NSE4 Practice Test 7 — 10 Questions

Question 1

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 2

An administrator needs to forward logs from a FortiGate to a FortiAnalyzer for centralized logging. The FortiAnalyzer IP is 10.10.10.10. Which configuration is required on the FortiGate?

Accepted Answer

config log fortianalyzer setting
 set status enable
 set server 10.10.10.10
 end. The FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Answer

config system central-management
 set type fortianalyzer
 set ip 10.10.10.10
 end

Answer

config log setting
 set fortianalyzer ip 10.10.10.10
 end

Answer

config log syslogd setting
 set server 10.10.10.10
 end

Question 3

A FortiGate is set to NAT/Route mode. The admin wants traffic from internal users to the internet to use an IP address on the WAN interface for source NAT. Which configuration is required?

Accepted Answer

Enable NAT on the policy from internal to WAN and set the outgoing interface to the WAN interface. In NAT/Route mode, source NAT (SNAT) is configured by enabling NAT on the firewall policy that governs traffic from the internal network to the WAN interface. When NAT is enabled on the policy and the outgoing interface is set to the WAN interface, FortiGate automatically translates the source IP of internal users to the primary IP address of that WAN interface (or a configured IP pool). This is the standard method for allowing internal users to access the internet with a public IP address.

Answer

Set the FortiGate to transparent mode

Answer

Configure a policy route to force traffic through a specific interface

Answer

Configure a virtual IP mapping internal IPs to the WAN IP

Question 4

An administrator wants to prevent data leakage by blocking outbound emails that contain credit card numbers. Which security profile should be configured?

Accepted Answer

DLP profile. DLP (Data Loss Prevention) profiles are specifically designed to inspect content such as credit card numbers in outbound emails and block them to prevent data leakage. While other profiles handle spam, web access, or malware, only DLP can perform pattern-based content inspection on email bodies and attachments.

Answer

Email Filter profile

Answer

Web Filter profile

Answer

Antivirus profile

Question 5

Which of the following statements about FortiGate backup is true?

Accepted Answer

The backup file contains the full configuration and can be encrypted with a password. FortiGate backup files contain the full device configuration, including all settings and policies, and can be encrypted with a password using the 'execute backup config' command with the 'password' option. This ensures confidentiality during storage or transfer, as the backup is stored in a binary format that requires the password for decryption during restoration.

Answer

The backup includes all current sessions and logs

Answer

A backup can be restored only on the same hardware model

Answer

Backup files are saved in plain text format

Question 6

An administrator wants to ensure that all DNS traffic from internal users is filtered by the FortiGate to block malicious domains. Which TWO configurations are necessary? (Choose two.)

Accepted Answer

Apply the DNS filter profile to a firewall policy that matches DNS traffic. A DNS filter profile must be applied to a firewall policy that matches DNS traffic for the filtering to take effect. Without this policy-level binding, the DNS filter profile is not enforced, even if it is configured. This ensures that all DNS queries from internal users are inspected by the FortiGate.

Answer

Set DNS server to FortiGate's IP

Answer

Enable sinkhole on the DNS filter profile

Answer

Configure SSL deep inspection for DNS over HTTPS

Question 7

A FortiGate administrator needs to block all traffic from a specific IP address (10.0.0.100) to the internet, but allow all other internal users. The administrator has created a firewall policy with source=10.0.0.100, destination=all, service=all, action=DENY, and placed it at the top of the policy list. Which TWO additional steps should the administrator take to ensure the block is effective? (Choose two.)

Accepted Answer

Enable the policy. A newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

Answer

Configure an IP Pool for the deny policy

Answer

Add a schedule to the policy for business hours

Answer

Set the action to ACCEPT

Question 8

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. The Geography address object type in FortiGate allows you to match traffic based on the source or destination country by using the ISO 3166-1 alpha-2 country codes. This is configured within a firewall policy to enforce geo-blocking or geo-allowance, leveraging FortiGuard's GeoIP database to map IP addresses to countries.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 9

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Accepted Answer

Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.. Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Answer

Disable DPD on the phase1 interface to reduce overhead.

Answer

Use aggressive mode for faster IKE negotiation.

Answer

Disable PFS to reduce CPU load on the firewall.

Question 10

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session for HTTPS traffic. The output shows `proto=6` (TCP), `proto_state=01` (TCP established), `dport=443` (HTTPS), and a duration/expire indicating an active session. This confirms an established TCP session for HTTPS traffic, making D correct.

Answer

The session is a half-open TCP connection

Answer

The session is a multicast session

Answer

The session is a UDP session for DNS over HTTPS