NSE4 Practice Test 9 — 10 Questions

Question 1

A company requires two-factor authentication for SSL VPN access. They already have an LDAP server for user credentials. Which TWO components are necessary to implement this?

Accepted Answer

FortiToken hardware or mobile tokens. FortiToken hardware or mobile tokens provide the second factor (something you have) required for two-factor authentication. The LDAP server supplies the first factor (something you know) via user credentials. Together, they satisfy the two-factor requirement for SSL VPN access on FortiGate.

Answer

FortiAuthenticator

Answer

RADIUS server

Answer

Certificate Authority (CA)

Question 2

A company is deploying FortiGate for outbound web filtering. They want to block users from accessing social media sites during business hours, but still allow access to cloud-based productivity tools like Office 365. Which approach should the administrator use to meet this requirement?

Accepted Answer

Configure an application control profile with rules to block social media applications and allow Office 365 applications.. Application control is the correct approach because it can identify and control applications like social media and Office 365 based on their unique signatures, regardless of the ports or protocols they use. Unlike URL filtering or port blocking, application control can differentiate between Office 365 traffic and social media traffic even when both use HTTPS on TCP 443, allowing the administrator to block social media while permitting cloud productivity tools.

Answer

Create a firewall policy to block all traffic to ports commonly used by social media (e.g., TCP 443).

Answer

Use a web filter profile to block URLs containing 'facebook' or 'twitter'.

Answer

Implement a DNS filter to block DNS queries for social media domains.

Question 3

An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?

Accepted Answer

Policy-based routing (PBR) configured with a policy matching the destination and service. Policy-based routing (PBR) allows you to override the routing table based on match criteria such as source/destination IP, port, or protocol. In this scenario, you create a PBR policy that matches destination 203.0.113.50 and service TCP/443, then sets the next-hop to the WAN2 gateway. This ensures that only traffic to that specific web service exits via WAN2, while all other traffic follows the default route via WAN1.

Answer

Central NAT policy to force the traffic out of WAN2

Answer

Static route with a higher priority for WAN2 to 203.0.113.0/24

Answer

SD-WAN with a strategy of 'Best Quality'

Question 4

An administrator wants to block an application named 'Skype' on the network. They create an application control profile and add a rule to block 'Skype'. However, after applying the profile to the policy, users can still use Skype. What is the most likely reason?

Accepted Answer

Skype traffic is encrypted and SSL deep inspection is not enabled. Skype uses proprietary encryption and often relies on peer-to-peer connections that bypass traditional port-based inspection. Without SSL deep inspection (also known as HTTPS inspection or certificate-based decryption), the FortiGate cannot decrypt the encrypted Skype traffic to match it against the application control signature. Application control relies on either protocol decoders or deep packet inspection (DPI) to identify applications; if the traffic is encrypted and not decrypted, the FortiGate sees only encrypted payloads and cannot apply the block rule.

Answer

The application control profile is not enabled on the firewall policy

Answer

The application signature for Skype is outdated

Answer

The application control rule is set to 'monitor' instead of 'block'

Question 5

A FortiGate administrator wants to configure a dial-up IPsec VPN where remote users connect using VPN clients with pre-shared key authentication. The company has recently experienced a data breach where the PSK was compromised. What is the best method to improve security without changing all clients immediately?

Accepted Answer

Migrate to certificate-based authentication for Phase 1. Migrating to certificate-based authentication eliminates reliance on a static pre-shared key (PSK), which is inherently vulnerable to compromise. Certificates provide asymmetric cryptographic proof of identity, ensuring that even if a PSK is leaked, the attacker cannot authenticate without a valid certificate. This is the most robust long-term fix for PSK compromise in IPsec VPNs.

Answer

Switch to aggressive mode with a complex PSK

Answer

Enable XAuth with a second authentication factor using FortiToken

Answer

Increase the PSK length to 64 characters

Question 6

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

Accepted Answer

In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload. The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.

Answer

Create a central SNAT policy with the source as the mail server and the translated IP as the desired address

Answer

Use a VIP with port forwarding to translate the source

Answer

Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool

Question 7

What is the primary advantage of using route-based IPsec VPN over policy-based IPsec VPN?

Accepted Answer

Route-based VPN allows the use of dynamic routing protocols over the tunnel. Route-based IPsec VPNs create a virtual tunnel interface (e.g., `tunnel` or `ipsec` interface) that acts as a logical routing endpoint. This allows the tunnel to participate in dynamic routing protocols like OSPF or BGP, enabling automatic route advertisement and failover across the VPN. Policy-based VPNs, in contrast, rely on static security policies that match traffic based on source/destination addresses and ports, which cannot be dynamically updated by routing protocols.

Answer

Route-based VPN requires fewer firewall policies

Answer

Route-based VPN is easier to configure for hub-and-spoke

Answer

Route-based VPN supports higher encryption algorithms

Question 8

An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?

Accepted Answer

The remote network in Phase 2 is set to 10.0.0.0/8. The most likely cause is that the remote network (client subnet) in the Phase 2 configuration on the VPN gateway is set to 10.0.0.0/8 instead of the correct value (0.0.0.0/0) for dial-up clients. Since Phase 1 succeeds, authentication and encryption settings are correct. The 'no proposal chosen' error in Phase 2 indicates a traffic selector mismatch: the server expects the client's IP to be within the 10.0.0.0/8 range, but the client's actual IP typically falls outside that subnet. Therefore, the Phase 2 negotiation fails.

Answer

The remote network in Phase 2 is set to 0.0.0.0/0

Answer

The Phase 1 encryption algorithm is mismatched

Answer

The authentication type requires EAP instead of certificate

Question 9

An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?

Accepted Answer

Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.. In a hub-and-spoke IPsec VPN topology, the hub must have Phase 2 selectors set to 0.0.0.0/0 (any-to-any) so that it can negotiate a single IPsec SA that covers all possible spoke-to-spoke traffic. This allows the hub to decrypt traffic from one spoke and re-encrypt it for another spoke without requiring separate Phase 2 selectors for each spoke pair. Additionally, firewall policies on the hub must explicitly permit traffic between the spoke networks, as the hub acts as a router forwarding inter-spoke traffic.

Answer

Enable NAT on the hub's tunnel interface.

Answer

Configure the hub as a DNS server for the spokes.

Answer

Configure IKEv2 instead of IKEv1 on all tunnels.

Question 10

After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?

Accepted Answer

The next-hop IP is not directly connected to any FortiGate interface. In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.

Answer

FortiGate now requires a default administrative distance of 10 for static routes

Answer

The route was deleted during the upgrade and needs to be re-added

Answer

The remote gateway is down