NSE4 Practice Test 6 — 10 Questions

Question 1

You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?

Accepted Answer

The HA heartbeat interface is not configured correctly or is down. The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings. The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.

Answer

The secondary unit has a lower priority, so it never takes over

Answer

The password for HA synchronization is incorrect

Answer

The session pickup feature is disabled

Question 2

A FortiGate administrator needs to configure NTP to ensure accurate time on the device. Which two steps are required? (Choose two.)

Accepted Answer

Specify at least one NTP server address. NTP requires both enabling the NTP service on the FortiGate (System > Settings) and specifying at least one NTP server address so the device can synchronize its clock. Without a server address, the NTP client has no source to query, and without enabling the service, the NTP client process will not run.

Answer

Enable the 'Sync on Save' option

Answer

Configure a firewall policy to allow NTP traffic (UDP 123)

Answer

Set the time zone to the local time zone

Question 3

An admin configures an aggregate interface on a FortiGate using two physical ports. After configuration, the admin notices that traffic is not load-balancing evenly. What is the MOST likely cause?

Accepted Answer

The aggregate interface is using the default load-balancing algorithm. The default load-balancing algorithm for an aggregate interface (LAG) on FortiGate is based on the source and destination MAC addresses. This algorithm often results in uneven traffic distribution, especially when traffic flows are limited to a small number of MAC pairs. To achieve more even load balancing, the algorithm should be changed to one that considers IP addresses or Layer 4 ports, such as 'src-dst-ip' or 'src-dst-ip-port'.

Answer

The aggregate interface is set to active-passive mode

Answer

The physical ports are connected to different switches

Answer

The MTU size is mismatched on the physical ports

Question 4

An admin needs to configure a FortiGate to send logs to a FortiAnalyzer. Which TWO steps must be performed? (Choose two.)

Accepted Answer

Configure the FortiAnalyzer IP under config system log-fortianalyzer. Option D is correct because the FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

Answer

Set the log aggregation interval

Answer

Configure SNMP trap destinations

Answer

Create a firewall policy to allow traffic to FortiAnalyzer

Question 5

An administrator needs to back up the FortiGate configuration to a remote server. Which protocol is supported for backup?

Accepted Answer

TFTP

Answer

FTP

Answer

SNMP

Answer

HTTP

Question 6

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

Accepted Answer

Enable SNMP agent and configure an SNMP community. To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Answer

Configure a performance SLA monitor

Answer

Enable SNMP on the interface and set administrative access to SNMP

Answer

Configure an SNMP v3 user and enable SNMP traps

Question 7

Which FortiGate operating mode is used when the device acts as a Layer 2 bridge without performing NAT?

Accepted Answer

Transparent mode. Transparent mode (Option B) is correct because in this mode the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any NAT or routing. The device is invisible to the network, and all interfaces share the same IP subnet, allowing it to inspect and filter traffic at the application layer while remaining transparent to connected devices.

Answer

HA mode

Answer

VPN mode

Answer

NAT/Route mode

Question 8

An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)

Accepted Answer

Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).. Option B is correct because FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Answer

Enable SNMP on the FortiGate to allow FortiManager to monitor.

Answer

Configure a VPN tunnel between FortiGate and FortiManager.

Answer

Set the FortiGate's operation mode to transparent.

Question 9

A FortiGate is configured in transparent mode. Which of the following statements is true?

Accepted Answer

The FortiGate interfaces have IP addresses for management only. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Answer

The FortiGate can have multiple routing tables

Answer

The FortiGate supports VLAN sub-interfaces

Answer

The FortiGate acts as a router and performs NAT

Question 10

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure voice traffic uses the interface with the lowest latency. Which SD-WAN configuration should be used?

Accepted Answer

Configure an SD-WAN rule with a performance SLA that monitors latency and set strategy to 'Best Quality'. Option C is correct because SD-WAN rules with a performance SLA allow the FortiGate to monitor real-time latency on each WAN interface and dynamically route voice traffic to the interface with the lowest latency. The 'Best Quality' strategy selects the best-performing interface based on the SLA metrics, ensuring optimal voice quality.

Answer

Set the strategy to 'Manual'

Answer

Set the strategy to 'Load Balance'

Answer

Use policy-based routing with a higher priority for voice traffic