NSE4 Practice Test 46 — 15 Questions

Question 1

An administrator configures a FortiGate HA cluster in active-active mode. After enabling session synchronization, they notice that new sessions are not being synced to the secondary unit. The cluster is using a dedicated heartbeat interface. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy does not have session sync enabled. In active-active HA, session synchronization requires that the session sync flag is enabled on the firewall policy. Without it, sessions are not synced.

Answer

The HA mode is set to active-passive

Answer

The session TTL is too short

Answer

The heartbeat interface is not configured with an IP address

Question 2

During a failover in an active-passive HA cluster, the newly active unit does not have the same session table as the previous primary, causing all existing sessions to drop. Which setting should the administrator verify?

Accepted Answer

The session pickup setting is enabled. Session synchronization must be enabled and properly configured to replicate sessions to the standby unit.

Answer

HA override is enabled on both units

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in active-active mode

Question 3

In an active-active HA cluster, what is the purpose of the 'session sync' configuration?

Accepted Answer

To replicate session state so that if one unit fails, another can take over without interruption. Session sync ensures that sessions are shared between cluster units so that any unit can handle traffic for a given session.

Answer

To synchronize configuration changes between cluster members

Answer

To balance the number of sessions across cluster members

Answer

To synchronize the time between cluster members

Question 4

An administrator needs to ensure that in an active-passive HA cluster, the primary unit always remains the preferred master unless it fails, regardless of other factors. The administrator sets the primary's HA priority to 200 and the secondary to 100. However, after a reboot of the primary, the secondary becomes the primary. What additional step is required?

Accepted Answer

Set 'set override enable' under config system ha. In HA, the 'override' setting (or 'set override enable') ensures that when the primary recovers, it will preempt the current primary and become active again. Without override, the cluster uses a non-preemptive mode: once a unit becomes primary, it stays primary even if a higher-priority unit comes back online.

Answer

Set 'set ha-mgmt-status enable' on the primary

Answer

Reduce the secondary priority to 0

Answer

Increase the primary priority to 255

Question 5

An administrator has configured an SSL deep inspection profile with 'certificate inspection' for a firewall policy. Users report that they receive certificate errors when accessing HTTPS sites. What is the MOST likely reason?

Accepted Answer

The web server uses a self-signed certificate which is blocked by the inspection profile. With 'certificate inspection' mode, the FortiGate does not decrypt traffic or present its own certificate to clients. It only inspects the server certificate during the SSL handshake. If the inspection profile is configured to block invalid certificates (e.g., self-signed, expired, untrusted CA), and the web server uses a self-signed certificate, the FortiGate will drop the connection. Users may then see a certificate error or connection failure in their browsers. Option C is incorrect because certificate inspection never involves the FortiGate's CA certificate; that is only used in full SSL inspection when re-signing certificates.

Answer

The certificate installed on the FortiGate for SSL inspection is expired

Answer

The users' browsers do not trust the FortiGate's CA certificate

Answer

The FortiGate is not configured to re-sign certificates with its own CA certificate

Question 6

Which of the following FortiGate features allows users to authenticate using a one-time password generated by a mobile app?

Accepted Answer

FortiToken. FortiToken is Fortinet's two-factor authentication solution that generates one-time passwords (OTPs) via a mobile app (FortiToken Mobile) or hardware token. When a user authenticates, they must provide both their regular password and the current OTP from the FortiToken app, which is validated by the FortiGate against the token's seed record. This directly matches the question's requirement for OTP generation by a mobile app.

Answer

FSSO

Answer

LDAP

Answer

Captive portal

Question 7

Drag and drop the steps to upgrade FortiGate firmware via the web interface into the correct order.

Accepted Answer

Upload the firmware image first, then confirm the upgrade, then reboot.. Firmware upgrade requires uploading the image and confirming; the device reboots automatically.

Answer

Confirm the upgrade first, then upload the firmware image, then reboot.

Answer

Upload the firmware image first, then reboot, then confirm the upgrade.

Answer

Reboot first, then upload the firmware image, then confirm the upgrade.

Question 8

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

Accepted Answer

Policy-based routing (PBR). Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Answer

Equal-cost multi-path (ECMP) routing

Answer

Static route with higher distance

Answer

SD-WAN with load balancing

Question 9

Which FortiGuard subscription service is required for URL filtering and web categorization?

Accepted Answer

FortiGuard Web Filtering. FortiGuard Web Filtering provides URL categorization and filtering capabilities.

Answer

FortiGuard IPS

Answer

FortiGuard Application Control

Answer

FortiGuard Antivirus

Question 10

Which TWO of the following are valid methods to view real-time debug output on a FortiGate? (Choose two.)

Accepted Answer

diagnose sniffer packet. Diagnose debug flow and diagnose sniffer packet are real-time debug commands. Execute tail log is not a standard command.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

execute tail log

Question 11

A FortiGate administrator is investigating a performance issue and suspects that a large number of incomplete TCP connections are consuming session table resources. Which TWO commands would help identify such sessions? (Choose two.)

Accepted Answer

diagnose sys session stat. Diagnose sys session list with filter can show sessions by state. Diagnose sys session stat shows counts by state. The sniffer shows packets, not session state; debug flow is for tracing specific streams.

Answer

diagnose debug flow filter dport 80 ; diagnose debug enable

Answer

diagnose sniffer packet any 'tcp' 4

Answer

diagnose sys session filter proto 6 ; diagnose sys session list

Question 12

A FortiGate administrator needs to forward logs to a FortiAnalyzer for centralized management. The FortiAnalyzer is reachable at 10.0.1.100. Which configuration step is required on the FortiGate to send logs to this FortiAnalyzer?

Accepted Answer

Configure the FortiAnalyzer in System > FortiAnalyzer. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer server under System > FortiAnalyzer or via CLI using 'config log fortianalyzer setting set server 10.0.1.100'. The log forwarding policy is not used for FortiAnalyzer.

Answer

Configure a syslog server under Log Setting

Answer

Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

Answer

Enable logging to FortiCloud instead

Question 13

Which CLI command is used on a FortiGate to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. On a FortiGate, the real-time packet capture command is 'diagnose sniffer packet '. It captures live packets on a specified interface with optional BPF-style filters and verbosity levels, making it the standard tool for troubleshooting traffic at the packet level. This is the FortiOS equivalent of tcpdump.

Answer

execute packet-capture

Answer

diagnose debug flow

Answer

diagnose sys session list

Question 14

An administrator configures a FortiGate to use NTP for time synchronization. After configuration, the FortiGate still shows the wrong time. Which command should the administrator run to verify NTP status?

Accepted Answer

diagnose sys ntp status. 'diagnose sys ntp status' is the FortiGate CLI command that provides detailed NTP synchronization status, including whether the FortiGate is synchronized to an NTP server, the stratum level, and the last sync time. This command is specifically designed for troubleshooting NTP issues, unlike the other options which either show configuration or are invalid.

Answer

show system ntp

Answer

execute ntp status

Answer

diagnose sys time status

Question 15

A FortiGate administrator needs to ensure that all internal users (10.0.0.0/8) accessing the internet use a single public IP address 203.0.113.10 for source NAT. Which NAT configuration should be used?

Accepted Answer

Create a Central SNAT rule with a Dynamic IP Pool using overload. Central SNAT with a Dynamic IP Pool using overload (Port Address Translation) allows all internal users in 10.0.0.0/8 to share a single public IP (203.0.113.10) by dynamically mapping multiple private source IPs and ports to unique source ports on the public IP. This is the standard method for many-to-one NAT, ensuring all outbound internet traffic appears from the same public address.

Answer

Enable NAT on the outgoing interface policy without an IP pool

Answer

Create a policy-based NAT rule with fixed port range

Answer

Configure a VIP with port forwarding