NSE4 Practice Exam 57 — 20 Questions

Question 1

A FortiGate in an HA active-passive cluster is experiencing frequent failovers. The administrator checks the HA statistics and sees that the primary unit's heartbeat interface has a high error rate. What is the most likely cause?

Accepted Answer

The heartbeat cable is faulty or the interface has a duplex mismatch. Option A is correct because a high error rate on the heartbeat interface indicates physical-layer issues such as a faulty cable or duplex mismatch. In an HA active-passive cluster, the heartbeat link must be reliable and low-latency; errors cause packet loss, leading the primary unit to appear unresponsive and triggering a failover to the secondary unit.

Answer

The heartbeat interface is configured as a single link without redundancy

Answer

The failover threshold is set too low

Answer

The HA configuration has mismatched passwords

Question 2

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

Accepted Answer

Create a local-in policy to allow management access only from the trusted host. A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Answer

Change the admin port to a non-standard port

Answer

Enable HTTPS and restrict admin access via admin host

Answer

Use a firewall policy with source address restriction

Question 3

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 4

A FortiGate is configured in NAT/Route mode. Which statement is correct about this mode?

Accepted Answer

The FortiGate routes traffic between different subnets and can perform NAT.. In NAT/Route mode, the FortiGate operates as a Layer 3 router, forwarding traffic between different subnets while also performing Network Address Translation (NAT) when configured. This is the default operational mode for most FortiGate deployments, enabling both routing and NAT capabilities on the same device.

Answer

Only one interface can be used for traffic.

Answer

VLAN interfaces are not supported in this mode.

Answer

The FortiGate acts as a Layer 2 bridge.

Question 5

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 6

A FortiGate admin needs to create a loopback interface for management purposes. Which two statements about loopback interfaces are correct? (Choose two.)

Accepted Answer

Loopback interfaces are always up and do not depend on physical links. Option A is correct because loopback interfaces are virtual interfaces that are always in an up/up state as long as the FortiGate is operational. They do not depend on any physical link or carrier status, making them ideal for management access and stable routing protocol peering.

Answer

Loopback interfaces cannot be assigned an IP address

Answer

Loopback interfaces are only used for routing protocols

Answer

Loopback interfaces require a physical port to be up

Question 7

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover

Question 8

Which of the following is required to allow a FortiGate to synchronize its clock with an NTP server?

Accepted Answer

Firewall policy allowing NTP traffic (UDP 123) from the FortiGate to the NTP server. A FortiGate synchronizes its clock with an NTP server using NTP traffic, which relies on UDP port 123. Without a firewall policy that explicitly permits outbound UDP 123 traffic from the FortiGate to the NTP server, the NTP packets are dropped by the FortiGate's own firewall engine, preventing clock synchronization. This policy is required even for traffic originating from the FortiGate itself, as the FortiGate applies firewall rules to all traffic, including management traffic.

Answer

Enable NTP in the admin settings

Answer

Set the timezone using config system global

Answer

Disable daylight saving time

Question 9

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. Option D is correct because in NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 10

You are troubleshooting a FortiGate HA cluster that is not failing over correctly. The cluster has two units in active-passive mode. You check the HA status and see both units are in 'standalone' mode. Which THREE configurations could cause this? (Choose three.)

Accepted Answer

The HA group ID is different on each unit. Option B is correct because the HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Answer

The FortiGate is configured in transparent mode

Answer

The firmware versions are different but both are 7.0.x

Question 11

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

Accepted Answer

Configure two static default routes with the same distance and metric. Option D is correct because configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Answer

Configure a single default gateway and rely on ARP for failover

Answer

Configure a policy route for each subnet directing traffic to a different ISP

Answer

Configure two static default routes with different distances

Question 12

You run the following command on a FortiGate:

```
diagnose sys session filter dport 443
diagnose sys session list
```

The output shows:
```
proto=6 proto_state=01 duration=3600 expire=3599
```

What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and has 3599 seconds remaining before timeout.. Option A is correct because the output shows `duration=3600` and `expire=3599`, which indicate the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. The `proto=6` confirms TCP (protocol 6), and `proto_state=01` represents the TCP state for an established connection (ESTABLISHED), not a handshake state.

Answer

The session is using TCP state 01 (SYN_SENT) and is still in the process of establishing.

Answer

The session has been idle for 3600 seconds and will expire in 3599 seconds.

Answer

The session is using UDP protocol and will expire in 3599 seconds.

Question 13

An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The correct command is 'execute backup config tftp ' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.

Answer

diagnose debug config-error-log read

Answer

show full-configuration

Answer

execute restore config tftp

Question 14

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

Accepted Answer

Transparent mode. Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Answer

HA mode

Answer

VDOM mode

Answer

NAT/Route mode

Question 15

An administrator plans to upgrade FortiGate firmware from version 6.0 to 7.2. The current version is 6.0.10. Which upgrade path is correct?

Accepted Answer

Upgrade to 6.2, then 6.4, then 7.0, then 7.2. FortiGate firmware upgrades must follow a supported path that does not skip major versions. Upgrading from 6.0.10 to 7.2.0 requires stepping through 6.2, 6.4, and 7.0 because Fortinet only supports upgrades from one major version to the next major version (e.g., 6.0→6.2→6.4→7.0→7.2). Option D correctly lists this sequential path.

Answer

Upgrade to 6.4 first, then to 7.2

Answer

It is not possible to upgrade from 6.0 to 7.2

Answer

Direct upgrade from 6.0.10 to 7.2.0 is supported

Question 16

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

Accepted Answer

A firewall is blocking the required ports between FortiGate and FortiAnalyzer.. The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Answer

The FortiAnalyzer is not registered with the FortiGate.

Answer

The FortiGate is not generating any logs.

Answer

The FortiAnalyzer SNMP community string is incorrect.

Question 17

What is the purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To create a logical interface that remains up regardless of physical link status. A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Answer

To provide a virtual IP address for NAT

Answer

To connect to a VLAN

Answer

To aggregate multiple physical interfaces for increased bandwidth

Question 18

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. Option A is correct because the HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 19

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The FortiGuard antivirus subscription has expired

Question 20

An administrator is configuring a VLAN interface on a FortiGate. The physical interface is port2 and the VLAN ID is 100. Which of the following correctly creates the VLAN interface?

Accepted Answer

config system interface edit port2.100 set vlanid 100 set type vlan next end. Option A is correct because it uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.

Answer

config system interface edit port2 set vlanid 100 next end

Answer

config system interface edit port2.100 set type vlan next end

Answer

config system vlan edit port2.100 set vlanid 100 next end