenticate users before granting network access. Which authentication method is used by the captive portal?

Accepted Answer

Form-based authentication. FortiGate captive portals use form-based authentication by default, presenting a web page where users enter credentials (username/password) that are verified against a configured authentication server (e.g., LDAP, RADIUS, or local user database). This method is designed for HTTP/HTTPS interception and does not rely on network-layer or certificate-based mechanisms.

Answer

IPsec pre-shared key authentication

Answer

X.509 certificate authentication

Answer

NTLM authentication

Question 13

An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?

Accepted Answer

The destination in the firewall policy is set to the public IP directly instead of the VIP object. When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Answer

The VIP is configured with port forwarding disabled

Answer

The server's default gateway is not set to the FortiGate

Answer

The source NAT is not configured

Question 14

An administrator wants to upgrade the FortiOS firmware on a FortiGate. Which step is critical before starting the upgrade process?

Accepted Answer

Back up the configuration file.. Backing up the configuration file is critical before upgrading FortiOS because the upgrade process may fail or corrupt the configuration, and a backup ensures you can restore the FortiGate to its previous operational state. Without a valid backup, a failed upgrade could result in a complete loss of configuration, requiring manual reconfiguration or a factory reset. Fortinet recommends always backing up the configuration before any firmware upgrade to mitigate risks.

Answer

Reboot the FortiGate.

Answer

Clear all sessions.

Answer

Disable all firewall policies.

Question 15

A FortiGate administrator is designing an SSL VPN solution for 500 remote users. The users need full network access. Which two design considerations are most important?

Accepted Answer

Ensure the SSL VPN IP pool has enough addresses for concurrent users.. The SSL VPN IP pool must have enough addresses to assign to all concurrent users. Without a sufficient pool, users will fail to obtain an IP address and cannot access the network. Option B is correct because firewall policies are required to permit traffic from the SSL VPN interface (e.g., ssl.root) to internal networks; without them, traffic is dropped even if the tunnel is established.

Answer

Configure split tunneling to reduce load on the FortiGate.

Answer

Use certificate-based authentication for all users.

Answer

Enable port forwarding for RDP and SSH.