NSE4 Practice Test 6 — 10 Questions

Question 1

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

Accepted Answer

Create an allow policy for HTTP/HTTPS and apply a web filter profile. FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Answer

Configure a DNS filter instead of a web filter

Answer

Create a policy with action DENY and a web filter profile

Answer

Use an application control profile to block malicious sites

Question 2

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 3

A network administrator needs to configure a FortiGate to allow HTTPS access to the GUI from the internal network. Which two steps must be performed?

Accepted Answer

Create a firewall policy that permits HTTPS traffic from internal to the FortiGate interface IP.. To allow HTTPS access to the GUI from the internal network, two actions are required. First, a firewall policy must be created to permit HTTPS traffic (TCP/443) from the internal network to the FortiGate's interface IP. This can be done via CLI with 'config firewall policy' or through the GUI. Second, HTTPS administrative access must be enabled on the internal interface. This is configured either via CLI with 'config system interface' and 'set allowaccess https' or by checking 'HTTPS' under Administrative Access in the GUI. Without both steps, GUI access will fail.

Answer

Disable HTTP administrative access on the internal interface.

Answer

Enable SSH administrative access on the internal interface.

Question 4

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) is the correct feature because it performs destination NAT (DNAT), translating the public destination IP 203.0.113.10 to the internal server IP 10.0.0.5. This allows inbound traffic from the internet to reach the internal web server by rewriting the destination IP address in the packet header as it traverses the FortiGate.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 5

An admin wants users to authenticate once via AD and have their network access controlled without repeated logins. Which feature should be used?

Accepted Answer

FSSO with Active Directory polling. FSSO with Active Directory polling allows users to authenticate once at Windows logon, and FortiGate polls the AD domain controllers to capture authentication events. This enables transparent network access control without repeated logins, as the user's identity and group memberships are mapped to firewall policies automatically.

Answer

Local user authentication

Answer

Captive portal with LDAP

Answer

SSL VPN with certificate authentication

Question 6

Which statement about the implicit deny policy on a FortiGate is true?

Accepted Answer

It is always at the bottom of the policy list and denies all unmatched traffic. The implicit deny policy is a built-in, non-configurable security policy that resides at the very bottom of the FortiGate policy list. It automatically denies all traffic that does not match any explicit user-defined policy, ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It is a user-configurable policy that can be deleted

Answer

It allows traffic that matches no other policy

Answer

It can be moved to a different position in the policy list

Question 7

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

Accepted Answer

Transparent mode. Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Answer

HA mode

Answer

VDOM mode

Answer

NAT/Route mode

Question 8

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The output shows `proto=6`, which is the protocol number for TCP, and `proto_state=01`, which in FortiGate's session table indicates an established TCP connection (state ESTABLISHED). The `duration=3600` seconds means the session has been active for exactly 1 hour, and `expire=3599` seconds shows the remaining time before the session times out. This confirms the session is an active TCP connection that has been established for 1 hour, making option C correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP

Question 9

An admin configures two static routes to the same destination with different distances. The route with distance 10 points to ISP1, and the route with distance 20 points to ISP2. The admin wants to use ISP2 only if ISP1 fails. What is the expected behavior?

Accepted Answer

Traffic will use ISP1 until its route is removed, then use ISP2. When two static routes have different administrative distances, the route with the lower distance (10) is preferred and installed in the routing table. The route with distance 20 remains in the routing table as a backup. If the preferred route (via ISP1) is removed due to a failure, the backup route (via ISP2) is automatically activated. This behavior is fundamental to how FortiGate (and most routers) handle static routes with unequal distances.

Answer

Traffic will load-balance between ISP1 and ISP2

Answer

The route with distance 20 will be ignored entirely

Answer

Both routes will be active simultaneously, and the FortiGate will choose based on source IP

Question 10

An administrator is configuring web filtering on a FortiGate. Which TWO statements about web filtering profiles are correct?

Accepted Answer

Web filtering profiles can be used together with application control profiles.. Web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Answer

Web filtering profiles can only be applied to users who are authenticated.

Answer

Web filtering profiles are applied globally by default.

Answer

Web filtering profiles are used to configure SSL certificate inspection.