NSE4 Practice Test 6 — 10 Questions

Question 1

An administrator wants to implement ZTNA (Zero Trust Network Access) on a FortiGate to secure access to an internal application. Which TWO components are essential for a ZTNA configuration?

Accepted Answer

A proxy-based firewall policy. ZTNA on FortiGate requires a proxy-based firewall policy to intercept and inspect application-layer traffic. This policy type enables the FortiGate to act as a reverse proxy, terminating TLS connections and enforcing access control based on user identity and device posture before forwarding traffic to the internal application.

Answer

A firewall policy using IPsec VPN

Answer

A FortiGate in transparent mode

Answer

A policy-based IPsec tunnel

Question 2

What is the primary difference between route-based and policy-based IPsec VPNs on a FortiGate?

Accepted Answer

Route-based uses a tunnel interface, policy-based uses firewall policies to define traffic selectors.. The primary difference is that route-based IPsec VPNs use a tunnel interface (e.g., 'phase1-interface' and 'phase2-interface') which participates in routing, while policy-based IPsec VPNs rely on firewall policies with explicit traffic selectors (source/destination addresses and services) to trigger encryption. In route-based VPNs, the tunnel interface is assigned an IP address and routes are used to direct traffic into the tunnel, decoupling encryption from policy matching. In policy-based VPNs, the firewall policy itself defines what traffic is encrypted, making the traffic selector part of the policy configuration.

Answer

Route-based requires a static route, policy-based uses dynamic routing.

Answer

Route-based encrypts all traffic, policy-based encrypts only specified services.

Answer

Route-based supports only IKEv2, policy-based supports both IKEv1 and IKEv2.

Question 3

Which of the following best describes the purpose of a captive portal on a FortiGate?

Accepted Answer

To authenticate users before granting network access. A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.

Answer

To provide secure remote access to internal resources

Answer

To encrypt traffic between sites

Answer

To block malware from entering the network

Question 4

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Accepted Answer

Define a traffic shaper object with the desired bandwidth limits. A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Answer

Enable SD-WAN on the FortiGate

Answer

Configure Central NAT to translate the source IP

Question 5

An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?

Accepted Answer

Enable 'require client certificate' in the SSL VPN settings. The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.

Answer

Configure a firewall policy with identity-based authentication

Answer

Enable 'certificate-based authentication' in the user group

Answer

Import the users' public keys into the FortiGate

Question 6

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Accepted Answer

diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80. B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.

Answer

execute ping 203.0.113.50

Answer

diagnose debug flow

Answer

get firewall policy

Question 7

An administrator has configured an IPS sensor to block critical-severity attacks. However, after a week, they notice that a known exploit (CVE-2021-44228) is still getting through. Which configuration change should be made to improve detection?

Accepted Answer

Enable the specific IPS signature for the exploit in the sensor.. The IPS sensor must have the specific signature for CVE-2021-44228 (Log4Shell) enabled to detect and block it. Even if the sensor is set to block critical-severity attacks, the signature for this exploit may be disabled by default in the sensor's signature database. Enabling the specific signature ensures the sensor inspects traffic for the exploit's unique patterns and applies the configured action.

Answer

Set the IPS sensor severity filter to 'low' and above.

Answer

Change the IPS sensor action from 'default' to 'block' for all signatures.

Answer

Create a custom IPS signature for the exploit.

Question 8

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 9

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Accepted Answer

diagnose firewall iprope list. The 'diagnose firewall iprope list' command (D) displays the kernel's internal firewall rule list, allowing the administrator to verify the exact order and matching criteria of all policies. The 'diagnose debug flow' command (E) enables real-time packet flow tracing, showing which policy each packet matches and why it is accepted or denied. Together, these two commands directly reveal if traffic is matching a different policy than intended.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 10

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security