NSE4 Practice Test 45 — 15 Questions

Question 1

An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile. In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.

Answer

Disable certificate verification in the deep inspection profile

Answer

Add the websites to the 'FortiGuard category' allow list

Answer

Configure the web filter to allow these websites

Question 2

What is the purpose of the 'DNS Filter' feature on a FortiGate?

Accepted Answer

To block DNS queries to malicious domains based on FortiGuard category and allow/block lists.

Answer

To cache DNS queries for faster resolution.

Answer

To encrypt DNS traffic to prevent eavesdropping.

Answer

To filter the content of DNS responses from legitimate servers.

Question 3

Which IPS detection method uses a baseline of normal traffic and alerts when deviations exceed a threshold?

Accepted Answer

Anomaly detection. Anomaly detection establishes a baseline of normal network traffic patterns and triggers alerts when observed traffic deviates significantly from that baseline. This method is effective for identifying unknown or zero-day attacks that do not match predefined signatures, as it relies on statistical or behavioral analysis rather than fixed patterns.

Answer

Rate-based detection

Answer

Signature-based detection

Answer

Protocol decode-based detection

Question 4

A FortiGate administrator wants to integrate with FortiSandbox to analyze suspicious files detected by antivirus. The administrator configures the FortiSandbox settings under Security Fabric. However, files are not being sent to FortiSandbox. The antivirus profile is set to 'flow-based' inspection. What could be the reason?

Accepted Answer

Flow-based inspection does not support FortiSandbox integration; proxy-based inspection is required.

Answer

The antivirus profile is set to 'Monitor' instead of 'Block'.

Answer

The firewall policy is using NAT, which interferes with FortiSandbox connectivity.

Answer

The FortiGate does not have a valid FortiSandbox license.

Question 5

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

Accepted Answer

Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.. Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Answer

Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

Answer

Enable SSH access on the WAN interface instead of HTTPS.

Answer

Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

Question 6

A network administrator is configuring SNMP on a FortiGate for monitoring. Which three pieces of information are required to complete the SNMPv2c configuration? (Choose THREE.)

Accepted Answer

SNMP manager IP address (allowed hosts). SNMPv2c uses community-based security, so the SNMP community string (Option D) is required for authentication. The SNMP manager IP address (Option B) is needed to define which hosts are allowed to query the FortiGate. The SNMP interface (Option E) specifies which network interface will listen for and respond to SNMP queries. These three pieces are mandatory for SNMPv2c configuration on a FortiGate.

Answer

SNMPv3 authentication protocol (MD5/SHA)

Answer

SNMP trap receiver IP and community

Question 7

A FortiGate administrator needs to configure a policy so that traffic to a specific external server is exempted from SSL deep inspection. Which method should be used?

Accepted Answer

Add the server's address to the 'SSL/SSH Inspection Profile' exemptions list. The SSL/SSH Inspection Profile includes an 'Exemptions' list where you can specify destination addresses that should bypass SSL deep inspection. This allows traffic to a specific external server to be excluded from SSL inspection without creating a separate firewall policy, ensuring that other security profiles (like antivirus, IPS, and web filtering) still apply to that traffic.

Answer

Create a separate firewall policy without SSL inspection for that server

Answer

Disable the IPS sensor on that policy

Answer

Set the antivirus profile to 'monitor' only

Question 8

A network administrator notices that users can access websites categorized as 'Pornography' despite a web filter profile blocking that category. The firewall policy uses the web filter profile and is applied to the users' traffic. What is the MOST likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard servers. The most likely cause is that the FortiGate cannot reach the FortiGuard servers. Web filter profiles rely on FortiGuard's cloud-based URL categorization to block categories like 'Pornography'. If the FortiGate loses connectivity to the FortiGuard servers (e.g., due to firewall rules, DNS issues, or proxy settings), it cannot retrieve the category rating for requested URLs, and the default action (often 'allow' if not explicitly set to block) will permit the traffic.

Answer

The web filter profile is applied to the wrong policy

Answer

The users are bypassing the FortiGate using a proxy

Answer

The web filter profile has the 'Override' feature enabled

Question 9

A company wants to ensure that administrative access to FortiGate is only allowed from the internal trusted network (192.168.1.0/24) and that all other access attempts are blocked. Which CLI command should the administrator configure first?

Accepted Answer

config system admin; edit admin; set trusthost 192.168.1.0 255.255.255.0; end. The `config system admin` command with `set trusthost` restricts administrative login attempts to only the specified source IP address or subnet. By setting `trusthost 192.168.1.0 255.255.255.0`, the FortiGate will only allow admin access from the 192.168.1.0/24 network, blocking all other sources. This is the foundational step to enforce source-based access control for administrative interfaces.

Answer

config system interface; edit port1; set allowaccess ping https ssh; end

Answer

config system global; set admin-http-redirect enable; end

Answer

set admin-sport 443

Question 10

An administrator wants to block the use of social media applications like Facebook and Twitter on the company network. Which security profile should be used?

Accepted Answer

Application Control profile. The Application Control profile is designed to identify and block specific applications, including social media platforms like Facebook and Twitter, regardless of the port or protocol they use. Unlike web filtering, which relies on URL categorization, application control inspects traffic patterns and signatures to enforce granular policies on application usage.

Answer

DNS Filter profile

Answer

Web Filter profile

Answer

IPS profile

Question 11

A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?

Accepted Answer

Disable HA override on both units. HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

Answer

Enable HA override on both units

Answer

Set the HA mode to active-active

Answer

Increase the HA priority on the primary unit

Question 12

A FortiGate receives log messages with severity 'warning'. What is the log severity level number for 'warning' according to FortiGate's log severity levels?

Accepted Answer

4. FortiGate severity levels: Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notification=5, Information=6, Debug=7.

Answer

3

Answer

6

Answer

5

Question 13

A FortiGate admin wants to inspect SSL-encrypted traffic for threats using IPS. The admin creates an SSL inspection profile with 'full SSL inspection' and applies it to the policy. What additional configuration is necessary for the IPS engine to process the decrypted traffic?

Accepted Answer

Apply an IPS sensor to the same firewall policy. IPS inspection requires that the security profile (IPS sensor) is also applied to the same firewall policy. SSL inspection alone only decrypts; the IPS profile inspects the decrypted traffic.

Answer

Enable 'set ssl-ssh-profile' under the IPS sensor

Answer

Enable 'IPS' under the SSL inspection profile

Answer

Configure the FortiGate's CA certificate on clients

Question 14

A FortiGate cluster in active-passive HA is configured with two heartbeat interfaces. The primary unit fails completely. The secondary unit detects the failure and becomes primary. After the original primary recovers, it remains in passive mode. What is the most likely reason for this behavior?

Accepted Answer

The HA override setting is disabled. When override is disabled (the default), the recovered unit will not preempt the current primary. The cluster stays with the current primary until it fails. This is the expected behavior for graceful recovery.

Answer

The heartbeat interfaces are not properly configured

Answer

The priority of the original primary is lower than the current primary

Answer

The HA override setting is enabled

Question 15

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Accepted Answer

Using a data interface as the heartbeat interface. Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Answer

Different firmware versions on cluster members

Answer

Mismatched HA passwords between cluster members

Answer

Mismatched HA priority values