NSE4 Practice Test 44 — 15 Questions

Question 1

A FortiGate in an HA active-passive cluster is experiencing frequent failovers. The administrator checks the HA statistics and sees that the primary unit's heartbeat interface has a high error rate. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The heartbeat cable is faulty or the interface has a duplex mismatch. A high error rate on the heartbeat interface indicates physical-layer issues such as a faulty cable or duplex mismatch. In an HA active-passive cluster, the heartbeat link must be reliable and low-latency; errors cause packet loss, leading the primary unit to appear unresponsive and triggering a failover to the secondary unit.

Answer

The heartbeat interface is configured as a single link without redundancy

Answer

The failover threshold is set too low

Answer

The HA configuration has mismatched passwords

Question 2

An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?

Accepted Answer

A traffic shaper object that defines bandwidth limits. A traffic shaper object is a fundamental component that defines the bandwidth limits (e.g., guaranteed bandwidth, maximum bandwidth, priority) that will be applied to traffic. Without this object, the firewall has no parameters to enforce rate limiting. In FortiGate, the traffic shaper object is created under 'Traffic Shapers' and can be per-policy or per-IP.

Answer

A static route for the YouTube subnet

Answer

A schedule object to apply the shaper only during business hours

Question 3

A FortiGate administrator wants to block spam emails sent to the company's mail server. The mail server is behind the FortiGate. Which THREE configurations should be applied?

Accepted Answer

Enable FortiGuard spam filtering in the Email Filter profile. Option C is correct because the FortiGate's Email Filter profile relies on FortiGuard Anti-Spam service to detect and tag/block spam based on FortiGuard's spam signature and IP reputation databases. Option E is correct because an Email Filter profile must first be created and its spam detection (and optionally other checks like banned words, DNSBL, HELO checks) enabled before it can take any action. Option D is correct because an Email Filter profile only takes effect when it is applied to the firewall policy that permits the SMTP traffic destined to the internal mail server. Option A is not correct because DLP on FortiGate handles data leakage patterns (credit cards, SSNs, file types) rather than spam detection. Option B is not correct because Application Control identifies and blocks applications by signature/behavior, not spam content within SMTP sessions.

Answer

Enable DLP to filter spam

Answer

Configure Application Control to block email applications

Question 4

What is the purpose of configuring an NTP server on a FortiGate?

Accepted Answer

To synchronize the FortiGate's system clock with a reliable time source.. Configuring an NTP server on a FortiGate synchronizes the system clock with a reliable time source, which is essential for accurate logging, certificate validation, and time-based operations. While time-based firewall policies depend on an accurate clock, NTP itself is the mechanism to achieve that accuracy, not the policy feature itself.

Answer

To enable time-based firewall policies.

Answer

To allow the FortiGate to act as an NTP server for the network.

Answer

To authenticate with FortiGuard services.

Question 5

A network administrator wants to ensure that all users are blocked from accessing websites categorized as 'Pornography' and 'Hacking' on a FortiGate. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Apply the web filter profile to the firewall policy that governs outbound internet traffic. A web filter profile must be applied to a firewall policy to enforce web filtering on outbound internet traffic. Without this association, the profile's settings (including category blocks) are not activated. The firewall policy is the enforcement point where security profiles are linked to traffic flows.

Answer

Create a URL filter to block all URLs containing 'pornography' and 'hacking'

Answer

Enable DNS filter and block the categories there

Answer

Enable SSL deep inspection to ensure the categories can be identified

Question 6

Which of the following statements about firewall policy ordering in FortiGate is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first match is applied. FortiGate firewall policies are evaluated sequentially from top to bottom in the policy list. The first policy that matches the source, destination, service, and other criteria is applied, and no further policies are evaluated. This is the fundamental 'first-match' behavior that governs traffic processing in FortiGate.

Answer

Policies are evaluated from bottom to top

Answer

The most specific policy always takes precedence regardless of order

Answer

The implicit permit rule at the end allows all traffic not explicitly denied

Question 7

What is the purpose of configuring an aggregate interface on a FortiGate?

Accepted Answer

To combine multiple physical interfaces into one logical interface for increased throughput and redundancy. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical FortiGate interfaces into a single logical interface. This increases throughput by load-balancing traffic across the member links and provides redundancy: if one physical link fails, traffic continues over the remaining links. FortiGate supports both static aggregation and LACP (IEEE 802.3ad) for dynamic negotiation.

Answer

To enable VLAN tagging on a physical interface

Answer

To separate management traffic from data traffic

Answer

To connect two different network segments with a firewall in between

Question 8

An admin needs to configure a FortiGate to allow multiple internal servers to be accessible from the internet using the same public IP but different ports. For example, internal server A (192.168.1.10:80) should be reachable via 203.0.113.10:8080, and internal server B (192.168.1.20:443) via 203.0.113.10:8443. Which TWO configuration steps are required?

Accepted Answer

Create two separate VIPs, one for each server, and add them to a VIP group. Each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

Answer

Disable NAT on the policy to preserve the source IP

Answer

Configure Central SNAT to translate the source IP

Answer

Create a single VIP with port forwarding that maps multiple ports

Question 9

A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?

Accepted Answer

Web mode only allows access to specific bookmarks configured in the portal. In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.

Answer

The user must be authenticated via LDAP

Answer

The user has not installed the FortiClient VPN plugin

Answer

The SSL VPN policy is missing a security profile

Question 10

A FortiGate is configured with FSSO and Active Directory polling. Users report that they are frequently prompted for authentication even though they are logged into the domain. Which THREE possible causes should the administrator investigate?

Accepted Answer

The user's IP address has changed and the FortiGate still has a stale mapping. FSSO with Active Directory polling relies on the FortiGate maintaining a mapping between a user's domain logon and their IP address. If the user's IP address changes (e.g., due to DHCP lease renewal or moving to a different subnet) and the FortiGate still holds the old mapping, the firewall will not recognize the user as authenticated, prompting re-authentication. This is a common issue in dynamic IP environments where the FortiGate's polling interval may not immediately detect the change.

Answer

The FortiToken server is overloaded

Answer

The captive portal is enabled on the policy

Question 11

An administrator needs to ensure that IPS signatures are updated automatically on the FortiGate. Which configuration should be verified?

Accepted Answer

The FortiGuard service is enabled and the signature update schedule is configured.. Automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Answer

The IPS engine is upgraded to the latest version.

Answer

The intrusion prevention profile is applied to the firewall policy.

Answer

The application control profile is set to 'monitor' for all applications.

Question 12

Which of the following FortiGate operating modes allows the firewall to act as a Layer 3 device, performing NAT and routing between interfaces?

Accepted Answer

NAT/Route mode. NAT/Route mode (option B) is correct because it configures the FortiGate as a Layer 3 device with distinct interfaces in different subnets, enabling it to perform routing (forwarding packets based on routing table entries) and Network Address Translation (NAT) to translate private IP addresses to public IP addresses. This mode is the default and most common operational mode for perimeter firewalls, allowing policy-based routing and NAT rules to be applied between zones.

Answer

Flow-based inspection mode

Answer

VLAN mode

Answer

Transparent mode

Question 13

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

Accepted Answer

The session will timeout in 3599 seconds. In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Answer

The session has 3599 packets

Answer

The session has been alive for 3599 seconds

Answer

The session has 3599 bytes of data transferred

Question 14

A FortiGate admin is troubleshooting an issue where internal users cannot access a specific external service over TCP/443. The admin confirms that the firewall policy allows HTTP/HTTPS. Which TWO CLI commands should the admin use to diagnose? (Choose two.)

Accepted Answer

diagnose firewall iprope list. 'diagnose firewall iprope list' displays the kernel's internal firewall rule chains, allowing the admin to verify whether the policy lookup is matching the expected rule for TCP/443 traffic. This command helps confirm that the policy is installed and active in the kernel, which is essential for troubleshooting policy-based access issues.

Answer

diagnose sys session filter dport 443

Answer

get system performance status

Answer

execute ping 8.8.8.8

Question 15

An administrator is configuring a VLAN interface on a FortiGate. The physical interface is port2 and the VLAN ID is 100. Which of the following correctly creates the VLAN interface?

Accepted Answer

config system interface edit port2.100 set vlanid 100 set type vlan next end. It uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.

Answer

config system interface edit port2 set vlanid 100 next end

Answer

config system interface edit port2.100 set type vlan next end

Answer

config system vlan edit port2.100 set vlanid 100 next end