NSE4 Practice Test 47 — 15 Questions

Question 1

An administrator is troubleshooting a policy that should allow HTTP traffic but it is being blocked. They run 'diagnose debug flow' and see the output ends with 'msg=deny by forward policy check'. What is the most likely cause?

Accepted Answer

The policy is configured with action DENY. The message indicates the packet was denied by a firewall policy, meaning there is no matching policy or the matching policy has action DENY.

Answer

The routing table is missing a default route

Answer

The session table is full

Answer

The HTTP traffic is not matching any policy

Question 2

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP three-way handshake is incomplete; only SYN was sent. protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

Answer

The session is a UDP connection to port 443

Answer

The session will expire in 3600 seconds

Answer

The session has been established for 3600 seconds

Question 3

Which TWO of the following are valid methods to view real-time debug output on a FortiGate? (Choose two.)

Accepted Answer

diagnose sniffer packet. Diagnose debug flow and diagnose sniffer packet are real-time debug commands. Execute tail log is not a standard command.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

execute tail log

Question 4

A company has two FortiGate units in an active-active HA cluster. They want to ensure that sessions initiated from the internet through a virtual IP are synchronized to the peer unit in case of failover. Which HA setting is required?

Accepted Answer

Enable 'session-pickup' under config system ha. In active-active HA, session synchronization is enabled by default for TCP sessions, but for UDP and other protocols, session sync needs to be explicitly enabled. However, the question is about ensuring sessions are synchronized. The key setting is 'session-pickup' which enables session synchronization for all protocols. Also, for active-active, 'session-pickup-connectionless' should be enabled for UDP and ICMP. But the most direct answer is to enable session-pickup globally.

Answer

Enable 'set ha-mgmt-status enable' on the WAN interface

Answer

Set 'set schedule' to 'round-robin' for the VIP

Answer

Configure the same virtual IP on both units

Question 5

A FortiGate is configured with an active-passive HA cluster. The admin notices that when the primary unit fails, the secondary takes over, but after the primary recovers, it does not automatically become active again. What is the most likely reason?

Accepted Answer

Override is not enabled. By default, HA does not preempt. The 'override' setting is disabled. When the primary recovers, it does not force a failback because the cluster is non-preemptive. The admin must enable override if they want automatic failback.

Answer

The primary has a lower priority than the secondary

Answer

Session pickup is disabled

Answer

The heartbeat interface is down

Question 6

An administrator is configuring ZTNA (Zero Trust Network Access) on a FortiGate. The administrator needs to ensure that only clients with a valid posture assessment can access an internal application. Which access proxy setting must be configured to enforce this requirement?

Accepted Answer

Configure a ZTNA rule with a ZTNA tag requirement. ZTNA uses access proxies to secure access. To enforce client posture assessment, the administrator needs to configure an access proxy with a ZTNA rule that includes a ZTNA tag matching the required posture. The tag is assigned by FortiClient EMS based on compliance. The access proxy rule can then require that the client presents a valid ZTNA tag.

Answer

Enable SSL deep inspection on the access proxy

Answer

Set the access proxy to use certificate-based authentication

Answer

Enable multi-factor authentication on the access proxy

Question 7

An administrator is troubleshooting an issue where users cannot access an internal web server via the internet through a FortiGate. The FortiGate has a virtual IP (VIP) configured for the web server. The administrator runs 'diagnose debug flow filter daddr <public-ip>' and 'diagnose debug flow trace start 100'. The output shows 'msg: forward to x.x.x.x via intf port2' but then 'msg: policy deny'. Which TWO actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Confirm that the firewall policy's destination is set to the internal web server's IP address (or the VIP's mapped IP). The debug shows that traffic is being forwarded to the internal server (via port2) but then denied by policy. This means the traffic is matching the VIP and being DNATed, but the firewall policy that should allow the traffic is either missing, disabled, or configured incorrectly. The administrator should check the firewall policy that handles the traffic after DNAT. Common issues: the policy's source interface is not the incoming interface (should be the WAN interface), or the policy's destination is not the internal server's IP (should be the original destination or the VIP destination). Option A and D are correct: ensure the policy has the correct source interface (WAN) and that the destination is set to the VIP's mapped IP (or the VIP itself). Option B is wrong because the issue is not DNS. Option C is wrong because adding a route to the internet won't help. Option E is wrong because the VIP is already configured.

Answer

Ensure that a static route exists to the internet via the WAN interface

Answer

Check if the public DNS resolution for the domain is correct

Answer

Recreate the virtual IP object with a different port

Question 8

A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization is not enabled. Option D is correct because session synchronization must be enabled for sessions to be preserved during failover. Without session sync, the backup unit has no knowledge of existing sessions and drops them.

Answer

The HA failover threshold is set too high

Answer

The HA mode is active-passive

Answer

The heartbeat interface is down

Question 9

A FortiGate administrator is configuring logging to meet a compliance requirement that all security events must be stored for at least one year. The FortiGate has limited local disk space. Which THREE actions should the administrator take to meet this requirement? (Choose three.)

Accepted Answer

Configure log rolling and retention policies to automatically delete older logs from the local disk after a set period. To store logs for a year with limited local disk, the administrator needs to offload logs to an external storage solution such as FortiAnalyzer or FortiCloud, and also set appropriate log retention policies. The correct actions are: enable logging to FortiAnalyzer (A), enable logging to FortiCloud (C), and configure log rolling and retention to automatically delete old logs from local disk (E). Option B is wrong because increasing log severity to only 'emergency' would lose most logs. Option D is wrong because disabling disk logs would avoid local storage but without external logging, logs would be lost.

Answer

Set the log severity filter to only log 'emergency' events to reduce volume

Answer

Disable local disk logging to save space

Question 10

An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. Option A is correct. The 'diagnose sniffer packet' command is used to capture packets in real time on FortiGate interfaces.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose debug flow

Question 11

A FortiGate administrator runs 'diagnose debug flow' with a filter for a specific source IP. The output shows 'no policy matched' for the traffic. The administrator verifies that a firewall policy exists with that source IP. What is the most likely reason for the 'no policy matched' message?

Accepted Answer

The traffic is being blocked by an implicit deny or a different policy before reaching the expected policy. Option B is correct. Debug flow may show 'no policy matched' when traffic hits an implicit deny before reaching the explicit policy, e.g., due to inter-VDOM routing or policy order where an earlier policy with a broader match blocks it.

Answer

The firewall policy is disabled

Answer

The debug flow filter is not configured correctly

Answer

The source IP is not in the routing table

Question 12

Which log severity level indicates that a log message is for informational purposes and does not require immediate action?

Accepted Answer

Information. Option B is correct. In FortiGate, log severity levels follow the standard syslog severity: 0=emergency, 1=alert, 2=critical, 3=error, 4=warning, 5=notice, 6=informational, 7=debug. Informational is level 6.

Answer

Notice

Answer

Debug

Answer

Warning

Question 13

An administrator wants to view real-time debug output for traffic flowing through a FortiGate. Which command should they use to enable flow tracing with a specific source IP filter?

Accepted Answer

diagnose debug flow filter src. Option D is correct. 'diagnose debug flow' with 'filter src' sets a source IP filter for flow debugging.

Answer

diagnose debug enable

Answer

diagnose sys session filter src

Answer

diagnose sniffer packet filter src

Question 14

An administrator needs to store logs for compliance purposes and wants them to be retained even if the FortiGate is reset. Which log storage option should they use?

Accepted Answer

FortiAnalyzer. Option C is correct. FortiAnalyzer provides centralized log storage that is separate from the FortiGate, ensuring logs are retained even if the FortiGate is reset.

Answer

FortiCloud logs

Answer

Syslog server

Answer

Local disk logs

Question 15

A FortiGate administrator is diagnosing a performance issue. They notice that the CPU usage is consistently high. Which command can provide a real-time view of the processes consuming CPU?

Accepted Answer

diagnose sys top. Option D is correct. 'diagnose sys top' provides a real-time top-like view of processes and their CPU/memory usage, helpful for identifying resource hogs.

Answer

get system performance status

Answer

diagnose sys session stat

Answer

diagnose debug flow