NSE4 Practice Test 48 — 15 Questions

Question 1

A FortiGate administrator has configured a firewall policy allowing HTTP traffic from the internal network (10.0.1.0/24) to the DMZ server (192.168.1.10). The policy is placed after a deny-all policy that blocks traffic from internal to DMZ. Even though the allow policy is more specific, traffic is still being denied. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deny-all policy is placed above the allow policy in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom. The first matching policy is applied, and subsequent policies are ignored. Since the deny-all policy is placed above the more specific allow policy, traffic from 10.0.1.0/24 to 192.168.1.10 matches the deny-all first and is dropped, never reaching the allow rule.

Answer

The deny-all policy has a higher policy ID than the allow policy

Answer

The allow policy is configured with the wrong source interface

Answer

The allow policy uses a schedule that is not active at the current time

Question 2

When configuring a route-based IPsec VPN, which of the following must be created to allow traffic to flow through the tunnel?

Accepted Answer

A static route to the remote subnet via the IPsec interface. In a route-based IPsec VPN, the tunnel is represented as a virtual IPsec interface. To route traffic from the local network to the remote subnet through this tunnel, a static route must be configured with the remote subnet as the destination and the IPsec interface as the next-hop or outgoing interface. Without this route, the FortiGate has no forwarding information to send traffic into the tunnel, even if the IPsec phase 1 and phase 2 settings are correctly established.

Answer

A firewall policy with the VPN interface as source

Answer

A NAT rule to translate the private IPs

Answer

A security profile for VPN traffic

Question 3

What is the PRIMARY purpose of enabling 'Safe Search' in a web filter profile?

Accepted Answer

To enforce safe search settings on supported search engines like Google and Bing. Safe Search enforces the safe search feature of popular search engines (e.g., Google, Bing) to filter explicit content from search results. It does not block search engines or HTTPS.

Answer

To block all search engines

Answer

To prevent users from using HTTPS search engines

Answer

To log all search queries

Question 4

Which log severity level indicates that a device is unusable and requires immediate attention?

Accepted Answer

Emergency. FortiGate log severity levels are: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notification (5), Information (6), Debug (7). Emergency is the highest severity, indicating the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 5

A FortiGate cluster is configured in active-passive HA. The administrator wants to manage the cluster using a single IP address that always points to the current primary unit. Which configuration should be applied?

Accepted Answer

Enable 'management IP' under HA configuration with the desired IP. The management interface in HA can have a virtual IP that follows the primary unit, accessible via the floating (virtual) management IP.

Answer

Configure a virtual IP (VIP) for HTTPS management

Answer

Set the HA management IP as a dedicated interface IP on each unit

Answer

Use the same IP address on both units and disable ARP

Question 6

A network admin configures a firewall policy allowing HTTP traffic from internal users to an external web server. The policy uses a service object 'HTTP' defined as TCP/80. However, users cannot reach the server. What is the MOST likely cause?

Accepted Answer

The external web server is using HTTPS (TCP/443) instead of HTTP. The firewall policy explicitly allows TCP/80 (HTTP), but the external web server is using TCP/443 (HTTPS). Since the service object does not match the actual traffic, the firewall will drop or reject the packets, preventing connectivity. This is a classic service mismatch issue in FortiGate firewall policies.

Answer

The source address object does not include the users' subnet

Answer

The policy order is wrong; the policy is placed after a deny-all policy

Answer

The interface is set to the wrong zone

Question 7

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

Accepted Answer

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.. SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Answer

Remove the slower link from the SD-WAN interface.

Answer

Increase the bandwidth on the slower link.

Answer

Configure policy-based routing for the SaaS application.

Question 8

An administrator wants to view the current session table on a FortiGate. Which command should they use?

Accepted Answer

diagnose sys session list. The command 'diagnose sys session list' displays the current session table on a FortiGate, showing active sessions with source/destination, protocol, state, and policy information. It is the standard CLI command for inspecting the session table in real time.

Answer

diagnose debug flow

Answer

show full-configuration

Answer

get system performance statistics

Question 9

An administrator wants to view the current session table entries filtered by destination port 443. Which command should be used?

Accepted Answer

diagnose sys session filter dport 443; diagnose sys session list. FortiGate session table inspection uses the 'diagnose sys session filter' command to set filter criteria (such as dport 443), followed by 'diagnose sys session list' to display matching entries. This two-step filter-then-list pattern is the correct syntax.

Answer

execute session list dport 443

Answer

diagnose debug flow filter dport 443

Answer

diagnose sys session list dport 443

Question 10

An administrator is configuring a FortiGate to send logs to a FortiAnalyzer. Which TWO of the following are required? (Choose two.)

Accepted Answer

Ensure network connectivity between FortiGate and FortiAnalyzer. The FortiGate must have IP reachability to the FortiAnalyzer to send logs over the network, typically using TCP port 514 (syslog) or FortiGate's proprietary log forwarding protocol. Without network connectivity, log transmission will fail regardless of configuration.

Answer

Enable local logging on the FortiAnalyzer

Answer

Create a firewall policy on the FortiGate to allow log traffic

Answer

Disable local logging on the FortiGate

Question 11

A company wants to block all HTTP traffic but allow HTTPS. Which SSL inspection method should be used on the firewall policy?

Accepted Answer

No inspection. To block HTTP (port 80) while allowing HTTPS (port 443), no SSL inspection is needed because the firewall can distinguish traffic by port number alone. SSL inspection is only required when you need to examine the encrypted payload of HTTPS traffic, not to permit or deny it based on the protocol. Therefore, 'No inspection' is correct for this access control requirement.

Answer

Deep inspection

Answer

Full SSL inspection

Answer

Certificate inspection

Question 12

A FortiGate administrator notices that the device's disk usage is critically high, causing logging failures. The administrator wants to free up space without losing important logs. Which action should be taken first?

Accepted Answer

Configure log compression. Log compression reduces the size of existing log files on the disk without deleting any data, directly addressing the critically high disk usage while preserving all important logs. This is the safest first step because it reclaims space immediately without risking data loss or altering logging behavior.

Answer

Delete all existing log files

Answer

Disable logging to the local disk

Answer

Increase the disk retention period

Question 13

A company recently deployed FortiGate with application control to manage cloud application usage. They want to allow Google Drive for business but block personal Google accounts. Which application control configuration approach is most effective?

Accepted Answer

Use application control with specific signatures for 'Google Drive Business' and 'Google Drive Personal' and apply appropriate actions.. FortiGate's application control uses application signatures to distinguish between different versions of the same application, such as 'Google Drive Business' and 'Google Drive Personal'. By configuring specific signatures with appropriate actions (allow for business, block for personal), you can enforce granular control over cloud application usage without affecting legitimate business traffic.

Answer

Use web filtering to block the URL of personal Google Drive.

Answer

Configure IPS to block personal Google Drive traffic.

Answer

Create a rule to block all Google Drive applications.

Question 14

Which TWO of the following are best practices when configuring IPS on a FortiGate in a high-throughput environment?

Accepted Answer

Enable only relevant signatures based on the network environment.. Enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Answer

Set all signatures to block action to maximize security.

Answer

Set the IPS severity filter to high and above only.

Answer

Disable all custom signatures to simplify management.

Question 15

Which of the following log types on FortiGate records traffic that is denied by a firewall policy?

Accepted Answer

Traffic logs. Traffic logs on a FortiGate record all traffic that passes through or is denied by the firewall, including the source/destination, service, action (accept/deny), and policy that matched. When a firewall policy blocks traffic, the deny action is captured in the traffic log with the corresponding policy ID, making it the correct log type for identifying denied sessions.

Answer

HA logs

Answer

Event logs

Answer

Security logs