NSE4 Practice Test 45 — 15 Questions

Question 1

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. FortiGate allows log rotation and archiving. The admin can configure the log settings to compress old logs or move them to an external location (like FortiAnalyzer or FortiCloud). However, the immediate need is to free space on the disk. The best practice is to archive existing logs to an external server and then clear the local disk, or enable automatic upload to FortiAnalyzer. The options are evaluated: Option D is the correct action because it preserves logs by uploading them to FortiAnalyzer, then clearing disk space to continue logging.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 2

A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?

Accepted Answer

Disable HA override on both units. HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

Answer

Enable HA override on both units

Answer

Set the HA mode to active-active

Answer

Increase the HA priority on the primary unit

Question 3

A FortiGate administrator needs to capture packets on interface port2 for 10 seconds to diagnose a connectivity issue. Which command should the administrator use?

Accepted Answer

diagnose sniffer packet port2 '' 4 10. The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet any "" 4 10' captures on all interfaces for 10 seconds with verbose output.

Answer

diagnose sys session list port2 10

Answer

diagnose debug flow port2 10

Answer

execute sniffer port2 10

Question 4

In an active-active HA cluster, session synchronization is enabled. What is the primary purpose of session synchronization in this mode?

Accepted Answer

To ensure that sessions are not lost if a cluster unit fails. In active-active HA, traffic is distributed across all cluster units. Session synchronization ensures that if a unit fails, other units have the session information to continue processing without interruption. This maintains transparent failover.

Answer

To synchronize firewall policies between cluster members

Answer

To load balance traffic across the cluster

Answer

To reduce the number of sessions on each unit

Question 5

A FortiGate administrator needs to send logs to a FortiAnalyzer device for long-term storage and analysis. Which log configuration must be set up?

Accepted Answer

Add the FortiAnalyzer as a logging destination in Log Settings. Logs are sent to FortiAnalyzer by configuring the Log Settings > Log Forwarding or the Log & Report > Log Setting to send logs to FortiAnalyzer.

Answer

Configure an IPsec tunnel to FortiAnalyzer

Answer

Enable disk logging on the FortiGate

Answer

Configure syslog server pointing to FortiAnalyzer IP

Question 6

Which CLI command is used on a FortiGate to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command captures packets in real-time on a specified interface.

Answer

execute packet-capture

Answer

diagnose debug flow

Answer

diagnose sys session list

Question 7

A FortiGate admin wants to send logs to both a local disk and a remote FortiAnalyzer. Which log configuration must be set?

Accepted Answer

Enable local logging and configure FortiAnalyzer as a remote server. FortiGate can log to multiple destinations simultaneously by configuring both local and remote logging.

Answer

Use the 'diagnose debug application log' command

Answer

Select 'Mirror local logs to FortiAnalyzer'

Answer

Set the log severity to 'Information' on both

Question 8

An administrator is troubleshooting a slow web application. The admin suspects that the FortiGate's session table might be full, causing new sessions to be dropped. Which command should the admin use to check the current session table utilization?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays statistics about the session table, including the number of current sessions and the maximum allowed. This helps determine if the session table is near capacity.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose sys session filter

Question 9

A FortiGate administrator needs to ensure that traffic logs are sent to a FortiAnalyzer even when the FortiGate's local disk is full. What configuration is required?

Accepted Answer

Enable 'remote log' under Log Settings and specify the FortiAnalyzer IP. Configuring the FortiAnalyzer as a log destination ensures logs are sent immediately. The local disk issue does not affect remote logging. Optionally, the admin can set logging to 'fallback' or 'any', but the direct method is to configure the remote syslog/FortiAnalyzer.

Answer

Enable 'disk logging' with rollover policy

Answer

Increase the log severity to 'emergency' only

Answer

Configure a log filter to send only security logs

Question 10

A FortiGate administrator needs to forward logs to a FortiAnalyzer for centralized management. The FortiAnalyzer is reachable at 10.0.1.100. Which configuration step is required on the FortiGate to send logs to this FortiAnalyzer?

Accepted Answer

Configure the FortiAnalyzer in System > FortiAnalyzer. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer server under System > FortiAnalyzer or via CLI using 'config log fortianalyzer setting set server 10.0.1.100'. The log forwarding policy is not used for FortiAnalyzer.

Answer

Configure a syslog server under Log Setting

Answer

Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

Answer

Enable logging to FortiCloud instead

Question 11

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Accepted Answer

Assign an IP address to the management interface. To have a dedicated management IP that does not fail over, the administrator should configure a dedicated management interface (separate from HA heartbeat), assign an IP to it, and ensure the management access is configured on that interface. The management interface can be in a separate VDOM if desired.

Answer

Enable 'set ha-mgmt-interface' on the management interface

Answer

Set the management interface to be part of the HA cluster management IP

Question 12

What is the function of Zero Trust Network Access (ZTNA) on a FortiGate?

Accepted Answer

It allows users to securely access internal applications without a VPN, based on identity and device posture. ZTNA provides secure access to applications based on identity and device posture, without requiring a VPN.

Answer

It replaces the firewall policy for all traffic

Answer

It encrypts all traffic between the FortiGate and the internet

Answer

It is a cloud-based subscription for antivirus updates

Question 13

A FortiGate administrator wants to ensure that in an active-passive HA cluster, a specific unit becomes the primary (active) unit after a reboot. Which configuration parameter should be set to a higher value on that unit?

Accepted Answer

HA priority. The HA priority determines the active unit in active-passive mode; higher priority wins.

Answer

HA session pickup delay

Answer

HA override

Answer

HA group-id

Question 14

An administrator is configuring an active-passive HA pair. Which THREE of the following must be identical on both units for the cluster to form? (Choose three.)

Accepted Answer

HA password. Operation mode, firmware version, and HA password (if set) must match. Priority can differ. Hostname is not required to match.

Answer

HA priority

Answer

Hostname

Question 15

An administrator needs to send logs from a FortiGate to a remote FortiAnalyzer for centralized log storage and analysis. Which configuration step is required on the FortiGate?

Accepted Answer

Set the FortiAnalyzer as the log destination in Log Settings. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer as a remote log destination under Log Settings. This is done via 'config log fortianalyzer setting' and specifying the server IP and other parameters.

Answer

Configure a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514

Answer

Create a log forwarding rule to forward all logs to the FortiAnalyzer

Answer

Install a FortiGate connector on the FortiAnalyzer