NSE4 Practice Test 9 — 10 Questions

Question 1

An administrator has configured an IPS profile to detect SQL injection attacks. However, some SQL injection attempts are still reaching the web server. Which TWO actions should the administrator take to improve detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the IPS signature database. IPS signatures are the primary mechanism for detecting known SQL injection patterns. If attacks are reaching the web server, the signature database is likely outdated or missing recent attack vectors. Updating the signature database ensures the IPS has the latest patterns to match against SQL injection attempts.

Answer

Configure anomaly detection for SQL traffic

Answer

Disable flow-based inspection and use proxy-based only

Answer

Enable SSL deep inspection on the policy

Question 2

A FortiGate has two WAN interfaces (wan1, wan2) configured with ECMP routes to the same destination. The administrator notices that traffic for a single session is being load-balanced across both links, causing performance issues. What should be configured to ensure sessions stick to one link?

Accepted Answer

Change ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based'.. Changing the ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based' ensures that all packets belonging to the same session (identified by source IP or source-destination IP pair) are hashed to the same egress interface. This prevents a single session from being split across multiple WAN links, which can cause out-of-order packets and performance degradation. FortiGate’s ECMP hash algorithm uses the configured method to compute a hash value that deterministically selects the outgoing interface for each flow.

Answer

Set policy routing to use source-based routing.

Answer

Configure SD-WAN rules to enforce per-session stickiness.

Answer

Disable ECMP and use a single default route.

Question 3

An administrator wants to restrict SSL VPN access to only users who have a valid client certificate issued by the company's internal CA. Which setting should be configured?

Accepted Answer

Enable 'require client certificate' in the SSL VPN settings. The 'require client certificate' setting in the SSL VPN portal or interface configuration enforces mutual TLS (mTLS), where the FortiGate requests and validates a client certificate against the configured CA. This ensures that only users presenting a valid certificate issued by the company's internal CA can establish the SSL VPN tunnel, regardless of their authentication credentials.

Answer

Configure a firewall policy with identity-based authentication

Answer

Enable 'certificate-based authentication' in the user group

Answer

Import the users' public keys into the FortiGate

Question 4

Drag and drop the steps to configure a VLAN interface on FortiGate into the correct order.

Accepted Answer

Create VLAN interface, then configure parent interface and VLAN ID, then assign IP address, then enable administrative access.. VLAN interfaces require a physical parent, VLAN ID, IP address, and optional administrative access.

Answer

Assign IP address, then create VLAN interface, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Create VLAN interface, then assign IP address, then configure parent interface and VLAN ID, then enable administrative access.

Answer

Configure parent interface and VLAN ID, then create VLAN interface, then assign IP address, then enable administrative access.

Question 5

An administrator needs to block users from uploading files containing credit card numbers to external websites. Which TWO actions must be configured? (Choose two.)

Accepted Answer

Enable SSL deep inspection on the firewall policy. SSL deep inspection is required to decrypt HTTPS traffic so the firewall can inspect the content of encrypted uploads for sensitive data like credit card numbers. Without decryption, the DLP profile cannot see the payload of encrypted sessions, rendering the DLP sensor ineffective.

Answer

Apply an antivirus profile to the policy

Answer

Configure application control to block file transfer applications

Answer

Use a web filter to block all upload websites

Question 6

Which THREE statements about SD-WAN rules are correct?

Accepted Answer

SD-WAN rules are evaluated in order of priority.. SD-WAN rules are evaluated in order of priority, meaning the rule with the highest priority (lowest number) is matched first. This sequential evaluation ensures deterministic traffic steering based on the most specific match criteria defined by the administrator.

Answer

SD-WAN rules must use a 'load balancing' strategy.

Answer

Each SD-WAN rule can only contain one member.

Question 7

A FortiGate administrator is planning an upgrade from FortiOS 6.4 to 7.2. Which THREE steps should be performed before the upgrade? (Choose three.)

Accepted Answer

Verify hardware compatibility with the target firmware. Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.

Answer

Remove all firewall policies

Answer

Enable automatic firmware checks

Question 8

A FortiGate administrator has configured an active-passive HA cluster with two units. During a failover test, they notice that existing TCP sessions are dropped and must be re-established. What configuration change should the administrator make to ensure sessions are preserved during failover?

Accepted Answer

Enable session synchronization between the cluster members. Session synchronization (session sync) allows the active unit to share session table entries with the passive unit. During failover, the new active unit has the session table pre-populated, so existing sessions continue without interruption.

Answer

Configure a dedicated heartbeat interface

Answer

Enable HA override

Answer

Increase the HA priority on the primary unit

Question 9

An organization uses FortiSandbox to analyze suspicious files. The FortiGate is configured to send files to FortiSandbox for analysis when the antivirus scan fails to reach a verdict. Which antivirus inspection mode must be used on the firewall policy for this integration to work?

Accepted Answer

Proxy-based inspection. Proxy-based inspection buffers the file and can hold the connection until FortiSandbox returns a verdict. Flow-based does not support this hold-and-wait mechanism.

Answer

Both flow and proxy modes support FortiSandbox equally

Answer

Deep inspection

Answer

Flow-based inspection

Question 10

A FortiGate administrator needs to configure a VLAN interface and an aggregate interface. Which THREE statements are correct regarding these interface types?

Accepted Answer

Aggregate interfaces require at least one physical member to be up.. An aggregate interface (LAG) requires at least one physical member port to be administratively and operationally up for the aggregate itself to be considered up. If all member ports are down, the aggregate interface goes down, which is a fundamental behavior of link aggregation groups (LAGs) per IEEE 802.3ad.

Answer

Aggregate interfaces are only supported in NAT/Route mode.

Answer

VLAN interfaces cannot be used in transparent mode.