NSE4 Practice Test 43 — 15 Questions

Question 1

An administrator creates a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network to the internet. The policy uses a dynamic IP pool for SNAT. Users report that some websites load slowly or fail to load intermittently. The administrator checks the firewall logs and sees 'session helper' warnings. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP pool is configured with fixed port range, limiting the number of available ports. The 'session helper' warnings indicate that the firewall is struggling to allocate NAT sessions for the dynamic IP pool. When the IP pool uses a fixed port range, the number of available source ports per IP is limited, leading to port exhaustion under heavy HTTP/HTTPS traffic. This causes intermittent failures and slow loads as new connections are dropped or queued.

Answer

The policy has traffic shaping enabled that is throttling the bandwidth

Answer

The firewall policy is configured for proxy-based inspection, causing high latency

Answer

The DNS server on the internal network is misconfigured

Question 2

A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)

Accepted Answer

Configure a firewall policy with the user group set in 'users/groups'. A firewall policy must reference the user group that uses the RADIUS server as its authentication source. Without this policy configuration, RADIUS-authenticated users cannot match the policy and will be denied access. The 'users/groups' field in the firewall policy is where the user group object is specified to enforce authentication-based access control.

Answer

Import the RADIUS server certificate into FortiGate

Answer

Enable 'set auth-type radius' on the interface

Question 3

A FortiGate HA cluster is experiencing frequent failovers. The administrator checks the HA event log and sees repeated 'Heartbeat loss' messages. The heartbeat interfaces are connected directly via a crossover cable. What is the MOST likely cause?

Accepted Answer

The heartbeat interface has a duplex mismatch. A duplex mismatch on the heartbeat interface causes intermittent link errors and dropped heartbeat packets, leading to repeated 'Heartbeat loss' messages and frequent failovers. Since the interfaces are directly connected via crossover cable, a speed/duplex mismatch is the most likely physical-layer cause.

Answer

The session pickup option is enabled

Answer

The HA uptime monitor is enabled and tracking a failed interface

Answer

The HA override setting is disabled

Question 4

A network engineer is configuring an SD-WAN rule to steer voice traffic to the MPLS link with the lowest latency. The SLA target is set to latency < 50 ms and jitter < 10 ms. However, the MPLS link occasionally exceeds the latency threshold. What should the engineer do to ensure voice traffic uses the best available link without manual intervention?

Accepted Answer

Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.. Configuring a secondary strategy (e.g., fallback to broadband) allows the SD-WAN rule to automatically steer voice traffic to the best available link when the primary MPLS link fails the SLA (latency > 50 ms). This ensures continuous SLA compliance without manual intervention, leveraging Fortinet's SD-WAN dynamic path selection based on real-time performance metrics.

Answer

Remove the latency performance SLA and rely only on jitter.

Answer

Increase the jitter threshold to 15 ms to avoid SLA violations.

Answer

Disable SLA enforcement on the SD-WAN rule so voice traffic always uses the MPLS link.

Question 5

A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?

Accepted Answer

Under system > admin > settings, restrict administrative access to trusted hosts.. The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.

Answer

Create a local-in policy to permit traffic from the management subnet.

Answer

Disable administrative access on all interfaces except the management interface.

Answer

Configure an inbound firewall policy allowing HTTPS from the management subnet to the FortiGate's interface IP.

Question 6

A FortiGate admin needs to create a loopback interface for management purposes. Which two statements about loopback interfaces are correct? (Choose two.)

Accepted Answer

Loopback interfaces are always up and do not depend on physical links. Loopback interfaces are virtual interfaces that are always in an up/up state as long as the FortiGate is operational. They do not depend on any physical link or carrier status, making them ideal for management access and stable routing protocol peering.

Answer

Loopback interfaces cannot be assigned an IP address

Answer

Loopback interfaces are only used for routing protocols

Answer

Loopback interfaces require a physical port to be up

Question 7

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

Accepted Answer

FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually. When a firewall policy is deleted on a FortiGate, the existing sessions that were created by that policy are not automatically removed. The FortiGate continues to process those sessions until they expire naturally based on their timeout values. In this case, the sessions with 'proto=6' (TCP) and 'expire=3599' seconds remaining will persist until the timer counts down, even though the originating policy no longer exists. The admin must manually clear them using 'diagnose sys session clear' or wait for the timeout to expire.

Answer

The sessions are using UDP protocol, which has a longer timeout

Answer

The sessions are protected by a different policy that still exists

Answer

The sessions are in a different VDOM

Question 8

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

Accepted Answer

Aggregate interface. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Answer

Loopback interface

Answer

VLAN interface

Answer

Software switch interface

Question 9

Which FortiGate log severity level indicates that a system is unusable and requires immediate attention?

Accepted Answer

Emergency. Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 10

A company has a web server in the DMZ that needs to be accessible from the internet on port 443 (HTTPS). The administrator configures a Virtual IP (VIP) mapping the public IP 203.0.113.10 to the private IP 10.0.1.10 port 443. Which firewall policy is required to allow inbound traffic?

Accepted Answer

A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT. When a Virtual IP (VIP) is configured in FortiGate, the firewall policy must reference the VIP object as the destination, not the actual private IP. The VIP translates the public IP (203.0.113.10) to the private IP (10.0.1.10), and the policy from WAN to DMZ with destination VIP ensures that inbound traffic is matched and permitted before NAT translation occurs. Without this policy, the VIP alone does not allow traffic; it only defines the translation rule.

Answer

A policy from WAN to DMZ with source any, destination IP of the server (10.0.1.10), and action ACCEPT

Answer

No firewall policy is needed; the VIP automatically allows traffic

Answer

A policy from DMZ to WAN with source VIP, destination any, and action ACCEPT

Question 11

Which firewall policy matching parameter is evaluated FIRST when a packet arrives at a FortiGate interface?

Accepted Answer

Incoming interface. When a packet arrives at a FortiGate interface, the firewall policy lookup begins by matching the incoming interface. This is because the interface is the first parameter evaluated in the policy-matching sequence, as defined by FortiGate's session-based architecture. Only after the interface match is successful does the FortiGate proceed to evaluate source address, destination address, service, and schedule.

Answer

Source address

Answer

Service

Answer

Schedule

Question 12

Which of the following best describes the policy lookup order on a FortiGate firewall?

Accepted Answer

Policies are evaluated in the order they appear in the policy list, from top to bottom. FortiGate firewalls evaluate firewall policies sequentially from the top of the policy list downward. The first policy that matches the source, destination, service, and other attributes of a packet is applied, and no further policies are checked. This top-down evaluation ensures deterministic traffic handling and is fundamental to FortiGate's stateful inspection engine.

Answer

Policies are evaluated based on the number of hits, least-hit first

Answer

Policies are evaluated randomly to balance load

Answer

The policy with the highest priority number is evaluated first

Question 13

Refer to the exhibit. A FortiGate SSL VPN user is unable to connect. The debug output shows the above error. What is the most likely cause?

Accepted Answer

The CA that issued the SSL VPN certificate is not trusted by the client.. The debug output indicates an SSL/TLS handshake failure, specifically that the client does not trust the server's certificate. This occurs when the Certificate Authority (CA) that issued the SSL VPN certificate is not in the client's trusted root store. Option B correctly identifies this as the most likely cause because the error is a certificate trust issue, not an expiration or authentication problem.

Answer

The SSL VPN certificate has expired.

Answer

The user's password is incorrect.

Answer

The firewall policy is blocking the SSL VPN port.

Question 14

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Accepted Answer

Define a traffic shaper object with the desired bandwidth limits. A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Answer

Enable SD-WAN on the FortiGate

Answer

Configure Central NAT to translate the source IP

Question 15

A FortiGate has a central SNAT policy that translates internal users to a single IP pool address. The admin wants specific traffic (e.g., from a particular subnet) to use a different IP pool. What is the correct approach?

Accepted Answer

Create a new central SNAT policy with the specific subnet as source and place it above the existing policy. Central SNAT policies are evaluated in sequential order, and the first matching policy is applied. By creating a new policy with the specific subnet as the source and placing it above the existing policy, the FortiGate will match the more specific traffic first and use the different IP pool, while all other traffic continues to match the original policy.

Answer

Create a policy-based NAT rule with the specific subnet and place it above the central SNAT policy

Answer

Use VIP to translate the source address

Answer

Modify the existing central SNAT policy to use a dynamic IP pool