NSE4 Practice Test 47 — 15 Questions

Question 1

An organization uses Application Control to allow only business-critical applications and block social media. The administrator has configured the profile to block Facebook and Twitter, but users can still access Facebook. The firewall policy applies the profile correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL inspection is not enabled on the firewall policy.. Application Control relies on SSL inspection to identify applications like Facebook that use HTTPS. Without SSL inspection enabled on the firewall policy, FortiGate can only see encrypted traffic as generic SSL/TLS flows and cannot match the application signatures for Facebook. Enabling SSL inspection (deep inspection or certificate-based inspection) allows the FortiGate to decrypt the traffic and apply the application control profile correctly.

Answer

The application control profile is applied to the wrong direction.

Answer

Facebook is not included in the default application signatures.

Answer

The FortiGate is in flow-based inspection mode.

Question 2

A FortiGate administrator needs to allow all internal users (10.0.0.0/8) to access a web server in the DMZ (192.168.1.100) using HTTPS. The administrator wants to apply a web filter profile to block malicious URLs while allowing legitimate traffic. Which of the following is the correct policy configuration?

Accepted Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=ACCEPT, web filter profile=default. The policy must match the HTTPS service (TCP/443) to allow encrypted web traffic to the DMZ web server, and the web filter profile is applied to inspect the HTTPS traffic for malicious URLs. The default web filter profile can block malicious URLs while allowing legitimate HTTPS traffic, provided SSL inspection is configured to enable content filtering.

Answer

Policy: source=internal, destination=DMZ, service=ALL, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTP, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=DENY, web filter profile=default

Question 3

A FortiGate administrator is troubleshooting an IPsec VPN that fails to establish. The Phase 1 status shows 'init' and then resets. The administrator runs 'diagnose debug application ike -1' and sees the message 'no acceptable proposal'. Which TWO parameters are MOST likely mismatched?

Accepted Answer

Encryption algorithm (e.g., AES256 vs AES128). The IKE debug message 'no acceptable proposal' means the two peers could not agree on the Phase 1 (IKE SA) proposal parameters, which are negotiated during IKE SA establishment. Option D (encryption algorithm, e.g., AES256 vs AES128) is correct because the encryption algorithm is a Phase 1 proposal attribute, and if the local and remote FortiGates offer different encryption algorithms, no matching proposal exists and negotiation fails. Option E (Diffie-Hellman group, e.g., group 14 vs group 2) is also correct because the DH group is another Phase 1 proposal attribute; mismatched DH groups (modp2048/group 14 vs modp1024/group 2) prevent the peers from agreeing on a proposal. Option A (pre-shared key) is not the cause here because a PSK mismatch produces authentication failure messages (e.g., 'probable pre-shared key mismatch'), not 'no acceptable proposal'. Option B (Phase 2 local and remote networks) is a Phase 2 quick-mode/selector issue and would not generate a Phase 1 proposal rejection. Option C (IKE version) can cause negotiation problems, but a version mismatch typically shows different errors such as 'received IKEv2 packet on IKEv1 tunnel' or invalid version messages rather than the specific 'no acceptable proposal' text.

Answer

Pre-shared key

Answer

Phase 2 local and remote networks

Answer

IKE version (IKEv1 vs IKEv2)

Question 4

An administrator runs the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and sees output indicating sessions with proto_state=01 and duration=3600. What does this indicate about the sessions?

Accepted Answer

The sessions are TCP connections in SYN state and have a timeout of 3600 seconds.. The command filters sessions on destination port 443. The output field 'proto_state=01' indicates a TCP session in SYN_SENT state (state 1), which is the initial step of a TCP handshake. The 'duration=3600' field shows that the session has been active for 3600 seconds (or represents a time value). Option B correctly identifies the state as TCP SYN and the number 3600 as a time value, making it the most accurate choice. Option A is wrong because UDP does not have a SYN state. Option C is wrong because state 01 is not established (established is state 06). Option D is wrong because ICMP does not use ports.

Answer

The sessions are UDP-based and have been active for 3600 seconds.

Answer

The sessions are TCP connections in established state with a duration of 3600 seconds.

Answer

The sessions are ICMP packets with a TTL of 3600.

Question 5

A FortiGate administrator notices that the HA cluster is frequently failing over even though no hardware failure has occurred. The heartbeat link shows some packet loss. What is the best action to reduce unnecessary failovers?

Accepted Answer

Increase the failover threshold. The failover threshold (also called heartbeat loss threshold) determines how many consecutive heartbeat packets must be missed before a failover is triggered. By increasing this threshold, the FortiGate will tolerate more packet loss on the heartbeat link before declaring a failure, thus reducing unnecessary failovers caused by transient network issues. This directly addresses the root cause: intermittent packet loss on the heartbeat link. Lowering the interval would make the problem worse, and changing HA mode or disabling session sync does not affect failover sensitivity.

Answer

Lower the heartbeat interval

Answer

Change HA mode to active-active

Answer

Disable session synchronization

Question 6

Drag and drop the steps to configure a static route on a FortiGate firewall into the correct order.

Accepted Answer

Enter config router static, then edit route with sequence number, then set destination, then set device, then set gateway, then end. Static routes on FortiGate are configured in the router static configuration context, requiring a sequence number, destination, device, and gateway.

Answer

Enter config router static, then edit route, then set gateway, then set destination, then set device, then end

Answer

Enter config router static, then set destination, then set device, then set gateway, then edit route, then end

Answer

Enter config router static, then edit route, then set device, then set gateway, then end, then set destination

Question 7

A FortiGate is deployed in NAT/Route mode. The administrator wants to create a policy that allows internal users to access the internet and also translates their private IP addresses to the public IP of the FortiGate's WAN interface. Which policy configuration is required?

Accepted Answer

Enable NAT on the firewall policy. In NAT/Route mode, enabling NAT on the firewall policy performs source NAT (SNAT) by default, translating the private source IP addresses of internal users to the public IP address of the FortiGate's WAN interface. This is the standard method for allowing internal users to access the internet while hiding their private addresses behind a single public IP.

Answer

Configure a virtual IP (VIP) for the WAN interface

Answer

Set the policy action to ACCEPT and enable SNAT in the policy advanced options

Answer

Add a static route with NAT enabled

Question 8

Which security profile is used to detect and prevent network-based attacks by analyzing traffic patterns and comparing them against known attack signatures?

Accepted Answer

IPS profile. The Intrusion Prevention System (IPS) profile is specifically designed to detect and prevent network-based attacks by inspecting traffic patterns and comparing them against a database of known attack signatures. Unlike other security profiles that focus on content or application-layer threats, the IPS profile operates at the network and transport layers to identify malicious patterns such as exploit attempts, buffer overflows, and denial-of-service attacks.

Answer

DLP profile

Answer

Web filter profile

Answer

Antivirus profile

Question 9

An administrator needs to send logs from a FortiGate to a remote FortiAnalyzer for centralized log storage and analysis. Which configuration step is required on the FortiGate?

Accepted Answer

Set the FortiAnalyzer as the log destination in Log Settings. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer as a remote log destination under Log Settings. This is done via 'config log fortianalyzer setting' and specifying the server IP and other parameters.

Answer

Configure a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514

Answer

Create a log forwarding rule to forward all logs to the FortiAnalyzer

Answer

Install a FortiGate connector on the FortiAnalyzer

Question 10

An administrator runs 'diagnose vpn ike gateway list' on a FortiGate and sees the following output for a dial-up IPsec VPN:
gateway name: 'dialup'
  version: IKEv1
  mode: aggressive
  local IP: 203.0.113.1
  remote IP: 0.0.0.0
  state: up
  peers: 0
What does 'peers: 0' indicate?

Accepted Answer

No IPsec clients are currently connected. In the output of 'diagnose vpn ike gateway list', the 'peers' field shows the number of active IPsec tunnels (Phase 1 SAs) currently established through that gateway. A value of '0' means no remote clients have successfully completed IKE negotiation and are connected. Since the gateway state is 'up', it is ready to accept connections, but no clients are currently associated with it.

Answer

The remote IP should be set to a specific address

Answer

The gateway is in a down state

Answer

The Phase 2 proposals are mismatched

Question 11

A FortiGate administrator notices that some users can bypass the web filter to access prohibited categories. The web filter profile is applied to the firewall policy. Which TWO actions should the admin take to determine why the filter is being bypassed? (Choose two.)

Accepted Answer

Check if the firewall policy that the traffic matches has the web filter profile applied. Option B is correct because if the firewall policy that actually matches the user's traffic does not have the web filter profile attached, the filter is never evaluated and users can reach prohibited categories; the admin must confirm the profile is applied on the matching policy, not just on some other policy. Option D is correct because without SSL deep inspection the FortiGate cannot decrypt HTTPS traffic, so it cannot inspect the URL path or content and the web filter is effectively bypassed for HTTPS sites. Option A is not the primary troubleshooting step here since FortiGuard connectivity issues would typically cause rating failures or blocks rather than selective bypass, and the question focuses on why filtering is bypassed. Option C is incorrect because the DNS filter is a separate feature and its absence does not explain why the web filter profile is not blocking traffic. Option E is incorrect because client browser proxy settings are not a FortiGate web filter configuration element and would not be the standard cause of the filter being bypassed in this scenario.

Answer

Ensure that the FortiGate has connectivity to FortiGuard

Answer

Verify that the DNS filter is also applied to the same policy

Answer

Examine the client's browser proxy settings

Question 12

Drag and drop the steps to perform a factory reset on FortiGate via CLI into the correct order.

Accepted Answer

Connect to CLI, run execute factoryreset, confirm, wait for reboot.. Factory reset is done with execute factoryreset, then confirm; device reboots to defaults.

Answer

Connect to CLI, confirm, run execute factoryreset, wait for reboot.

Answer

Connect to CLI, run execute factoryreset, wait for reboot, confirm.

Answer

Connect to CLI, reboot, run execute factoryreset, confirm.

Question 13

A FortiGate has a policy that allows traffic from 10.0.0.0/8 to any destination with NAT enabled using an IP pool 'Pool1' (203.0.113.10-203.0.113.20). The admin notices that internal servers using fixed ports (e.g., SIP) are failing. What is the likely cause?

Accepted Answer

The IP pool is configured with overload (PAT), which changes source ports. When an IP pool is configured with overload (PAT), the FortiGate translates the source IP address and also changes the source port to a random high port. For protocols like SIP that rely on fixed source ports (e.g., UDP 5060), this port remapping breaks the application because the SIP server expects traffic from a specific port. Option D correctly identifies this as the root cause.

Answer

The policy order is incorrect

Answer

The IP pool is configured with one-to-one NAT

Answer

The IP pool uses fixed port range, which should work

Question 14

An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?

Accepted Answer

The destination interface should be the internal interface, not wan1. The VIP maps the public IP to the internal server, but the firewall policy's destination interface is set to 'wan1', which is the external interface. Traffic arriving on wan1 and destined for the VIP must be processed by a policy where the destination interface is the internal interface (e.g., 'internal' or 'lan') so that the firewall can route the decapsulated traffic to the private server. Setting the destination interface to wan1 prevents the firewall from forwarding the traffic to the internal network, breaking connectivity.

Answer

The policy needs NAT enabled

Answer

The source interface should be the internal interface

Answer

The VIP is not associated with the policy

Question 15

An administrator needs to block access to a specific website using FQDN address objects. Which TWO steps are necessary?

Accepted Answer

Create an FQDN address object for the website. Creating an FQDN address object (Option A) is necessary because it allows the firewall to resolve the fully qualified domain name to an IP address dynamically, enabling policy enforcement based on the domain rather than a static IP. Adding a firewall policy with destination set to that FQDN object and action DENY (Option B) is required to actually block traffic to the website by matching the resolved IP addresses against the policy. Without both steps, the firewall cannot identify and deny traffic to the specific website using FQDN-based control.

Answer

Create a wildcard FQDN address object

Answer

Configure a DNS filter to block the FQDN

Answer

Create a VIP for the website