NSE4 Practice Exam 64 — 20 Questions

Question 1

An admin wants to ensure that VoIP traffic (UDP ports 5060-5061) from the internal network to the internet is prioritized over other traffic when the WAN link is congested. Which feature should be configured on the firewall policy?

Accepted Answer

Traffic shaping policy with a guaranteed bandwidth allocation and high priority. Option C is correct because a traffic shaping policy with guaranteed bandwidth allocation and high priority ensures that VoIP traffic (UDP ports 5060-5061) receives the necessary bandwidth and is prioritized over other traffic during WAN congestion. Traffic shaping policies on FortiGate allow you to set guaranteed bandwidth, maximum bandwidth, and priority levels, which directly address congestion by reserving resources for critical traffic like VoIP.

Answer

Enable NAT on the policy

Answer

QoS marking only (DSCP)

Answer

Configure a security profile with QoS settings

Question 2

Which of the following is the default action of a FortiGate firewall policy if no policy matches the traffic?

Accepted Answer

Deny. FortiGate firewall policies operate on a 'first-match' basis, and if no policy matches the traffic, the default action is to deny the traffic. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall. The implicit deny rule is automatically applied at the end of the policy list and cannot be removed or modified.

Answer

Log and drop

Answer

Redirect to authentication

Answer

Accept

Question 3

A network administrator needs to allow only HTTPS traffic from the internal network (10.0.0.0/8) to the public DNS server (8.8.8.8). Which firewall policy configuration BEST enforces this restriction?

Accepted Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: HTTPS, Action: Accept. Option C is correct because it specifies the internal network (10.0.0.0/8) as the source, the public DNS server (8.8.8.8) as the destination, and HTTPS (TCP/443) as the service, with an Accept action. This precisely matches the requirement to allow only HTTPS traffic from the internal network to that specific destination, blocking all other traffic by default via the implicit deny rule.

Answer

Source: ALL, Destination: 8.8.8.8, Service: HTTPS, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: ALL, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: ALL, Service: HTTPS, Action: Accept

Question 4

Which THREE of the following are valid address object types in FortiGate? (Choose three.)

Accepted Answer

Subnet. A is correct because a Subnet address object in FortiGate defines a range of IP addresses using a network address and subnet mask (e.g., 192.168.1.0/24). This is one of the fundamental object types used in firewall policies to match traffic based on source or destination IP ranges.

Answer

MAC address

Answer

Wildcard

Question 5

You execute 'get firewall policy 5' and see the following output:
policyid=5
name="test"
status=enable
schedule="always"
logtraffic=all
What does 'logtraffic=all' mean?

Accepted Answer

All traffic matching the policy will be logged, regardless of action. Option D is correct because 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

Answer

Only the first packet of each session will be logged

Answer

Only traffic that triggers a security profile will be logged

Answer

Only traffic that is denied by the policy will be logged

Question 6

An administrator configures a VIP for port forwarding: public IP 203.0.113.10 port 8080 to internal server 10.0.1.10 port 80. External users can connect to http://203.0.113.10:8080 but receive a timeout. The firewall policy allows traffic from any to the VIP on destination port 8080. The internal server is reachable from internal hosts. What is the most likely problem?

Accepted Answer

The policy destination service is set to HTTP (port 80) instead of port 8080. Option C is correct because the firewall policy must match the destination port of the incoming traffic. External users connect to port 8080 on the VIP, but if the policy's destination service is set to HTTP (port 80), the policy will not match traffic destined for port 8080. Even though the VIP translates the destination to port 80 on the internal server, the firewall policy evaluation occurs before NAT translation, so the policy must match the original destination port (8080).

Answer

The internal server is not running a web server

Answer

The VIP is not associated with the policy

Answer

The source NAT is not configured

Question 7

A network administrator creates a firewall policy allowing HTTP traffic from the internal network to a web server in the DMZ. Users report that they cannot access the web server. The administrator runs 'diagnose firewall iprope list' and sees the policy is present. What is the MOST likely cause of the issue?

Accepted Answer

A deny policy with a lower policy ID is matching the traffic before the allow policy. The 'diagnose firewall iprope list' command confirms the allow policy exists in the FortiGate's kernel policy list, meaning it is present and enabled. However, FortiGate evaluates policies in sequential order based on policy ID (lowest first), so a deny policy with a lower ID that matches the same traffic (e.g., from internal to DMZ) will be hit first, blocking the HTTP request before the allow policy can be evaluated. This is the most likely cause because the policy is present but not being matched due to ordering.

Answer

The firewall policy has an incorrect source interface

Answer

The policy is disabled

Answer

The web server is not responding to HTTP requests

Question 8

What is the default action of the implicit deny policy at the end of the firewall policy list?

Accepted Answer

Deny. In FortiGate firewalls, the implicit deny policy at the end of the firewall policy list has a default action of 'Deny'. This means any traffic that does not match an explicit firewall policy is automatically dropped. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall.

Answer

Monitor (log only)

Answer

Allow

Answer

Redirect to authentication

Question 9

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the SYN_SENT state, waiting for a SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table corresponds to the TCP state `SYN_SENT` (the session has sent a SYN and is awaiting a SYN-ACK). The `duration=3600` and `expire=3599` indicate the session has been alive for 3600 seconds and will expire in 3599 seconds, but the state itself is not established or closing. Option A is correct because `proto_state=01` specifically maps to the TCP SYN_SENT state in FortiOS session diagnostics.

Answer

The session is using UDP protocol

Answer

The session is fully established and actively transferring data

Answer

The session is being torn down and will expire soon

Question 10

An administrator runs 'diagnose firewall iprope list 100000' and sees 'action=deny' entries for traffic that should be allowed. The policy list shows an allow policy with ID 1 for that traffic. What is the most likely cause of the deny?

Accepted Answer

The firewall policy is not installed in the kernel due to an error. The 'diagnose firewall iprope list 100000' command displays the kernel-level firewall policy list. If the policy list shows an allow policy (ID 1) but the kernel entries show 'action=deny', it indicates that the policy was not successfully installed into the kernel's connection tracking or firewall engine. This typically occurs due to a policy installation error, such as a configuration inconsistency or a failure during the commit process, causing the kernel to fall back to a default deny action for that traffic.

Answer

The traffic is being blocked by a local-in policy

Answer

The implicit deny rule is being triggered because the policy is disabled

Answer

A security profile is dropping the traffic after the policy matches

Question 11

What is the purpose of policy-based routing (PBR) in FortiGate?

Accepted Answer

To route traffic based on source address, destination, or other attributes instead of the routing table. Policy-based routing (PBR) in FortiGate allows you to override the default routing table lookup by forwarding traffic based on criteria such as source IP address, destination IP address, protocol, or even application. This is configured under the 'policy route' feature and is evaluated before the routing table, enabling granular control over traffic paths that static or dynamic routes cannot provide.

Answer

To load balance traffic across multiple WAN links

Answer

To filter traffic based on application signatures

Answer

To authenticate users before allowing traffic

Question 12

A FortiGate administrator needs to block all traffic from a specific IP address (10.0.0.100) to the internet, but allow all other internal users. The administrator has created a firewall policy with source=10.0.0.100, destination=all, service=all, action=DENY, and placed it at the top of the policy list. Which TWO additional steps should the administrator take to ensure the block is effective? (Choose two.)

Accepted Answer

Enable the policy. Option A is correct because a newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

Answer

Configure an IP Pool for the deny policy

Answer

Add a schedule to the policy for business hours

Answer

Set the action to ACCEPT

Question 13

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

Accepted Answer

Create an allow policy for HTTP/HTTPS and apply a web filter profile. Option C is correct because FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Answer

Configure a DNS filter instead of a web filter

Answer

Create a policy with action DENY and a web filter profile

Answer

Use an application control profile to block malicious sites

Question 14

An organization wants to implement least privilege for firewall policies. Which THREE best practices should be followed? (Choose three.)

Accepted Answer

Specify the exact services required (e.g., TCP/443, TCP/22). Option B is correct because specifying exact services (e.g., TCP/443, TCP/22) enforces least privilege by allowing only the necessary protocols and ports, reducing the attack surface. In FortiGate firewall policies, this is configured under the 'Service' field, where you can select predefined services or create custom ones to match specific TCP/UDP port numbers. This prevents overly permissive rules that could expose services like SMB (TCP/445) or RDP (TCP/3389) unintentionally.

Answer

Use a single schedule covering all days

Answer

Use any any for source and destination to simplify management

Question 15

An admin needs to ensure that all traffic from the 10.0.1.0/24 network to the internet uses a specific public IP address (203.0.113.10) as the source IP, with port translation enabled. The FortiGate has multiple WAN interfaces. Which NAT configuration should the admin use on the firewall policy?

Accepted Answer

Create an IP pool of type Overload with the range 203.0.113.10 and select it in the policy. Option A is correct because an IP Pool of type Overload (Port Block Allocation) allows you to specify a single public IP address (203.0.113.10) as the translated source IP for all traffic from 10.0.1.0/24, with port address translation (PAT) enabled. This ensures that all outbound traffic uses that specific IP as the source, regardless of which WAN interface the traffic egresses, and the 'Overload' type automatically performs port translation to multiplex multiple internal hosts behind that single IP.

Answer

Enable NAT on the policy and set the IP pool configuration to use the interface address

Answer

Configure a Central SNAT rule that matches the source subnet and set the translated address to 203.0.113.10

Answer

Use a VIP to perform destination NAT and set the source IP in the VIP configuration

Question 16

Which of the following best describes a Virtual IP (VIP) in FortiGate?

Accepted Answer

A method to translate a public IP/port to a private IP/port for inbound traffic. A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Answer

A method to translate private source IPs to a public IP for outbound traffic

Answer

A method to group multiple firewall policies

Answer

A method to load balance traffic across multiple WAN interfaces

Question 17

An administrator creates a firewall policy with a traffic shaper to limit bandwidth for guest wireless users. After applying the policy, users can still consume high bandwidth. The administrator confirms the policy is matching. What is the MOST likely reason the traffic shaper is not effective?

Accepted Answer

The traffic shaper is configured but not applied to the policy's 'Traffic Shaper' field. Option C is correct because in FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Answer

The traffic shaper's maximum bandwidth is set too high

Answer

The traffic shaper is applied to the wrong direction (egress vs ingress)

Answer

The traffic shaper is a per-IP shaper but the policy applies to a subnet

Question 18

Which statement best describes the 'implicit deny' policy on a FortiGate?

Accepted Answer

It is automatically applied to all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a built-in, last-resort rule that automatically denies any traffic not matching an explicit firewall policy. It is not visible in the policy list and cannot be moved, modified, or deleted; it is always applied as the final rule to ensure that only explicitly permitted traffic is allowed through the FortiGate.

Answer

It can be moved to a different position in the policy list

Answer

It is a configurable policy that denies all traffic

Answer

It logs all denied traffic by default

Question 19

A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?

Accepted Answer

Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic. Option D is correct because when multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.

Answer

The FortiGate is using a proxy server that caches different results for different users

Answer

The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent

Answer

The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing

Question 20

What is the purpose of the 'implicit deny' policy on a FortiGate?

Accepted Answer

It denies all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a default, last-resort rule that denies all traffic not matching any explicit firewall policy. It ensures that any packet that does not meet the source, destination, service, or schedule criteria of a configured policy is dropped, enforcing a default-deny security posture. This behavior is fundamental to stateful firewall operation and prevents unauthorized traffic from traversing the device.

Answer

It allows traffic from trusted internal networks

Answer

It logs all traffic that is denied

Answer

It allows all traffic that matches no other policy