NSE4 Practice Exam 53 — 20 Questions

Question 1

A network admin wants to block all traffic from the BitTorrent application. The admin has enabled application control on the firewall policy. Which step is necessary to achieve this?

Accepted Answer

Add the BitTorrent application signature to the application control profile and set action to block. To block BitTorrent traffic, the admin must add the BitTorrent application signature to the application control profile and set the action to block (option B). Application control can detect BitTorrent even though it uses proprietary encryption—FortiGate uses protocol decoders and signature matching on unencrypted handshake data. SSL deep inspection (option E) is not required because BitTorrent does not use SSL/TLS encryption; enabling deep inspection would not help and would add unnecessary overhead. Options A, C, and D are also unnecessary: DNS filter does not block the application itself, proxy-based inspection is not mandatory, and deep inspection (in the profile) is not the correct setting.

Answer

Add a DNS filter profile to block BitTorrent tracker domains

Answer

Set the application control inspection mode to proxy-based

Answer

Enable 'deep inspection' in the application control profile

Answer

Enable SSL deep inspection on the firewall policy

Question 2

An administrator needs to configure a firewall policy to allow outbound traffic from the internal network to the internet. The internal network uses private IP addresses, and the administrator wants to hide these addresses from the internet. Which NAT configuration should be applied to the policy?

Accepted Answer

Enable NAT and use the outgoing interface address.. For outbound traffic from a private network to the internet, source NAT (SNAT) is required to translate private IP addresses to a public IP address. The most common and straightforward method on a FortiGate is to enable NAT on the firewall policy and use the outgoing interface address. This translates all internal addresses to the IP of the FortiGate's external interface, allowing return traffic to be routed back.

Answer

Disable NAT and rely on the FortiGate to route private IPs.

Answer

Enable NAT and use a central NAT table with a specific IP pool.

Answer

Enable NAT and use a fixed port range for source translation.

Question 3

A FortiGate administrator is configuring a dial-up IPsec VPN for remote users. The users will connect from various locations with dynamic public IP addresses. The administrator wants to ensure that the VPN is secure and that only authorized users can connect. Which two Phase 1 configuration settings are required to support this scenario? (Choose two.)

Accepted Answer

Set the 'Remote Gateway' to 'Dialup User'.. For a dial-up IPsec VPN with dynamic user IPs, the remote gateway must be set to 'Dialup User' to accept connections from any IP. To authenticate individual users, XAUTH must be enabled, which prompts for username and password after the tunnel is established. These two settings ensure that the VPN can handle dynamic IPs and enforce user authentication. Other settings like Aggressive mode or NAT Traversal may be used but are not required for all scenarios.

Answer

Set the 'Remote Gateway' to the specific IP address of each user.

Answer

Configure 'Aggressive' mode for Phase 1.

Answer

Enable 'NAT Traversal' in Phase 1 settings.

Question 4

A FortiGate is configured in an active-passive HA cluster. The administrator wants to verify which unit is currently the primary and also see the HA uptime and priority of each unit. Which command should the administrator use?

Accepted Answer

get system ha status. The command 'get system ha status' is the correct way to view the current HA status on a FortiGate. It shows which unit is the primary, the HA uptime, and the priority of each cluster member. This directly answers the administrator's need to verify the active unit and its attributes in an active-passive cluster.

Answer

diagnose sys ha status

Answer

show system ha

Answer

diagnose sys ha dump

Question 5

A FortiGate administrator has enabled central NAT (policy-based NAT) in the VDOM. They need to translate all outbound traffic from the internal subnet 192.168.1.0/24 to the FortiGate's WAN interface IP when it leaves the network. Where must the NAT configuration be referenced in the firewall policy?

Accepted Answer

Create a central SNAT rule that matches the source subnet and outgoing interface, and ensure the firewall policy has no NAT configuration.. When central NAT is enabled, the FortiGate uses central SNAT rules instead of per-policy NAT. The firewall policy references the central SNAT rule implicitly by matching traffic; the policy itself must not have NAT enabled. The central SNAT rule defines the source and destination criteria and the translation. This separation simplifies management and avoids conflicting NAT configurations.

Answer

Enable NAT in the firewall policy and select the central SNAT rule from the NAT dropdown.

Answer

Create an IP pool with the WAN IP and apply it as the NAT IP in the firewall policy, then disable central NAT.

Answer

Configure a virtual IP (VIP) for the internal subnet and reference it in the firewall policy as the source.

Question 6

A FortiGate is configured as an SSL VPN server with tunnel mode. Remote users authenticate successfully, but after connecting they cannot reach any internal subnet. The administrator verifies that the SSL VPN firewall policy allows the tunnel interface and that the internal routes exist. Which SSL VPN configuration setting must be checked next to ensure that the correct routes are pushed to the clients?

Accepted Answer

Configure the 'Routing Address' in the SSL VPN portal to include the internal subnets.. In SSL VPN tunnel mode, the FortiGate pushes routes to the client based on the 'Routing Address' defined in the SSL VPN portal. If this setting is empty or does not include the internal subnets, the client will not have routes for those networks, even though the tunnel is up and the firewall policy permits traffic. Verifying and correcting the Routing Address is the direct solution.

Answer

Enable 'client-certificate' authentication in the SSL VPN settings.

Answer

Set the SSL VPN to use 'web mode' instead of 'tunnel mode'.

Answer

Enable 'split-tunneling' in the SSL VPN portal settings.

Question 7

An administrator applies an application control profile to a firewall policy that allows outbound traffic. Users report that a specific business-critical application, which uses TLS on port 443, is now being blocked even though the application is not listed as blocked in the profile. The administrator wants to allow this application while still controlling other applications. What is the most likely reason the application is being blocked?

Accepted Answer

The application control profile is configured to block all applications that are not explicitly allowed.. The correct answer is that the application control profile is configured to block all applications that are not explicitly allowed. In FortiGate application control, each category and application can have an action, and there is a default action for applications not explicitly listed. If the default action is set to block, any application not in the allow list will be blocked, even if it is not explicitly blocked. The administrator should either add the application to the allow list or change the default action to allow.

Answer

The firewall policy is using flow-based inspection, which cannot identify applications on port 443.

Answer

The application is being blocked by a separate IPS sensor that is applied to the same firewall policy.

Answer

The application control profile requires an SSL inspection profile to detect applications on port 443, and none is applied.

Question 8

A FortiGate administrator wants to block access to a list of known malicious websites. The list is updated frequently by a third-party threat intelligence feed. Which FortiGate feature should the administrator use to dynamically block these sites without manual intervention?

Accepted Answer

External threat feed connector. External threat feed connectors enable the FortiGate to ingest blocklists from external sources and use them in policies. They support automatic updates, so the administrator does not need to manually maintain the list. This is the correct feature for dynamically blocking sites from a third-party threat intelligence feed.

Answer

Static URL filter

Answer

DNS filter

Answer

FortiGuard web filter category

Question 9

A FortiGate is deployed at a branch office with a single WAN link. The administrator wants to ensure that the FortiGate itself can resolve external hostnames for features like FortiGuard lookups, but does not want internal clients to use the FortiGate as their DNS server. Which configuration should the administrator apply?

Accepted Answer

Configure DNS servers under System > DNS on the FortiGate, and leave the internal interface DNS settings unchanged.. The FortiGate needs its own DNS settings for system lookups, which are configured under System > DNS. This does not affect clients unless the interface DNS server feature is enabled or DHCP hands out the FortiGate as a DNS server. Leaving the internal interface DNS settings unchanged ensures clients continue using their own DNS servers.

Answer

Configure a DNS filter profile on the outbound firewall policy and set the FortiGate as the primary DNS in the DHCP server.

Answer

Set the FortiGate as a DNS forwarder under Network > DNS Servers and configure a firewall policy to allow DNS.

Answer

Enable DNS server on the internal interface and set the same DNS servers in the DHCP scope.

Question 10

A FortiGate is configured with two VDOMs: root and vdom1. The administrator wants to allow a server in vdom1 to be accessible from the internet via a virtual IP (VIP) configured in the root VDOM. Which configuration is required to achieve this?

Accepted Answer

Create inter-VDOM links between root and vdom1, and configure firewall policies to allow traffic.. To allow a server in one VDOM to be accessible via a VIP in another VDOM, inter-VDOM links must be configured to route traffic between them. Firewall policies on both VDOMs are also required to permit the traffic. This ensures that the VIP in the root VDOM can forward traffic to the server in vdom1, and return traffic can flow back.

Answer

Enable asymmetric routing on both VDOMs and disable session helpers.

Answer

Assign the same interface to both VDOMs and enable VDOM sharing.

Answer

Configure a static route in vdom1 pointing to the root VDOM's VIP as the gateway.

Question 11

A network administrator is configuring a site-to-site IPsec VPN between two FortiGates. Phase 1 and Phase 2 are both up, but traffic is not passing through the tunnel. The administrator runs 'diagnose debug flow' and sees that packets are being dropped with the message 'iprope_in_check() check failed, drop'. Which configuration change is most likely to resolve this issue?

Accepted Answer

Add a firewall policy that allows traffic from the local subnet to the remote subnet through the IPsec tunnel.. The error 'iprope_in_check() check failed, drop' is generated by the FortiGate when a packet is denied by a firewall policy. For IPsec VPN traffic to pass, a firewall policy must allow traffic from the local subnet to the remote subnet, with the correct source and destination interfaces. Even if Phase 1 and Phase 2 are up, without this policy, the FortiGate will drop the packets. The administrator should verify that the policy exists and is correctly ordered.

Answer

Modify the Phase 2 selector to match the remote subnet.

Answer

Configure a static route for the remote subnet pointing to the IPsec tunnel interface.

Answer

Enable 'auto-negotiate' in Phase 2 settings to allow dynamic routing.

Question 12

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network to the DMZ. The internal network is 10.0.0.0/24 and the DMZ network is 172.16.0.0/24. Which source and destination address objects should be used in the policy?

Accepted Answer

Source: 10.0.0.0/24, Destination: 172.16.0.0/24. The firewall policy must match the specific source and destination networks to allow only the desired traffic. Using the internal subnet as source and DMZ subnet as destination creates a precise policy. Other combinations either reverse the direction or are too permissive, failing to meet the requirement.

Answer

Source: 172.16.0.0/24, Destination: 10.0.0.0/24

Answer

Source: all, Destination: all

Answer

Source: 10.0.0.0/24, Destination: all

Question 13

An administrator is configuring a firewall policy to allow web traffic from the internal network to the internet. They want to apply security profiles and ensure that only HTTP and HTTPS are allowed. Which two actions are required in the firewall policy configuration? (Choose two.)

Accepted Answer

Attach at least one security profile, such as an antivirus or web filter profile.. To allow only HTTP and HTTPS with security profiles, the policy must specify those services and have at least one security profile attached. These two actions ensure the traffic is limited to web protocols and inspected. NAT and logging are optional depending on network design and policy, and application control is a specific profile that may not be required.

Answer

Enable NAT in the policy to translate internal IPs to the outgoing interface address.

Answer

Attach an application control profile to the policy.

Answer

Enable logging of all sessions.

Question 14

A security administrator is configuring an IPS sensor on a FortiGate to protect a web server. The sensor includes a signature that detects a specific HTTP exploit. The administrator wants to ensure that the signature blocks the attack but also generates a log entry for each detection. Which action should be taken for that signature in the IPS sensor?

Accepted Answer

Set the action to 'Block' and enable 'Logging' for the signature.. In a FortiGate IPS sensor, the 'Block' action drops packets matching the signature, preventing the exploit from reaching the server. Enabling 'Logging' for that signature ensures an event is recorded each time the signature is triggered. This combination satisfies both the blocking and logging requirements without unnecessary packet capture or connection resets.

Answer

Set the action to 'Reset' and enable 'Logging'.

Answer

Set the action to 'Monitor' and enable 'Packet Logging'.

Answer

Set the action to 'Block' and enable 'Packet Logging'.

Question 15

A FortiGate administrator needs to check the current HA status of a two-unit cluster. The administrator wants to see which unit is the primary, the HA mode, and the uptime of each unit. Which command should the administrator use?

Accepted Answer

diagnose sys ha status. To view the current HA status, including which unit is primary, the HA mode, and uptime, the administrator should use 'diagnose sys ha status'. This command provides a comprehensive overview of the cluster's operational state and is the standard tool for HA monitoring and troubleshooting.

Answer

show system ha

Answer

diagnose sys ha checksum

Answer

get system ha status

Question 16

A FortiGate administrator is configuring a new VLAN interface on a managed FortiSwitch. The FortiGate is the FortiLink parent. The administrator wants to ensure that the VLAN is properly recognized and that traffic can flow between the FortiGate and devices on that VLAN. Which two actions must the administrator perform? (Choose two.)

Accepted Answer

Configure the VLAN on the FortiSwitch using the FortiGate GUI or CLI, assigning it to the desired ports.. For a VLAN to function on a FortiLink-managed FortiSwitch, the FortiGate must have a VLAN interface with the matching VLAN ID bound to the FortiLink interface, and the FortiSwitch must have the VLAN configured on the appropriate ports. These two steps ensure the VLAN is recognized and traffic can flow. Other options are either optional security features or unnecessary configuration steps.

Answer

Enable DHCP snooping on the FortiGate for the VLAN to prevent rogue DHCP servers.

Answer

Set the FortiLink interface to dedicated mode to allow VLAN tagging.

Answer

Configure a static route on the FortiGate for the VLAN subnet pointing to the FortiLink interface.

Question 17

An administrator is configuring a FortiGate to authenticate users via LDAP. The LDAP server uses a self-signed certificate. When testing the connection, the FortiGate returns an error about certificate validation. Which action should the administrator take to resolve this issue while maintaining security?

Accepted Answer

Import the LDAP server's CA certificate into the FortiGate's local certificate store and configure the LDAP server to use LDAPS.. The certificate validation error occurs because the FortiGate does not trust the self-signed certificate of the LDAP server. Importing the CA certificate into the FortiGate's local store allows it to validate the server's certificate. Configuring LDAPS ensures the connection is encrypted. This maintains security without disabling validation.

Answer

Disable certificate validation on the FortiGate for LDAP connections.

Answer

Set the LDAP server to use port 389 with StartTLS and enable certificate validation.

Answer

Configure the LDAP server to use a public CA-signed certificate instead of a self-signed one.

Question 18

A FortiGate administrator manages an active-passive HA cluster of two FGCP units. The administrator needs to upgrade the firmware on the cluster with minimal downtime. The administrator has already uploaded the new firmware image to both units. Which step should the administrator take next to ensure the secondary unit is upgraded first and the cluster remains available?

Accepted Answer

Run 'execute ha manage 1' to access the secondary unit, then run 'execute restore image <firmware_file>' to install the new firmware.. In an active-passive HA cluster, upgrading firmware with minimal downtime involves upgrading the secondary unit first, then triggering a failover so the upgraded secondary becomes primary, and finally upgrading the original primary. Accessing the secondary via 'execute ha manage' and using 'execute restore image' is the correct method. This ensures the cluster remains available during the upgrade process.

Answer

Run 'diagnose sys ha upgrade' to trigger the firmware upgrade process on the secondary unit.

Answer

Run 'execute ha synchronize start' to push the firmware from the primary to the secondary.

Answer

Run 'execute ha manage 1' to access the secondary unit, then run 'execute reboot' to reboot it into the new firmware.

Question 19

An administrator needs to configure a firewall policy to allow outbound traffic from the internal network to the internet. The internal network uses private IP addresses, and the FortiGate's WAN interface has a public IP. Which NAT configuration is appropriate to ensure return traffic is routed correctly?

Accepted Answer

Enable NAT in the firewall policy and use the outgoing interface address.. For outbound internet access from a private network, source NAT must be enabled in the firewall policy, typically using the outgoing interface address. This translates private IPs to the public IP of the WAN interface, allowing return traffic to reach the FortiGate and be forwarded back to the internal hosts. Other options either use incorrect NAT types or fail to translate to a routable address.

Answer

Disable NAT and rely on the FortiGate's routing table to forward traffic.

Answer

Enable NAT and specify a custom IP pool with a private IP address.

Answer

Create a VIP for the internal subnet and apply it as the source in the policy.

Question 20

An administrator is configuring a FortiGate to use LDAP for firewall authentication. Users are prompted for their credentials when accessing the internet. After successful authentication, users can access the internet. However, the administrator notices that users are prompted again after 30 minutes of inactivity. Which setting should the administrator adjust to extend the authentication timeout?

Accepted Answer

Modify the 'auth-timeout' in the user settings.. The authentication timeout on a FortiGate is controlled by the 'auth-timeout' setting, which can be configured globally or per user group. This setting determines how long a user remains authenticated after providing credentials. The default is 30 minutes. To extend this period, the administrator should increase the 'auth-timeout' value. Other timeouts, such as idle-timeout or session-ttl, affect session behavior but not the authentication duration.

Answer

Increase the 'idle-timeout' in the firewall policy.

Answer

Adjust the 'session-ttl' in the firewall policy.

Answer

Change the 'ldap-timeout' in the LDAP server configuration.