NSE4 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. The policy applies deep inspection, but users cannot access any HTTPS websites. The FortiGate CA certificate is installed on clients. What is the most likely cause?

Accepted Answer

The service 'HTTPS' only allows TCP 443, but some websites use other ports.. Option D is correct because the policy uses the service 'HTTPS', which by default only matches TCP port 443. If any HTTPS websites are hosted on non-standard ports (e.g., 8443, 9443), the FortiGate will not apply deep inspection to that traffic, causing the connection to fail when deep inspection is required. The FortiGate CA certificate being installed on clients ensures trust, but the service definition must match the actual destination port for inspection to occur.

Answer

The deep inspection profile is misconfigured.

Answer

The antivirus profile is blocking the traffic.

Answer

The web filter profile 'strict' is blocking all sites.

Question 2

Refer to the exhibit. The HA cluster has been operational for 5 days. The primary unit suddenly loses power. Which of the following will happen?

Accepted Answer

The secondary unit will become primary and maintain existing UDP sessions.. In a FortiGate HA cluster, session synchronization is enabled by default for UDP sessions but not for TCP sessions (unless specifically configured). When the primary unit fails, the secondary unit takes over as primary and maintains all synchronized sessions, which includes UDP sessions. TCP sessions are not synchronized by default and will be dropped upon failover.

Answer

The secondary unit will become primary, but all existing sessions will be dropped.

Answer

The cluster will remain without a primary until the original unit is restored.

Answer

The secondary unit will become primary and maintain only TCP sessions.

Question 3

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Accepted Answer

Heartbeat interfaces must be on the same subnet.. Option C is correct because FortiGate HA heartbeat interfaces must be on the same subnet to allow the heartbeat packets (typically UDP port 496) to be exchanged directly between the primary and secondary units. This ensures Layer 2 adjacency is maintained for reliable failure detection and synchronization.

Answer

Heartbeat interfaces must be in the same VDOM.

Answer

Heartbeat interfaces must be dedicated management ports.

Answer

Only two heartbeat interfaces can be configured.

Question 4

A network engineer is configuring an SD-WAN rule to steer voice traffic to the MPLS link with the lowest latency. The SLA target is set to latency < 50 ms and jitter < 10 ms. However, the MPLS link occasionally exceeds the latency threshold. What should the engineer do to ensure voice traffic uses the best available link without manual intervention?

Accepted Answer

Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.. Option B is correct because configuring a secondary strategy (e.g., fallback to broadband) allows the SD-WAN rule to automatically steer voice traffic to the best available link when the primary MPLS link fails the SLA (latency > 50 ms). This ensures continuous SLA compliance without manual intervention, leveraging Fortinet's SD-WAN dynamic path selection based on real-time performance metrics.

Answer

Remove the latency performance SLA and rely only on jitter.

Answer

Increase the jitter threshold to 15 ms to avoid SLA violations.

Answer

Disable SLA enforcement on the SD-WAN rule so voice traffic always uses the MPLS link.

Question 5

Which THREE statements about SD-WAN rules are correct?

Accepted Answer

SD-WAN rules are evaluated in order of priority.. SD-WAN rules are evaluated in order of priority, meaning the rule with the highest priority (lowest number) is matched first. This sequential evaluation ensures deterministic traffic steering based on the most specific match criteria defined by the administrator.

Answer

SD-WAN rules must use a 'load balancing' strategy.

Answer

Each SD-WAN rule can only contain one member.

Question 6

An administrator has two FortiGate units in an active-passive HA cluster. The cluster is configured to use the heartbeat interface port3. During a failover test, the primary unit fails but the secondary does not take over. What is the most likely cause?

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an active-passive HA cluster, the secondary unit monitors the primary's health via the heartbeat interface. If the heartbeat interface (port3) is down on the secondary, it cannot receive or send heartbeat packets, so it will not detect the primary's failure and will not initiate a failover. This is the most direct cause of the secondary not taking over.

Answer

The secondary unit has an override enabled.

Answer

Session pickup is disabled on the cluster.

Answer

The HA uptime on the secondary is less than the primary.

Question 7

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Accepted Answer

Set the manual strategy with MPLS as first member and enable SLA check.. Option B is correct because a manual strategy with ordered members and an SLA check allows the SD-WAN rule to first attempt the MPLS link; if the SLA is met, traffic uses MPLS, and if the SLA fails, the rule automatically fails over to the next member (broadband). This directly implements the engineer's requirement of 'MPLS if SLA met, otherwise broadband.'

Answer

Set the strategy to 'volume' and configure MPLS as preferred.

Answer

Use 'load balancing' strategy and assign MPLS a higher weight.

Answer

Set the strategy to 'best quality' and set MPLS with highest priority.

Question 8

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Accepted Answer

The performance SLA for jitter is not configured, only latency.. Option A is correct because the SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Answer

The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Answer

The LTE link has a higher cost and is not considered for failover.

Answer

The fiber link has a higher interface weight.

Question 9

Refer to the exhibit. An administrator has configured HA on two FortiGate units. During a failover test, the secondary unit does not take over when the primary fails. What is the most likely cause?

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an HA cluster, the heartbeat interface is critical for communication between primary and secondary units. If the heartbeat interface (port3) is down on the secondary unit, it cannot receive or send HA heartbeat packets, so the secondary will not detect the primary's failure or negotiate a takeover. This directly prevents the secondary from assuming the primary role, making D the correct answer.

Answer

Session pickup is enabled but session-pickup-connectionless is also enabled, causing conflict.

Answer

Override is disabled, so the secondary cannot become primary.

Answer

The priority on the secondary is set to a higher value than the primary.

Question 10

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

Accepted Answer

Virtual cluster ID. In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.

Answer

HA priority

Answer

Management IP address

Answer

Hostname

Question 11

Refer to the exhibit. An SD-WAN rule for voice traffic uses the SLA strategy with sla-match-mode 'any'. SLA 'sla1' measures ping to 8.8.8.8. If wan1 has latency 90 ms and jitter 10 ms, and wan2 has latency 110 ms and jitter 5 ms, which link will be selected for voice traffic?

Accepted Answer

wan1, because it meets the SLA thresholds.. With sla-match-mode 'any', the SD-WAN rule selects the first link that meets any of the configured SLA thresholds. The SLA for voice traffic measures ping to 8.8.8.8 with thresholds for latency and jitter. wan1 has latency 90 ms and jitter 10 ms, which both fall within typical SLA thresholds (e.g., latency < 150 ms, jitter < 20 ms), so it meets the SLA. wan2 has latency 110 ms, which also meets the latency threshold, but since 'any' mode selects the first qualifying link, wan1 is chosen. Option B is correct because wan1 satisfies the SLA and is selected first.

Answer

Neither link, because both fail jitter?

Answer

Both links, because sla-match-mode 'any' allows any link that meets SLA.

Answer

wan2, because it has lower jitter.

Question 12

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

Accepted Answer

Create a policy route with source address set to the specific IP and set the gateway to ISP1. Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Answer

Increase the administrative distance of the ISP2 default route to 20

Answer

Configure SD-WAN rules to steer the traffic

Answer

Add a static host route for the specific source IP via ISP1

Question 13

A FortiGate administrator is setting up a new FortiGate and needs to integrate it with FortiAnalyzer and FortiManager. Which THREE statements are correct regarding this integration?

Accepted Answer

FortiAnalyzer can generate reports based on the logs received from FortiGate.. Option A is correct because FortiAnalyzer is designed to receive logs from FortiGate devices and use them to generate comprehensive reports. The FortiGate sends logs via syslog or the FGFM protocol, and FortiAnalyzer stores them in its SQL database, allowing administrators to create scheduled or on-demand reports for compliance, traffic analysis, and security events.

Answer

FortiAnalyzer can push configuration changes to the FortiGate.

Answer

FortiGate uses the FGFM protocol to communicate with FortiAnalyzer.

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been established for 1 hour and will expire in about 1 hour. Option A is correct because the output shows `proto=6`, which indicates TCP (protocol number 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. The `duration=3600` means the session has been active for 3600 seconds (1 hour), and `expire=3599` indicates the session will expire in 3599 seconds (approximately 1 hour). This matches the description of a TCP session established for 1 hour with about 1 hour remaining before expiry.

Answer

The session is a UDP session with destination port 443

Answer

The session will expire in 3600 seconds

Answer

The session is a TCP session in SYN_SENT state

Question 15

An administrator needs to block traffic from a specific geographic region (e.g., country) from reaching the corporate web server. Which type of address object should be used to define the source?

Accepted Answer

Geography object. Option D is correct because a Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

Answer

Wildcard FQDN object

Answer

FQDN object

Answer

Subnet object

Question 16

An administrator configures a VIP for inbound HTTP traffic to an internal server (192.168.1.10:80). External users can reach the server via the VIP, but internal users on the same subnet as the server cannot access the server using its public IP. What is the most likely cause?

Accepted Answer

NAT reflection (hairpin NAT) is not enabled. Option D is correct because internal users on the same subnet as the server (192.168.1.10) attempting to reach the server via its public VIP (e.g., 203.0.113.10) will send packets to the FortiGate, which performs destination NAT (DNAT) to the private IP. Without NAT reflection (also called hairpin NAT or NAT loopback), the FortiGate does not translate the source IP for traffic that enters and leaves the same interface, so the server sees the source as the internal user's private IP and replies directly, bypassing the FortiGate. This breaks the return path because the internal user's packet was destined for the VIP but the reply comes from the private IP, causing asymmetric routing and connection failure.

Answer

The internal users do not have a route to the VIP's public IP

Answer

The firewall policy for internal-to-DMZ traffic has NAT disabled

Answer

The VIP is configured on the wrong interface

Question 17

A FortiGate administrator wants to ensure that traffic from the internal network to an external FTP server uses a specific source IP address (203.0.113.10). The internal network uses RFC 1918 addresses. Which NAT configuration should be used?

Accepted Answer

Policy-based NAT using an IP pool with type 'Overload' and the IP address 203.0.113.10. Option D is correct because policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

Answer

Policy-based NAT using an IP pool set to 'Fixed Port Range'

Answer

Virtual IP (VIP) mapping the internal server to 203.0.113.10

Answer

Central SNAT with dynamic IP pool

Question 18

An administrator wants to integrate FortiGate with FortiAnalyzer for logging. Which TWO steps are necessary?

Accepted Answer

Set the FortiAnalyzer IP under 'config system log-fortianalyzer set status enable set server '.. Option A is correct because the command 'config system log-fortianalyzer set status enable set server ' directly configures FortiGate to send logs to a specific FortiAnalyzer server. Option B is correct because enabling logging to FortiAnalyzer under the log settings activates the log forwarding mechanism, which is a necessary step to ensure logs are actually transmitted after the server IP is configured.

Answer

Create a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514.

Answer

Configure SNMP traps to send logs to FortiAnalyzer.

Answer

Install a FortiAnalyzer license on FortiGate.

Question 19

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 20

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

Accepted Answer

The session will timeout in 3599 seconds. In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Answer

The session has 3599 packets

Answer

The session has been alive for 3599 seconds

Answer

The session has 3599 bytes of data transferred

NSE4 Practice Exam 54 — 20 Questions

Exhibit

NSE4 Practice Exam 54 — 20 Questions

Exhibit