NSE4 Practice Exam 51 — 20 Questions

Question 1

A FortiGate administrator is configuring an SSL VPN web mode portal. The administrator wants users to access only a specific internal web application (https://internal-app.company.local) and nothing else. Which SSL VPN setting should be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Under the SSL VPN portal, configure 'URL Access' to allow only https://internal-app.company.local. The 'URL Access' setting in the SSL VPN web mode portal allows the administrator to explicitly define which URLs users can access through the portal. By configuring an allow list with only https://internal-app.company.local, users are restricted to that specific internal web application, and all other URLs are blocked. This provides granular control over web-based resources in the SSL VPN portal without relying on network-layer restrictions.

Answer

In the SSL VPN portal, set the default bookmark to the application URL

Answer

Configure a firewall policy that allows traffic only to the application's IP address

Answer

Enable split tunneling under the SSL VPN settings

Question 2

An administrator configures a firewall policy with source address 'internal_net' (10.0.0.0/16) and destination address 'server_farm' (10.10.10.0/24). The action is set to ACCEPT with NAT enabled. However, traffic from 10.0.1.100 to 10.10.10.50 is being denied. What is the most likely cause?

Accepted Answer

There is a deny policy above this policy that matches the traffic. The most likely cause is that a deny policy with a higher priority (lower sequence number) exists above the ACCEPT policy in the firewall policy list. FortiGate evaluates policies sequentially from top to bottom, and the first matching policy determines the action. If a deny policy matches the traffic (source 10.0.1.100, destination 10.10.10.50) before the ACCEPT policy is reached, the traffic will be denied regardless of the ACCEPT policy below it.

Answer

The destination address 'server_farm' does not include 10.10.10.50

Answer

The NAT translation is causing the traffic to be dropped

Answer

The source address 'internal_net' does not include 10.0.1.100

Question 3

An administrator runs 'diagnose ips anomaly list' and sees many 'tcp_syn_flood' entries. The IPS profile has anomaly detection enabled with action 'pass'. The administrator wants to block such attacks. What change is required?

Accepted Answer

Change the action for the anomaly from 'pass' to 'block'. The 'pass' action in the IPS anomaly detection configuration instructs the FortiGate to only log the detected anomaly without taking any blocking action. Changing the action to 'block' ensures that when the 'tcp_syn_flood' anomaly is detected, the FortiGate will actively drop the offending packets, thereby mitigating the SYN flood attack.

Answer

Increase the threshold for the anomaly

Answer

Enable flow-based inspection on the policy

Answer

Add a DoS policy from the same source

Question 4

Which statement best describes the 'implicit deny' policy on a FortiGate?

Accepted Answer

It is automatically applied to all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a built-in, last-resort rule that automatically denies any traffic not matching an explicit firewall policy. It is not visible in the policy list and cannot be moved, modified, or deleted; it is always applied as the final rule to ensure that only explicitly permitted traffic is allowed through the FortiGate.

Answer

It can be moved to a different position in the policy list

Answer

It is a configurable policy that denies all traffic

Answer

It logs all denied traffic by default

Question 5

A FortiGate in NAT/Route mode has multiple internal networks. The administrator wants to configure a loopback interface for management access. Which THREE statements about loopback interfaces are correct? (Choose three.)

Accepted Answer

The loopback interface is always up regardless of physical link status. Option B is correct because a FortiGate loopback interface is a logical interface with no dependency on any physical link, so its operational state remains up even if physical ports go down. Option C is correct because the loopback's stable IP address is commonly configured as the source-ip for management protocols such as HTTPS, SSH, SNMP, and syslog, ensuring consistent management reachability. Option E is correct because loopback interfaces can be included in routing protocol configurations (for example, OSPF or BGP) and advertised as a stable router ID or network, which is a standard design practice. Option A is wrong because a loopback is a logical interface that is not bound to a physical port. Option D is wrong because loopback interfaces can absolutely be referenced in firewall policies as source or destination interfaces.

Answer

The loopback interface must be assigned to a physical port

Answer

The loopback interface cannot be used for firewall policies

Question 6

An administrator needs to allow inbound SSH access from the internet to a specific internal server (10.0.1.10) on port 22. The WAN IP is 203.0.113.10. Which THREE configuration steps are required?

Accepted Answer

Ensure the firewall policy allows the SSH service (port 22). Option D is correct because a Virtual IP (VIP) performs destination NAT (DNAT), mapping the public WAN address 203.0.113.10 on port 22 to the internal server 10.0.1.10 on port 22, which is the essential first step to make the internal host reachable from the internet. Option B is correct because a firewall policy must be created with the incoming interface as WAN and the outgoing interface as the internal/LAN interface, with the destination set to that VIP object, so the firewall permits and forwards the translated traffic to the server. Option A is correct because the policy must explicitly allow the SSH service on TCP port 22, since inbound traffic is denied by default and the service must be matched in the policy for the connection to be accepted. Option C is incorrect because a source NAT IP pool applies to outbound traffic (masquerading internal clients behind a public address) and is irrelevant to publishing an internal server for inbound SSH. Option E is incorrect because SSL inspection applies to TLS/HTTPS traffic and cannot inspect SSH, which is not an SSL/TLS protocol, so enabling it would not enable or secure this inbound SSH access.

Answer

Configure a source NAT IP pool for outbound traffic

Answer

Enable SSL inspection on the policy

Question 7

An administrator is configuring SNMP on a FortiGate for monitoring. Which THREE items are required for SNMPv3 configuration?

Accepted Answer

Security level (authPriv or authNoPriv). For SNMPv3 on a FortiGate, the security level (Option A) must be specified because SNMPv3 defines whether messages are authenticated only (authNoPriv) or both authenticated and encrypted (authPriv), which directly determines the security mechanisms applied to the user. Option B is required because SNMPv3 authentication uses a hash protocol such as SHA (or MD5) and privacy uses an encryption protocol such as AES (or DES); these protocol selections must be configured alongside the passwords to build the user's security parameters. Option E is required because SNMPv3 is user-based rather than community-based, so an SNMP user must be created with a username and authentication password (and, when authPriv is used, a privacy password) before the FortiGate can respond to SNMPv3 queries. Option C is not required for basic SNMPv3 configuration because views are optional MIB access restrictions, not mandatory parameters for creating an SNMPv3 user. Option D is incorrect because community strings apply to SNMPv1 and SNMPv2c, not to SNMPv3, which replaces communities with users and security levels.

Answer

SNMP view definition for the user

Answer

SNMP community string (read-only or read-write)

Question 8

A FortiGate admin is troubleshooting an issue where traffic from VLAN 10 to the internet is not being NATed even though a policy-based NAT rule is configured. The admin verifies that the firewall policy uses the correct IP Pool. Which THREE steps should the admin take to diagnose the problem? (Choose three.)

Accepted Answer

Examine the IP Pool configuration for correct interface binding or port exhaustion. Option B is correct because an IP Pool must be bound to the correct egress interface and must have available ports/addresses; if the pool is bound to the wrong interface or its ports are exhausted, NAT translation will not occur even though the policy references the pool. Option C is correct because the admin must confirm the policy is actually matching the traffic, which can be done with 'diagnose firewall fwpolicy list' or by reviewing policy logs; if the policy is not hit, NAT will never be applied. Option D is correct because 'diagnose sys session list' shows the live session table and whether NAT is applied, including the translated source IP and port, which directly reveals if NAT is failing. Option A is not appropriate because rebooting is disruptive and does not diagnose the root cause of a NAT failure. Option E is not appropriate because disabling all other policies is a risky, non-diagnostic action that could cause an outage and does not isolate the NAT issue in a controlled way.

Answer

Reboot the FortiGate to clear any session table issues

Answer

Disable all other firewall policies to isolate the issue

Question 9

An administrator configures a route-based IPsec VPN between two FortiGates. The Phase 1 and Phase 2 are up. The administrator adds a static route on each FortiGate pointing to the remote subnet via the virtual tunnel interface (e.g., 'to_remote'). Traffic between the subnets fails. What is the MOST likely missing configuration?

Accepted Answer

A firewall policy is required to permit traffic between the interfaces. In a route-based IPsec VPN, even when Phase 1 and Phase 2 are up and a static route exists via the virtual tunnel interface, traffic will still be dropped unless a firewall policy explicitly permits it. FortiGate uses a stateful firewall, so a policy must allow traffic from the local interface to the tunnel interface (or vice versa) to forward packets. Without this policy, the FortiGate will not forward traffic between the subnets, even though the tunnel is established.

Answer

NAT must be disabled on the tunnel interface

Answer

The tunnel interface must be added to a zone

Answer

The Phase 2 proposal must include the correct local and remote subnets

Question 10

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

Accepted Answer

The secondary unit detects loss of heartbeat from the primary and takes over. In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Answer

The administrator must manually reboot the secondary unit

Answer

The secondary unit becomes active only if the heartbeat link is also down

Answer

The secondary unit waits for a configuration change before becoming active

Question 11

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover

Question 12

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

Question 13

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

Accepted Answer

The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy. The FQDN object in a policy above the allow policy resolved to an IP that includes 203.0.113.5. FortiGate performs policy lookup based on cached IP addresses for FQDN objects. Since the FQDN object's cached IP now matches the destination IP of the website, traffic hits the higher-priority policy (which likely denies or otherwise blocks the traffic) before reaching the allow policy. This is why users cannot access the website despite the allow policy existing.

Answer

The destination NAT on the allow policy is misconfigured

Answer

The FortiGate's DNS server is not resolving the FQDN correctly

Answer

The antivirus profile on the allow policy is blocking the website

Question 14

What is the primary purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To provide a stable IP address for management and routing protocols. A loopback interface on a FortiGate is a virtual interface that is always up, independent of physical link states. It provides a stable and reachable IP address for management access (e.g., HTTPS, SSH) and for routing protocols like OSPF or BGP to use as the router ID or source interface, ensuring consistent connectivity even if physical interfaces fail.

Answer

To aggregate bandwidth from multiple physical interfaces

Answer

To enable NAT for internal networks

Answer

To increase the number of available physical ports

Question 15

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

Accepted Answer

Enable the specific IPS signature for the exploit in the sensor.. The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Answer

Set the IPS sensor severity filter to 'low' and above.

Answer

Change the IPS sensor action from 'default' to 'block' for all signatures.

Answer

Create a custom IPS signature for the exploit.

Question 16

An administrator is troubleshooting a FortiGate that is not sending logs to FortiCloud. The FortiGate has internet connectivity and a valid FortiCloud subscription. Which THREE steps should the administrator take to resolve this issue? (Select three.)

Accepted Answer

Ensure that the log types (traffic, event, security) are enabled for FortiCloud. Option A is correct because FortiCloud log forwarding only transmits the log categories that are explicitly enabled under Log & Report > Log Settings > FortiCloud, so traffic, event, and security logs must each be turned on for them to be uploaded. Option B is correct because the dashboard FortiCloud widget shows the registration/entitlement status and whether the FortiGate is successfully connected to FortiCloud, which is the fastest way to confirm the subscription is actually active on the device. Option C is correct because the FortiGate must resolve the FortiCloud FQDN (for example, the service endpoint such as fortigate.forticloud.com or the region-specific logging endpoint) via DNS; if name resolution fails, logs cannot be sent even with working internet and a valid subscription. Option D is incorrect because increasing the log buffer size only affects local disk/memory log retention and does not fix FortiCloud delivery. Option E is incorrect because disabling an antivirus profile has no bearing on log transmission and would only weaken security.

Answer

Increase the log buffer size

Answer

Disable the antivirus profile temporarily

Question 17

An administrator needs to configure HA on a pair of FortiGates with the following requirements: the cluster must support session failover for TCP, UDP, and ICMP; the management interface should be accessible on both units; and the failover must be triggered if port2 goes down. Which TWO settings must be configured? (Choose two.)

Accepted Answer

Enable session pickup. Option A (Enable session pickup) is correct because session pickup is the FortiGate HA setting that synchronizes session state tables across cluster members, which is exactly what enables TCP, UDP, and ICMP sessions to survive a failover to the other unit. Option C (Add port2 to the monitored interfaces) is correct because HA monitors only the interfaces explicitly listed in the monitored-interface configuration; adding port2 ensures that if that link goes down, the unit's HA priority is reduced or it fails over as required. Option B is not required because the requirement is that the management interface be reachable on both units, which is achieved by allowing management access on the HA interfaces or via reserved management interfaces, not by a mandatory dedicated management interface setting. Option D is not required because session failover and interface monitoring work in both active-passive and active-active modes, so the mode does not have to be active-passive. Option E is not required because override only controls whether a unit with higher priority preempts the primary after it recovers; it is not needed to trigger failover on a link-down event.

Answer

Configure a dedicated management interface

Answer

Set the HA mode to active-passive

Answer

Set the HA override to enabled

Question 18

A FortiGate is configured with two equal-cost static routes to the same destination network (0.0.0.0/0) via two different ISPs. The administrator wants to use both links simultaneously for load balancing. What must be enabled?

Accepted Answer

ECMP (Equal Cost Multi-Path) routing. Equal Cost Multi-Path (ECMP) routing is the correct feature to enable because it allows a FortiGate to load-balance traffic across multiple static routes that have the same metric (distance) to the same destination (0.0.0.0/0). By default, FortiGate uses a single best route; enabling ECMP distributes sessions across both ISP links based on a hash algorithm (e.g., source-destination IP), achieving simultaneous utilization without requiring dynamic routing protocols.

Answer

SD-WAN

Answer

Link load balancing

Answer

Policy routing

Question 19

An organization has two FortiGate units in an HA cluster. They need to perform a firmware upgrade on the primary unit without causing a failover. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a graceful failover, then upgrade the original primary. In an HA cluster, upgrading the secondary unit first ensures that the primary remains active and can take over if the upgrade fails. After the secondary is upgraded and stable, a graceful failover is performed to make it the new primary, allowing the original primary to be upgraded without causing an unplanned failover or service interruption.

Answer

Upgrade the primary unit first, then the secondary will automatically synchronize

Answer

Upgrade both units simultaneously using the GUI

Answer

Disable HA, upgrade both, then re-enable HA

Question 20

A FortiGate administrator is upgrading firmware from version 6.0 to 7.0. The upgrade path requires multiple steps. Which of the following is the recommended method to ensure a successful upgrade?

Accepted Answer

Upgrade to 6.2, then to 6.4, then to 7.0, following the official upgrade path. FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

Answer

Perform a factory reset after upgrading to 7.0

Answer

Use the 'execute upgrade-version' command to automatically determine the path

Answer

Upload and install the 7.0 firmware directly, then restore configuration from backup