NSE4 Practice Test 46 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting an issue where HTTPS traffic is not being properly inspected by the web filter. The policy has SSL inspection enabled. Which TWO commands would provide the most useful real-time debugging information? (Choose two.)

Accepted Answer

diagnose debug flow filter dport 443 ; diagnose debug flow show function-name ; diagnose debug enable. Diagnose debug flow traces the packet through the firewall pipeline, showing each stage. Diagnose sniffer packet captures the actual packets, useful for seeing the SSL handshake. The other options are not real-time for this issue.

Answer

diagnose test application ips 1

Answer

diagnose sys session filter dport 443 ; diagnose sys session list

Answer

execute log display

Question 2

An administrator runs 'diagnose debug flow' for a specific source IP and sees the output includes 'no matching policy'. The FortiGate has a firewall policy that should match the traffic. What is the most likely reason for this message?

Accepted Answer

The firewall policy is disabled or the source/destination interfaces do not match the traffic's ingress/egress interfaces. 'no matching policy' in debug flow indicates that the traffic did not match any firewall policy. Even if a policy exists, it may not match due to incorrect source/destination interfaces, addresses, or other criteria. A common cause is that the traffic is coming from an interface that is not covered by the policy or the policy is disabled.

Answer

The FortiGate's routing table does not have a route for the destination

Answer

The security profiles applied to the policy are blocking the traffic

Answer

The session table is full and cannot accept new sessions

Question 3

A FortiGate administrator needs to capture packets on the DMZ interface to troubleshoot a connectivity issue. Which CLI command should be used to start a packet capture?

Accepted Answer

diagnose sniffer packet. The command 'diagnose sniffer packet' is used for packet capture on FortiGate interfaces.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

execute packet-capture start

Question 4

A FortiGate HA cluster in active-passive mode is experiencing unexpected failovers. The administrator suspects the heartbeat link is unreliable. Which TWO actions would help diagnose the heartbeat link issue? (Select two.)

Accepted Answer

Ping the heartbeat interface IP from the peer unit. Pinging the heartbeat interface IP checks connectivity; enabling debug HA heartbeat provides detailed heartbeat status.

Answer

Disable session synchronization

Answer

Configure a dedicated heartbeat interface

Answer

Increase the HA hello timer

Question 5

Which FortiGuard subscription service is required for URL filtering and web categorization?

Accepted Answer

FortiGuard Web Filtering. FortiGuard Web Filtering provides URL categorization and filtering capabilities.

Answer

FortiGuard IPS

Answer

FortiGuard Application Control

Answer

FortiGuard Antivirus

Question 6

A FortiGate admin is troubleshooting intermittent VPN disconnections. The admin enables debug flow with 'diagnose debug flow filter daddr 10.0.0.1' and 'diagnose debug flow trace start 10'. The output shows 'msg: send to x.x.x.x via intf port1' but then immediately 'msg: no matching policy'. However, the firewall policy list shows a policy that should match. What is the most likely cause?

Accepted Answer

A static route is missing or incorrect, causing the traffic to exit the wrong interface. The 'no matching policy' message indicates that the traffic did not match any policy. Since the debug shows the traffic is going out via port1, but the policy might be configured on a different interface (e.g., the VPN interface). In a VPN scenario, traffic destined for the remote subnet must match a policy from the VPN tunnel interface to the destination. If the traffic is being routed out port1 (the physical WAN) instead of through the VPN tunnel, the policy check fails. This is often due to missing or incorrect routing. Alternatively, the policy might be correctly configured but the traffic is being processed on the wrong VDOM, but the routing issue is more common.

Answer

The policy's source interface is not the incoming interface

Answer

The firewall policy is disabled

Answer

The VPN tunnel is down

Question 7

A network administrator is troubleshooting a FortiGate HA cluster that is not failing over as expected. The cluster consists of two units in active-passive mode. The administrator issues the command 'diagnose sys ha status' and sees that both units have the same priority. What is the most likely cause of the failover issue?

Accepted Answer

The HA override setting is disabled. In active-passive HA, the unit with the higher priority (lower number) becomes primary. If priorities are equal, the primary is determined by serial number. Equal priorities do not prevent failover; the issue is likely that the override setting is disabled, so a lower-priority unit cannot take over even if the primary fails unless override is enabled.

Answer

The HA mode is set to active-active instead of active-passive

Answer

The session pickup feature is enabled

Answer

The HA heartbeat interfaces are not properly connected

Question 8

An administrator configures a FortiGate to use FortiGuard for web filtering. However, some users report that certain categories are not being blocked as configured. The administrator checks the FortiGuard subscription status and it is valid. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard distribution servers. Even with a valid subscription, if the FortiGate cannot reach the FortiGuard distribution servers (e.g., due to firewall policies or routing), it will use the local cache. If the cache is outdated or incomplete, filtering may not work as expected.

Answer

The users are bypassing the FortiGate

Answer

The FortiGuard subscription has expired

Answer

The web filter profile is not applied to the firewall policy

Question 9

What is the purpose of the 'override' setting in FortiGate HA?

Accepted Answer

It enables the higher-priority unit to reclaim the primary role after recovery. HA override allows a device with higher priority to take over as primary after it recovers from a failure.

Answer

It allows management access to the cluster via a virtual IP

Answer

It disables HA failover during maintenance windows

Answer

It forces the secondary unit to become primary immediately

Question 10

A FortiGate HA cluster is operating in active-passive mode. The active unit fails over to the passive unit. After the failover, some existing TCP sessions are dropped. What is the MOST likely cause?

Accepted Answer

Session synchronization is not enabled or not working properly. TCP sessions require session synchronization to survive failover. If session sync is not configured or not functioning, sessions are lost.

Answer

The HA heartbeat interface has a high latency

Answer

The failover time is too slow, causing TCP timeouts

Answer

The TCP sessions are using NAT, which cannot be synchronized

Question 11

An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?

Accepted Answer

The heartbeat interface is not configured. HA requires at least one heartbeat interface configured on both units. Without it, they cannot communicate.

Answer

The management interface is used as a heartbeat

Answer

The HA password is incorrect

Answer

The HA group-id does not match

Question 12

An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is the built-in packet capture tool on FortiGate. It allows capturing packets on interfaces with filters for IP, port, protocol, etc. Example: 'diagnose sniffer packet any "host 10.0.0.1" 4'.

Answer

diagnose debug enable and diagnose debug flow trace

Answer

diagnose sys session list

Answer

execute system grep from CLI

Question 13

An administrator is setting up an active-passive HA pair and wants to ensure that the cluster can properly monitor each unit's health. Which TWO interfaces must be configured as HA heartbeat interfaces? (Choose two.)

Accepted Answer

A VLAN interface on a dedicated trunk that is only used for HA. Heartbeat interfaces are used for cluster communication and health monitoring. FortiGate requires at least one dedicated heartbeat interface, but best practice is to have two for redundancy. The heartbeat interfaces can be physical interfaces or VLANs. They should be dedicated to HA traffic and not carry regular data traffic. Options: The correct ones are physical or VLAN interfaces designated as heartbeat. Option C and D are correct because heartbeat interfaces can be any unused interface, and they should not carry data traffic. Option A is wrong because management interfaces are separate. Option B is wrong because the WAN interface is typically used for data. Option E is wrong because the internal switch interface is usually for LAN traffic.

Answer

The internal switch interface (e.g., port3)

Answer

The WAN interface (port1)

Answer

The management interface

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the TCP SYN sent state, not yet fully established. The output shows a TCP session (proto=6) in state 01 (TCP SYN sent), duration 3600 seconds, and expire 3599 seconds. This indicates the session is in the initial SYN state and has not completed the three-way handshake.

Answer

The session is using UDP protocol

Answer

The session has expired and is being removed

Answer

The session has completed the three-way handshake and is established

Question 15

A FortiGate administrator is troubleshooting a traffic issue where users cannot access a specific website. The administrator runs 'diagnose debug flow' and sees the output indicating that traffic is being denied by a firewall policy. Which two actions should the administrator take to identify the specific policy denying the traffic? (Choose two.)

Accepted Answer

Review the policy list and look for the policy ID shown in the debug output. The debug flow output includes the policy ID that denied the traffic. The administrator can check the policy details using 'show firewall policy <id>' or check the traffic log for the session to see which policy was matched.

Answer

Run 'diagnose debug enable' and then reproduce the issue

Answer

Use 'diagnose sys session list' to find the policy ID

Answer

Disable all firewall policies temporarily