NSE4 Practice Test 50 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting a traffic issue where users cannot access a specific website. The administrator runs 'diagnose debug flow' and sees the output indicating that traffic is being denied by a firewall policy. Which two actions should the administrator take to identify the specific policy denying the traffic? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the policy list and look for the policy ID shown in the debug output. Option C is correct because the 'diagnose debug flow' output explicitly prints the policy ID (e.g., 'matched policy 5') that denied the traffic, so reviewing the firewall policy list for that ID pinpoints the exact offending policy. Option D is correct because FortiGate traffic logs record the policy ID (policyid) for each session, so checking the log entry for the denied session reveals the same policy identifier and confirms which rule blocked the traffic. Option A is not the right action because 'diagnose debug enable' only turns on debug output; it does not itself identify the policy, and the administrator has already captured the flow output. Option B is incorrect because 'diagnose sys session list' shows session details such as source/destination and state, but it does not reliably surface the denying policy ID for a denied flow. Option E is incorrect and dangerous because disabling all firewall policies would remove security enforcement and is not a valid troubleshooting step.

Answer

Run 'diagnose debug enable' and then reproduce the issue

Answer

Use 'diagnose sys session list' to find the policy ID

Answer

Disable all firewall policies temporarily

Question 2

A FortiGate admin wants to send logs to both a local disk and a remote FortiAnalyzer. Which log configuration must be set?

Accepted Answer

Enable local logging and configure FortiAnalyzer as a remote server. To send logs to both local disk and a remote FortiAnalyzer, you must enable local logging (so logs are written to disk) and configure FortiAnalyzer as a remote logging server. FortiOS supports simultaneous local and remote logging when both are enabled; no special 'mirror' toggle is required for FortiAnalyzer in standard configurations. This combination satisfies the requirement of dual destinations.

Answer

Use the 'diagnose debug application log' command

Answer

Select 'Mirror local logs to FortiAnalyzer'

Answer

Set the log severity to 'Information' on both

Question 3

An organization wants to send FortiGate logs to a central log management system for long-term storage and compliance. Which FortiGate feature is specifically designed for collecting and analyzing logs from multiple FortiGate devices?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is Fortinet's dedicated centralized logging, analysis, and reporting appliance (physical or virtual) designed to collect logs from multiple FortiGate devices, FortiSwitches, FortiAPs, and other Fortinet products. It provides long-term storage, compliance reporting, and advanced analytics such as event correlation and security fabric rating. Unlike local disk logging, FortiAnalyzer aggregates logs from many devices into a single repository, making it the correct choice for centralized log management.

Answer

Disk logging

Answer

FortiGuard

Answer

FortiCloud

Question 4

An administrator is configuring a FortiGate HA cluster and wants to ensure that the primary unit is always preferred based on its configuration priority. Which setting should be enabled to allow the primary unit to resume its role after a failover if it regains connectivity?

Accepted Answer

set override enable. The 'set override enable' setting allows the primary unit to resume its role after a failover if it regains connectivity, based on its configured priority. Without override, the cluster does not preempt; the current primary remains primary even if a higher-priority unit rejoins. Enabling override ensures the primary unit always takes back its role when available.

Answer

set ha-inherit-priority enable

Answer

set session-pickup enable

Answer

set ha-priority 255

Question 5

A FortiGate administrator receives an alert that the FortiGuard antivirus database on the firewall is outdated. Which subscription service must be active to update the antivirus signatures?

Accepted Answer

FortiGuard Antivirus Service. The FortiGuard Antivirus Service subscription is the specific entitlement that provides signature updates for the antivirus engine on a FortiGate. Without an active FortiGuard AV subscription, the FortiGate cannot download updated virus definition databases, which is exactly the alert described. Each FortiGuard subscription is licensed and updated independently, so only the AV service covers AV signature refresh.

Answer

FortiGuard IPS Service

Answer

FortiGuard Application Control Service

Answer

FortiGuard Web Filtering Service

Question 6

Which FortiGate diagnostic command allows you to capture packets on an interface for troubleshooting network connectivity issues?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command on a FortiGate captures packets on a specified interface, similar to tcpdump. It allows administrators to see live packet data for troubleshooting connectivity, filtering by interface, protocol, host, port, and verbosity level. This is the correct tool for packet-level capture.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

diagnose test application

Question 7

An administrator configures HA override on a cluster with priority 200 on primary and 100 on secondary. The primary fails, secondary takes over. When primary recovers, what happens?

Accepted Answer

Primary immediately takes over as active. With HA override enabled, the primary unit with higher priority (200) will preempt the secondary (100) once it recovers and rejoins the cluster. The primary immediately takes over as active because override allows a higher-priority unit to force a failback. This is the intended behavior of override in FortiGate HA.

Answer

Both units become active, causing a conflict

Answer

Secondary remains active until next failover

Answer

The administrator must manually trigger failback

Question 8

Which FortiGate log type records user authentication events, such as successful logins and failed login attempts?

Accepted Answer

Event logs. Event logs on a FortiGate record system-level activities including user authentication events such as successful logins, failed login attempts, and administrative actions. These logs are specifically designed to capture events that are not traffic-related, making them the correct choice for authentication events.

Answer

ZTNA logs

Answer

Traffic logs

Answer

Security logs

Question 9

An administrator wants to block upload of files containing credit card numbers via web forms. Which security profile should be used?

Accepted Answer

Data leak prevention (DLP) profile. Data Leak Prevention (DLP) profiles on FortiGate are specifically designed to inspect traffic content for sensitive data patterns such as credit card numbers, SSNs, and custom regex patterns, and to block or log based on those matches. Blocking uploads of files containing credit card numbers via web forms is a classic DLP use case because DLP can scan HTTP POST bodies and file contents. The DLP profile is applied to a firewall policy, where it inspects the matching traffic.

Answer

Antivirus profile

Answer

Web filter profile

Answer

Application control profile

Question 10

A FortiGate administrator needs to send logs to a FortiAnalyzer device for long-term storage and analysis. Which log configuration must be set up?

Accepted Answer

Add the FortiAnalyzer as a logging destination in Log Settings. To send logs to FortiAnalyzer, the administrator must add FortiAnalyzer as a logging destination in the FortiGate's Log Settings (under Log & Report > Log Settings or via CLI 'config log fortianalyzer setting'). This enables the FortiGate to forward logs to the FortiAnalyzer IP address for storage and analysis.

Answer

Configure an IPsec tunnel to FortiAnalyzer

Answer

Enable disk logging on the FortiGate

Answer

Configure syslog server pointing to FortiAnalyzer IP

Question 11

Which of the following is a benefit of using IKEv2 over IKEv1 for IPsec VPN?

Accepted Answer

IKEv2 is more robust to network changes and supports MOBIKE. IKEv2 is more robust to network changes because it supports the Mobility and Multihoming (MOBIKE) protocol, which allows an IPsec VPN tunnel to survive IP address changes without re-establishing the entire security association. This is a key advantage over IKEv1, which lacks native support for MOBIKE and requires a full rekey when the endpoint's IP address changes.

Answer

IKEv2 supports only main mode

Answer

IKEv2 requires fewer firewall rules

Answer

IKEv2 uses a single UDP port 500

Question 12

Which of the following best describes the function of FortiGuard web filtering categories?

Accepted Answer

They categorize websites to allow granular control over access based on content type. FortiGuard web filtering categories are pre-classified buckets (e.g., Social Networking, Malware, Phishing, Streaming Media) that map URLs/domains to content types. Administrators use these categories in web filter profiles to allow, block, monitor, or warn on entire classes of sites, giving granular, policy-driven control without maintaining manual URL lists. This is the core function of the FortiGuard category database.

Answer

They are used to quarantine infected files

Answer

They block specific IP addresses known for hosting malware

Answer

They provide a list of allowed websites only

Question 13

An administrator notices that traffic matching a firewall policy is not being logged. The policy has logging enabled. The FortiGate has local disk storage. What should the administrator check first?

Accepted Answer

The disk health and available space using 'diagnose sys disk' commands. When a FortiGate policy has logging enabled but logs are not appearing, and the device uses local disk storage, the first thing to check is whether the disk is healthy and has available space. FortiOS stops writing logs when the disk is full or failing, and 'diagnose sys disk' commands reveal disk health, usage, and log partition status. This is the most direct and common cause of missing local logs.

Answer

Whether the FortiGate has a valid FortiAnalyzer subscription

Answer

Whether FortiCloud logging is enabled

Answer

The log severity level on the policy

Question 14

After upgrading FortiOS, an IPsec VPN tunnel fails to come up. The diagnose output shows 'negotiation failed: no acceptable proposal'. The remote peer is a third-party device. Which step should you take first?

Accepted Answer

Check the phase1 and phase2 proposal settings on both ends to ensure they match. The 'no acceptable proposal' error indicates a mismatch in the Internet Key Exchange (IKE) parameters between the FortiGate and the remote peer. Since the remote peer is a third-party device, the most common cause is a misalignment in phase1 (IKE) or phase2 (IPsec) settings such as encryption algorithm, authentication method, Diffie-Hellman group, or lifetime. Option D is correct because verifying and aligning these proposals on both ends is the standard first step to resolve proposal mismatches.

Answer

Change the IKE version to IKEv2

Answer

Disable dead peer detection on the FortiGate

Answer

Reboot the remote peer

Question 15

An administrator attempts to configure a policy route to route specific traffic from an internal subnet (10.1.1.0/24) to the internet via a different ISP. The policy route is created but traffic is still using the default route. What is the most likely cause?

Accepted Answer

The outgoing interface in the policy route is down.. Policy routes in FortiGate have a higher priority than static routes, but they are only applied if the specified outgoing interface is operationally up. If the outgoing interface is down, the policy route is skipped, and traffic falls back to the default route. This is the most likely cause because the administrator confirmed the policy route was created but traffic still uses the default route.

Answer

The policy route is not using the correct source interface.

Answer

The destination address in the policy route is incorrect.

Answer

The static default route has a lower administrative distance than the policy route.