NSE4 Practice Test 8 — 10 Questions

Question 1

What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?

Accepted Answer

Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content. Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.

Answer

Certificate inspection decrypts traffic; deep inspection does not

Answer

Deep inspection is faster than certificate inspection

Answer

Both provide the same level of security

Question 2

Which of the following best describes the difference between flow-based and proxy-based inspection for antivirus scanning?

Accepted Answer

Flow-based inspection uses pattern matching and anomaly detection with low latency, while proxy-based provides full content reassembly and higher detection rates. Flow-based inspection uses pattern matching and anomaly detection to scan traffic with low latency, while proxy-based inspection fully reassembles files and content, enabling deeper analysis and higher detection rates. In Fortinet's FortiOS, flow-based mode is optimized for performance, whereas proxy-based mode provides more thorough inspection by buffering and reconstructing the entire data stream before scanning.

Answer

Flow-based inspection reassembles the entire file before scanning, while proxy-based scans packets on the fly

Answer

Flow-based inspection scans first packet and allows, while proxy-based buffers the entire session

Answer

Flow-based inspection requires SSL deep inspection, while proxy-based does not

Question 3

Which of the following is NOT a valid address object type in FortiGate?

Accepted Answer

MAC address. FortiGate address objects support Subnet, Wildcard FQDN, and Geography types, but MAC addresses are not a valid address object type. MAC addresses are used in other contexts like static ARP entries or DHCP reservations, not as firewall address objects.

Answer

Subnet

Answer

Wildcard FQDN

Answer

Geography

Question 4

An administrator needs to ensure that a firewall policy applies only during business hours (Monday to Friday, 9:00 AM to 6:00 PM). What object should be configured and applied to the policy?

Accepted Answer

Schedule object. A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

Answer

Service group

Answer

Address group

Answer

Traffic shaper

Question 5

A large enterprise is deploying a FortiGate 600F as the perimeter firewall. The security team requires that all administrative access (SSH, HTTPS, and Ping) to the FortiGate must be restricted to a dedicated management network (10.10.10.0/24). Additionally, any failed login attempt from outside the management network should be logged and the source IP should be blocked for 30 minutes. The administrator has configured a local-in policy to deny all administrative access from non-management networks and enabled logging. However, the administrator wants to automatically block the offending IPs. The FortiGate is not connected to any FortiAnalyzer or FortiManager. What should the administrator do to achieve this?

Accepted Answer

Create an automation stitch that triggers on local-in policy logging and adds the source IP to a blocked list via CLI script.. An automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

Answer

Use a FortiAnalyzer to generate alerts and send to SIEM.

Answer

Configure a firewall policy to block the offending IPs manually based on logs.

Answer

Enable 'set block-session-ttl' on the local-in policy.

Question 6

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy must specify the destination address of the traffic, which is the web server at 192.168.2.10. Without an address object for this server, the policy cannot match the destination IP of the VPN users' HTTP requests.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 7

An administrator plans to upgrade FortiGate firmware from version 6.0 to 7.2. The current version is 6.0.10. Which upgrade path is correct?

Accepted Answer

Upgrade to 6.2, then 6.4, then 7.0, then 7.2. FortiGate firmware upgrades must follow a supported path that does not skip major versions. Upgrading from 6.0.10 to 7.2.0 requires stepping through 6.2, 6.4, and 7.0 because Fortinet only supports upgrades from one major version to the next major version (e.g., 6.0→6.2→6.4→7.0→7.2). Option D correctly lists this sequential path.

Answer

Upgrade to 6.4 first, then to 7.2

Answer

It is not possible to upgrade from 6.0 to 7.2

Answer

Direct upgrade from 6.0.10 to 7.2.0 is supported

Question 8

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy B is correct because at 8:00 AM on Saturday, the 'WorkHours' schedule (Mon-Fri 9-17) is not active. FortiGate evaluates policies sequentially; when the first matching policy's schedule is inactive, the firewall skips it and continues to the next policy. Policy B with schedule 'Always' matches and permits the traffic.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 9

A FortiGate has two firewall policies for HTTP traffic to the internet: Policy A (source: 10.0.1.0/24) and Policy B (source: 10.0.2.0/24). Both policies have the same destination and service. The admin wants to apply a traffic shaper to limit bandwidth for Policy B. Which TWO actions are correct? (Choose two.)

Accepted Answer

Create a traffic shaping policy that matches Policy B's source and apply the shaper. A traffic shaping policy can match the source address of Policy B (10.0.2.0/24) and apply a specific shaper, allowing granular bandwidth control without affecting Policy A. Option E is correct because FortiGate allows a traffic shaper to be applied directly within a firewall policy's 'Traffic Shaping' settings, which overrides any default or VDOM-level shaping. Both methods achieve the goal of limiting bandwidth for Policy B only.

Answer

Apply the shaper to both policies and use a different shaper for Policy B

Answer

Use a QoS queue on the outgoing interface

Answer

Enable traffic shaping on the VDOM

Question 10

A FortiGate policy allows traffic from the internal network to a DMZ server. The admin wants to limit access to only specific hours. Which object type should be used in the policy?

Accepted Answer

Schedule. A schedule object is the correct choice because it defines time-based conditions (e.g., specific hours, days, or recurring intervals) that FortiGate applies to firewall policies. By attaching a schedule to a policy, the admin can restrict traffic to the DMZ server only during the permitted hours, such as business hours or maintenance windows.

Answer

Address group

Answer

Service group

Answer

Traffic shaper