NSE4 Practice Exam 52 — 20 Questions

Question 1

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.. The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Answer

The session is an ICMP session with state 01 and expires in 1 second.

Answer

The session is a UDP session to port 443 and has been active for 3600 seconds.

Answer

The session is a TCP session that has timed out and will be removed in 3599 seconds.

Question 2

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

Accepted Answer

Verify the load-balancing algorithm for the aggregate interface. The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Answer

Check the LACP mode (active vs passive)

Answer

Increase the MTU on the aggregate interface

Answer

Ensure the physical ports are in the same VDOM

Question 3

An administrator configures a firewall policy with a schedule that allows traffic only during business hours (Monday to Friday, 09:00-18:00). At 17:55 on a Friday, a user establishes an SSH session that is still active at 18:05. What happens to the session when the schedule ends?

Accepted Answer

The session continues until it ends naturally. FortiGate firewall policies control the establishment of new sessions based on the schedule. Once a session is established, it is tracked in the session table and continues to be forwarded even if the schedule ends, until the session naturally terminates or times out. This behavior ensures that ongoing traffic is not abruptly disrupted when a schedule expires.

Answer

The session is immediately terminated at 18:00

Answer

The session is allowed but new sessions are blocked

Answer

The session is terminated after a 60-second grace period

Question 4

A FortiGate administrator is troubleshooting an SSL VPN connection issue. Users can connect but cannot access internal resources. The administrator checks the SSL VPN policy and confirms it allows access to the internal subnet. What should the administrator check next?

Accepted Answer

Verify that the firewall policy between the SSL VPN interface and the internal network allows the traffic. Even if the SSL VPN policy permits access to the internal subnet, traffic must still traverse a firewall policy from the SSL VPN interface (e.g., ssl.root) to the internal network interface. Without an explicit firewall policy allowing the traffic, the FortiGate will drop the packets, preventing resource access. This is a common oversight because the SSL VPN policy only controls tunnel establishment and route injection, not the actual forwarding of traffic between zones.

Answer

Check the routing table on the FortiGate for the internal subnet

Answer

Ensure the users have the correct client software installed

Answer

Check the FortiGate's DNS settings

Question 5

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The FortiGuard antivirus subscription has expired

Question 6

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 7

A FortiGate administrator wants to block access to Facebook for all internal users. However, the administrator must ensure that the CEO's computer (IP 10.0.0.100) is exempted. Which TWO steps should the administrator take? (Choose two.)

Accepted Answer

Create an application control profile with a rule to block 'Facebook' and apply it to the firewall policy for all users.. Option C is correct because the administrator must first create an application control profile containing a rule that blocks the Facebook application (Facebook is recognized as an application signature, not merely a URL), and then apply that profile to the firewall policy covering all internal users so the block is enforced. Option D is correct because FortiGate evaluates firewall policies top-down, so placing a policy above the blocking policy that permits traffic sourced from the CEO's IP 10.0.0.100 and does not reference the application control profile ensures the CEO's traffic is matched and allowed before the blocking policy is reached. Option A is incorrect because application control profiles in FortiOS do not provide an 'exempt IP' list; exemptions are achieved through policy ordering, not profile-level IP exceptions. Option B is incorrect for the same reason—there is no per-IP exemption setting inside an application control profile. Option E is incorrect because a web filter URL block for facebook.com would not reliably block the Facebook application (which can use multiple domains and non-HTTP traffic) and does not address the CEO exemption requirement.

Answer

Add the CEO's IP to the application control profile's 'exempt IP' list.

Answer

Configure an IP exemption in the application control profile.

Answer

Use a web filter profile with a URL block for 'facebook.com' instead of application control.

Question 8

An administrator is troubleshooting why an application control profile is not detecting a custom application that uses a non-standard port. The administrator wants to ensure the application is properly identified. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Add a custom application signature based on the traffic pattern. Option B is correct because application control can only identify a custom application on a non-standard port if a custom application signature is created that matches its traffic pattern, since the default signature database will not recognize it. Option D is correct because an application control profile only takes effect when it is attached to the firewall policy that handles the traffic; if it is applied to the wrong policy, the custom application will never be inspected or detected. Option E is correct because if the custom application's traffic is encrypted with SSL/TLS, the firewall cannot see the application-layer data needed for identification unless SSL deep inspection is enabled to decrypt and inspect it. Option A is incorrect because setting the action to 'block' only controls what happens after identification and does nothing to help the firewall recognize the application. Option C is incorrect because disabling flow-based inspection and using proxy-based only is not a required step for identifying a custom application and may not even be supported or desirable in all deployments.

Answer

Set the application control action to 'block' for the application

Answer

Disable flow-based inspection and use proxy-based only

Question 9

A FortiGate administrator is troubleshooting an issue where HTTPS traffic is not being properly inspected by the web filter. The policy has SSL inspection enabled. Which TWO commands would provide the most useful real-time debugging information? (Choose two.)

Accepted Answer

diagnose debug flow filter dport 443 ; diagnose debug flow show function-name ; diagnose debug enable. Option B is correct because the debug flow commands (diagnose debug flow filter dport 443, diagnose debug flow show function-name, diagnose debug enable) provide real-time packet-path tracing that shows whether the HTTPS session is being matched to the firewall policy and whether SSL inspection is applied, which is essential for troubleshooting web-filter inspection issues. Option E is correct because diagnose sniffer packet any 'port 443' 4 captures live packets on port 443 with interface information, allowing the administrator to verify that HTTPS traffic is actually reaching the FortiGate and to observe the handshake behavior in real time. Option A is not appropriate because diagnose test application ips 1 only tests IPS engine operation and does not trace HTTPS web-filter or SSL-inspection processing. Option C is not the best choice because diagnose sys session filter dport 443 with diagnose sys session list only shows the session table entries and does not provide real-time debugging of the inspection path. Option D is not suitable because execute log display only shows already-generated log entries and does not deliver live debugging information.

Answer

diagnose test application ips 1

Answer

diagnose sys session filter dport 443 ; diagnose sys session list

Answer

execute log display

Question 10

A FortiGate administrator is troubleshooting an issue where a user receives a certificate error when accessing a web server. The administrator has configured SSL deep inspection with a custom CA certificate. The error indicates the certificate is not trusted. Which THREE actions could resolve this issue? (Choose three.)

Accepted Answer

Install the FortiGate's CA certificate on the client devices.. Option A is correct because with SSL deep inspection the FortiGate re-signs the server certificate using its custom CA, so that CA certificate must be imported into the client's trust store (e.g., Windows Certificate Manager or browser trust store) for the re-signed certificate to validate without an untrusted-CA error. Option D is correct because switching the profile to certificate-inspection means the FortiGate only inspects the certificate metadata (SNI, CN, validity) and does not re-sign the server certificate, so the client sees the original, publicly trusted server certificate and no trust error occurs. Option E is correct because adding the web server to the SSL exemption list in the inspection profile bypasses deep inspection for that destination, again letting the client receive the original trusted certificate. Option B is not the intended fix because disabling SSL inspection entirely removes security inspection rather than resolving the trust problem while preserving inspection. Option C is not relevant because a firmware update does not make the client trust the FortiGate's custom CA certificate or change the re-signing behavior.

Answer

Disable SSL inspection on the firewall policy entirely.

Answer

Update the FortiGate firmware to the latest version.

Question 11

A FortiGate administrator is troubleshooting why traffic from a specific source IP is not being logged. The traffic is allowed by a firewall policy with logging enabled. Which TWO commands could the administrator use to verify if the traffic is hitting the expected policy? (Choose two.)

Accepted Answer

diagnose debug flow. Option B (diagnose debug flow) is correct because it traces a packet through the FortiGate's inspection path, showing which firewall policy matches the traffic and whether it is allowed or denied, which directly verifies if the source IP hits the expected policy. Option D (diagnose sys session filter src 10.0.0.1) is correct because it filters the session table by the source IP so the administrator can run 'diagnose sys session list' and confirm the session was created and which policy ID it matched. Option A (get system performance status) only shows CPU, memory, and uptime statistics and provides no policy-matching information. Option C (diagnose sniffer packet any 'host 10.0.0.1') captures raw packets but does not reveal which firewall policy processed them. Option E (diagnose debug application fnbamd) debugs the Fortinet non-blocking authentication daemon, which is unrelated to firewall policy matching for this traffic.

Answer

get system performance status

Answer

diagnose sniffer packet any 'host 10.0.0.1'

Answer

diagnose debug application fnbamd

Question 12

An administrator needs to ensure that all HTTPS traffic to a critical server is inspected by the IPS. The server uses a valid certificate from a public CA. Which THREE steps are required to achieve this?

Accepted Answer

Apply an IPS profile to the same firewall policy. Option D is correct because SSL deep inspection must be enabled on the firewall policy so the FortiGate decrypts the HTTPS session and can pass the plaintext to the IPS engine; without it, the IPS only sees encrypted traffic. Option A is correct because the IPS profile must be attached to that same firewall policy that carries the inspected traffic, otherwise the decrypted stream is never scanned by the IPS sensors. Option C is correct because deep inspection causes the FortiGate to re-sign the server's certificate with its own CA (the FortiGate's local/protection CA), so client browsers must trust that CA certificate to avoid certificate warnings and failed connections. Option B is wrong because 'Deep Inspection' is a setting of the SSL/SSH inspection profile, not the Antivirus profile, and antivirus is not what performs IPS inspection. Option E is wrong because the server already presents a valid public CA certificate; the FortiGate does not need the server's certificate uploaded to perform deep inspection.

Answer

Set the Antivirus profile to 'Deep Inspection'

Answer

Upload the server's certificate to the FortiGate

Question 13

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Accepted Answer

The performance SLA for jitter is not configured, only latency.. The SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Answer

The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Answer

The LTE link has a higher cost and is not considered for failover.

Answer

The fiber link has a higher interface weight.

Question 14

A FortiGate administrator needs to ensure that all outbound DNS queries from internal clients are inspected for malicious domains. The administrator has a DNS filter profile configured. What additional configuration is required on the firewall policy to make the DNS filter effective?

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic (UDP/TCP port 53). A DNS filter profile must be explicitly applied to a firewall policy that matches DNS traffic (UDP/TCP port 53) to be effective. Without this association, the FortiGate will not inspect DNS queries against the configured DNS filter profile, even if the profile is defined globally or under Security Profiles.

Answer

Enable SSL deep inspection on the policy

Answer

Configure FortiGuard DNS filtering service on the FortiGate

Answer

Set the inspection mode to proxy-based

Question 15

A FortiGate administrator wants to block all traffic to a known malicious IP address range using the Intrusion Prevention System (IPS). Which IPS configuration method is most appropriate?

Accepted Answer

Create a custom IPS signature that matches the IP range. FortiGate's IPS allows administrators to create custom signatures that can match specific IP addresses or ranges using the 'source-ip' or 'destination-ip' filter criteria. This is the most direct and precise method to block traffic to a known malicious IP range, as predefined signatures typically target application-layer vulnerabilities or exploit patterns, not arbitrary IP addresses.

Answer

Use a predefined IPS signature for known malicious IPs

Answer

Configure an IPS anomaly detection rule to block the IP range

Answer

Use a local IPS signature database

Question 16

An administrator needs to configure a firewall policy that allows internal users to access a specific web server on the internet using its domain name. The web server's IP address may change. Which type of address object should be used as the destination in the policy?

Accepted Answer

FQDN address object. An FQDN (Fully Qualified Domain Name) address object allows the firewall to resolve the domain name to an IP address dynamically. This is essential when the web server's IP address may change, as the firewall will periodically perform DNS resolution to update the destination IP in the policy, ensuring continuous access without manual reconfiguration.

Answer

IP Range object that covers the entire public IP space

Answer

Subnet object with the current IP address

Answer

Geography object

Question 17

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

Accepted Answer

Central SNAT overrides policy-based NAT. Central SNAT (Source NAT) is a centralized NAT policy that takes precedence over policy-based NAT rules when both are configured for the same traffic. In FortiGate, Central SNAT is evaluated before policy-based NAT, and if a matching Central SNAT rule exists, it will override any policy-based NAT configuration. This is by design to provide a more predictable and manageable NAT architecture.

Answer

Both NAT methods are applied, causing double NAT

Answer

The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict

Answer

Policy-based NAT always overrides Central SNAT

Question 18

What is the purpose of the DNS filter security profile on a FortiGate?

Accepted Answer

To block DNS queries to known malicious domains. The DNS filter security profile on a FortiGate is designed to block DNS queries to known malicious domains by comparing the domain names in DNS requests against a regularly updated database of malicious or categorized domains. This prevents users from resolving domains associated with malware, phishing, or command-and-control servers, thereby stopping threats before an IP connection is even established.

Answer

To inspect DNS traffic for virus signatures

Answer

To filter spam emails based on DNS blacklists

Answer

To prevent DNS tunneling attacks

Question 19

An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?

Accepted Answer

A RADIUS server object with IP address and shared secret. Option B is correct because configuring RADIUS authentication on a FortiGate requires creating a RADIUS server object under User & Authentication > RADIUS Servers, which must include the server's IP address and the shared secret used to encrypt the RADIUS exchange (typically over UDP ports 1812/1813). Option D is correct because the RADIUS server object alone does not enforce authentication; you must create a user group that references the RADIUS server so it can be applied in firewall identity-based policies or SSL-VPN/LDAP-style authentication rules. Option A is not required because PKI certificates are only needed for EAP/TLS-based RADIUS or LDAPS scenarios, not basic RADIUS shared-secret authentication. Option C is not required because FSSO is a separate agent-based single sign-on mechanism, not a prerequisite for RADIUS. Option E is not required because RADIUS users are authenticated against the external RADIUS database, not against local FortiGate accounts.

Answer

A PKI certificate for the RADIUS server

Answer

An FSSO connector

Answer

A local user account for each RADIUS user

Question 20

An administrator runs 'diagnose debug flow' for a specific policy and sees the following output:
id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet'
What does this indicate?

Accepted Answer

The destination IP address has no matching route in the routing table. The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

Answer

The packet is being blocked by a firewall policy

Answer

The source interface is down

Answer

The session table is full