NSE4 Practice Test 9 — 10 Questions

Question 1

You are troubleshooting a FortiGate HA cluster (active-passive) and notice that after a failover, some existing TCP sessions are not being maintained. The hbdev heartbeat interfaces are configured correctly, and session synchronization is enabled. What is the MOST likely cause?

Accepted Answer

NPU offloading is enabled on the primary FortiGate. In FortiGate HA, session synchronization relies on NPU offloaded sessions being re-synced. If the NPU offloading was enabled on the primary, sessions might not be fully synced to the backup. Disabling NPU offloading on the primary ensures all sessions are handled by the CPU and thus properly synced.

Answer

The secondary unit is in maintenance mode

Answer

The HA uptime monitor is not configured

Answer

Session pickup is not enabled in the HA configuration

Question 2

A company has two internet connections (WAN1 and WAN2). The administrator wants to route HTTP traffic from the internal network through WAN1, and all other traffic through WAN2. Which TWO configurations are needed?

Accepted Answer

Define an SD-WAN rule that matches HTTP and sets WAN1 as preferred. Option A is correct because SD-WAN rules allow you to define application-based routing policies. By creating an SD-WAN rule that matches HTTP traffic and sets WAN1 as the preferred interface, the FortiGate will automatically steer HTTP sessions out through WAN1 while using the default routing table (which points to WAN2) for all other traffic. This leverages the SD-WAN feature's ability to perform per-application load balancing and failover without requiring policy-based routing.

Answer

Apply NAT with IP pool on the firewall policy

Answer

Add a static route with a lower priority to WAN1

Answer

Configure load balancing between WAN1 and WAN2

Question 3

An administrator needs to allow traffic from a guest network (192.168.100.0/24) to the internet only during business hours (Mon-Fri, 08:00-18:00). The administrator creates a schedule object and applies it to the firewall policy. However, guests can still access the internet outside of the schedule. What is the most likely cause?

Accepted Answer

The schedule is not selected in the firewall policy. Option D is correct. If the schedule is not properly associated with the firewall policy, it will not be enforced. Common mistakes include not selecting the schedule in the policy configuration or selecting the wrong schedule. Option A would affect all policies. Option B is irrelevant to schedule enforcement. Option C is incorrect; schedule is a dedicated object, not part of address.

Answer

The guest network is also allowed by another policy without a schedule

Answer

The schedule object is configured as a group but not applied

Answer

The FortiGate clock is not synchronized with an NTP server

Question 4

A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?

Accepted Answer

The fixed port range is too small, causing port exhaustion. The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Answer

The external server is rate-limiting connections

Answer

The firewall policy has a timeout setting that is too low

Answer

The IP pool has run out of IP addresses

Question 5

An administrator is troubleshooting why traffic from a specific subnet (192.168.10.0/24) to the internet is not being matched by the expected firewall policy. The policy list shows an allow policy for this traffic at ID 10, but there is a deny policy at ID 5 for any traffic from 192.168.0.0/16. Which TWO statements are correct?

Accepted Answer

The deny policy at ID 5 is matching the traffic before the allow policy at ID 10. Option A is correct because FortiGate firewall policies are evaluated sequentially from top to bottom based on their policy ID. Since policy ID 5 (deny for 192.168.0.0/16) appears before policy ID 10 (allow for 192.168.10.0/24), traffic from 192.168.10.0/24 is matched by the broader deny policy first, and the allow policy is never reached. This is a fundamental behavior of FortiGate's policy lookup order.

Answer

The allow policy at ID 10 will override the deny policy because it is more specific

Answer

The traffic will be matched by the implicit deny at the end of the policy list

Answer

The administrator should enable 'policy override' on the allow policy

Question 6

Which of the following is a valid address object type in FortiGate that can be used to match traffic based on the domain name of the destination?

Accepted Answer

FQDN. FQDN address objects allow matching traffic based on fully qualified domain names, which are resolved to IP addresses dynamically.

Answer

Wildcard FQDN

Answer

Subnet

Answer

Geography

Question 7

A FortiGate admin is troubleshooting a policy that should allow VoIP traffic. The admin suspects that the SIP ALG is interfering. Which TWO actions should the admin take to verify or resolve the issue?

Accepted Answer

Disable the SIP ALG on the firewall policy. Option A is correct because disabling the SIP ALG on the firewall policy stops the FortiGate from inspecting and modifying SIP traffic at the application layer. This is a common troubleshooting step when the SIP ALG interferes with VoIP traffic, as it can alter SIP headers or signaling in ways that break compatibility with certain VoIP providers or endpoints.

Answer

Enable 'set sip-nat-trace' on the policy

Answer

Enable 'set ssl-ssh-profile' on the policy

Answer

Increase the session TTL for SIP

Question 8

During a security audit, the administrator runs the command 'diagnose firewall policy list' and sees the following output:
policy id=1: allow from port1 to port2, src=10.0.0.0/8, dst=any, action=accept
policy id=2: deny from port1 to port2, src=10.0.0.0/8, dst=172.16.0.0/12, action=deny
policy id=3: allow from port1 to port2, src=any, dst=any, action=accept
A host with IP 10.0.1.5 sends traffic to 172.16.0.1. Which policy will match?

Accepted Answer

Policy 1. Policy 1 matches because the source IP 10.0.1.5 falls within the 10.0.0.0/8 range, the destination IP 172.16.0.1 is not explicitly matched by policy 2's destination of 172.16.0.0/12 (since 172.16.0.1 is the network address itself and is included, but policy 2 is a deny and is evaluated before policy 3; however, policy 1 is evaluated first due to its lower ID, and since it matches both source and destination with action accept, the traffic is permitted by policy 1 before reaching policy 2). In FortiGate, policies are evaluated sequentially by ID, and the first match is applied.

Answer

Policy 3

Answer

Implicit deny

Answer

Policy 2

Question 9

Which of the following statements about firewall policy ordering in FortiGate is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first match is applied. FortiGate firewall policies are evaluated sequentially from top to bottom in the policy list. The first policy that matches the source, destination, service, and other criteria is applied, and no further policies are evaluated. This is the fundamental 'first-match' behavior that governs traffic processing in FortiGate.

Answer

Policies are evaluated from bottom to top

Answer

The most specific policy always takes precedence regardless of order

Answer

The implicit permit rule at the end allows all traffic not explicitly denied

Question 10

Which TWO statements about firewall policy order are true?

Accepted Answer

Policies are evaluated in the order they appear (top-down). FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Answer

If a packet does not match any policy, it is allowed by default

Answer

A more specific policy should be placed below a less specific one to avoid shadowing

Answer

Once a policy is matched, subsequent policies are still evaluated for logging purposes