NSE4 Hard Questions — 25 Difficult Questions

Question 1

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session that has been active for 1 hour and will expire in about 1 hour. The output shows 'proto=6' indicating TCP (protocol 6), 'duration=3600' meaning the session has been active for 3600 seconds (1 hour), and 'expire=3599' meaning the session will expire in 3599 seconds (approximately 1 hour). The 'proto_state=01' indicates a TCP session in the established state (state 1), confirming it is a TCP session.

Answer

The session is a TCP session that has been active for 1 hour and will expire immediately

Answer

The session is a UDP session that has been idle for 3600 seconds

Answer

The session is an ICMP session with a short timeout

Question 2

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

Accepted Answer

The PBR rule's source address does not match the traffic correctly.. Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Answer

The default route has a lower administrative distance than the PBR rule.

Answer

PBR is not supported on FortiGate.

Answer

The PBR rule has a higher priority than the default route.

Question 3

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays the current FSSO login status for all users, including the Fortinet Single Sign-On (FSSO) session information such as username, IP address, and group membership. This command queries the authentication daemon (authd) which maintains the FSSO user database, allowing the administrator to verify if a specific user is authenticated and which firewall policies apply. It directly addresses the scenario where users are logged into the domain but web traffic is blocked, as it confirms whether the FSSO polling has successfully registered the user's login.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and will expire in 3599 seconds. The output shows 'duration=3600' and 'expire=3599', which means the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' indicates the session is in the established state. Therefore, the session is established and has a remaining lifetime of 3599 seconds.

Answer

The session is using UDP protocol

Answer

The session is blocked by the firewall policy

Answer

The session is in SYN-SENT state

Question 5

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Answer

The session is blocked by the firewall

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 6

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP three-way handshake is incomplete; only SYN was sent. protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

Answer

The session is a UDP connection to port 443

Answer

The session will expire in 3600 seconds

Answer

The session has been established for 3600 seconds

Question 7

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Accepted Answer

Assign an IP address to each VLAN subinterface for management. In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Answer

Enable NAT on the policies to translate addresses between VLANs

Answer

Configure static routes to route between VLANs

Question 8

Which THREE conditions must be met for a firewall policy with FSSO authentication to work correctly?

Accepted Answer

The FortiGate must be able to communicate with the domain controller. FSSO (Fortinet Single Sign-On) relies on the FortiGate communicating with the domain controller to retrieve user login events via NetAPI or WMI. Without this communication, the FortiGate cannot map user identities to IP addresses, which is essential for FSSO-based authentication in firewall policies.

Answer

The user's IP address must be in the destination address range of the policy

Answer

The user must be authenticated to the FortiGate locally

Question 9

A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?

Accepted Answer

There is no firewall policy permitting traffic from the dial-up interface to the destination network. Even when Phase 1 and Phase 2 are up and the tunnel is established, traffic will not pass through a dial-up IPsec VPN unless a firewall policy explicitly permits traffic from the dial-up interface (often the virtual IPsec interface) to the destination network. The 'diagnose sys session list' showing no sessions for the remote user's IP confirms that the FortiGate is not processing any traffic for that user, which points to a missing or misconfigured firewall policy rather than an encryption or routing issue.

Answer

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Answer

The FortiGate's routing table does not have a route to the remote user's subnet

Answer

The remote user's FortiClient is blocking split tunneling

Question 10

A FortiGate is configured with multiple VDOMs. The administrator creates a firewall policy in VDOM A that allows traffic from VDOM A to VDOM B using inter-VDOM links. Users in VDOM A can initiate traffic, but return traffic from VDOM B is not reaching them. What is the MOST likely cause?

Accepted Answer

The reverse path forwarding (RPF) check is blocking return traffic. In a multi-VDOM FortiGate, inter-VDOM traffic requires firewall policies in both involved VDOMs to establish a session. Once the initial session is successfully established, return traffic is handled by the session table and does not require a separate policy. If users in VDOM A can initiate traffic, the policies in both VDOMs for the forward direction must exist. The failure of return traffic is therefore more likely due to a reverse path forwarding (RPF) check, which validates that the source address of a packet is reachable via the interface on which the packet arrived. If the return path uses an asymmetric route, the RPF check may drop the packets.

Answer

The inter-VDOM link is down

Answer

The session helper is not configured for the application

Answer

A firewall policy is missing in VDOM B to allow return traffic

Question 11

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface

Question 12

A FortiGate configured with IPS anomaly detection is generating false positives for the 'tcp_syn_flood' anomaly. The administrator wants to reduce the false positives without completely disabling the detection. Which action should the administrator take?

Accepted Answer

Increase the threshold value. Increasing the threshold value reduces false positives by requiring a higher rate of TCP SYN packets per second before the 'tcp_syn_flood' anomaly triggers an alert or action. This allows legitimate traffic bursts to pass without being flagged, while still detecting genuine SYN flood attacks. The threshold defines the sensitivity of the anomaly detection; raising it makes the detection less sensitive to low-volume spikes.

Answer

Disable the anomaly and use a custom IPS signature

Answer

Decrease the threshold value

Answer

Set the action to 'pass'

Question 13

Which THREE factors should be considered when tuning IPS to reduce false positives?

Accepted Answer

Excluding trusted source IP addresses from certain signatures.. Excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

Answer

Enabling hardware acceleration for IPS processing.

Answer

Increasing the sensitivity of signatures to catch more attacks.

Question 14

An administrator runs 'diagnose debug application ike -1' and sees the following output:
ike 0:come to x.x.x.x:500, IKEv1, cookie 123456789abcdef0
ike 0:incoming IKE packet: src y.y.y.y:500, dst x.x.x.x:500, len 456
ike 0:send IKE packet: src x.x.x.x:500, dst y.y.y.y:500, len 456
ike 0:phase 1 negotiation failed due to time out.
What is the likely cause?

Accepted Answer

A firewall rule is blocking UDP 500/4500 between the peers. The output shows that the IKE packet is being sent and received (no proposal mismatch or interface down), but the negotiation fails due to a timeout. This indicates that the packet is leaving the local FortiGate but the response is not arriving back, which is classic behavior when a firewall (or ACL) between the peers is blocking UDP 500 or 4500. The timeout occurs because the remote peer never receives the initial packet or the local peer never receives the reply, preventing any IKE exchange from completing.

Answer

The remote FortiGate's Phase 1 proposal does not match

Answer

The pre-shared key is incorrect

Answer

The local FortiGate's external interface is down

Question 15

A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?

Accepted Answer

Install the FortiGate's CA certificate on all client machines in the trusted root store. The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.

Answer

Use a publicly trusted CA certificate for the FortiGate

Answer

Disable deep inspection and use certificate inspection only

Answer

Add the websites to the exemption list in the SSL/SSH profile

Question 16

An administrator configures SSL deep inspection with a CA certificate. Users accessing an internal site (internal.company.com) receive a certificate error. The administrator wants to avoid the error without disabling deep inspection. What should be done?

Accepted Answer

Add internal.company.com to the SSL/SSH inspection exemption list. Adding internal.company.com to the SSL/SSH inspection exemption list tells the FortiGate to bypass deep inspection for that specific site, allowing the internal CA certificate to be used without triggering a certificate error. This avoids the error while keeping deep inspection enabled for all other traffic, which is the administrator's goal.

Answer

Replace the CA certificate with a self-signed one

Answer

Use certificate inspection instead of deep inspection

Answer

Disable certificate validation in the deep inspection profile

Question 17

A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?

Accepted Answer

The FortiGate can block HTTPS connections based on the certificate's CN. Certificate Inspection only examines the SSL/TLS certificate presented during the handshake, without decrypting the traffic. Because the FortiGate can read the certificate's Common Name (CN) or Subject Alternative Name (SAN), it can block HTTPS connections based on that information, such as by using a URL filter or application control rule that matches the certificate's CN. This is the only deep inspection action possible without full decryption.

Answer

Deep inspection can still see client certificates

Answer

The antivirus profile can scan the HTTPS payload

Answer

IPS can still inspect the application layer of HTTPS traffic

Question 18

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

Accepted Answer

The firewall policy for HTTPS traffic is missing or has incorrect destination. The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.

Answer

The server's HTTPS service is not running

Answer

VIPs cannot share the same public IP address

Answer

The HTTPS VIP is configured with the wrong internal port

Question 19

During an SSL VPN tunnel mode connection, the client reports that they cannot access any internal resources, but the VPN connection is established. The FortiGate debug shows 'no matching policy'. The administrator has configured a policy allowing the SSL VPN interface to internal. What else must be configured?

Accepted Answer

Ensure the incoming interface of the policy is set to 'ssl.root' (or the SSL VPN interface). The SSL VPN tunnel mode creates a virtual interface (typically named 'ssl.root' or 'ssl.VDOM') on the FortiGate. Even though the administrator configured a policy allowing the SSL VPN interface to internal, the incoming interface in the policy must explicitly be set to this SSL VPN interface. If it is set to a different interface (e.g., the physical WAN interface), the FortiGate will not match the traffic from the SSL VPN tunnel, resulting in the 'no matching policy' debug message.

Answer

Add the client's assigned IP to a local user group

Answer

Configure a static route on the FortiGate for the client's tunnel IP

Answer

Enable split tunneling on the SSL VPN portal

Question 20

An administrator configures a DLP profile to detect credit card numbers in email traffic. The DLP rule uses a regular expression. However, the DLP sensor is not triggering on emails containing credit card numbers. What is a likely reason?

Accepted Answer

SSL deep inspection is not enabled on the policy. DLP sensors inspecting email traffic require SSL deep inspection to decrypt the SMTP traffic if it is encrypted via TLS (STARTTLS). Without SSL deep inspection enabled on the firewall policy, the FortiGate cannot see the plaintext content of encrypted emails, so the DLP regular expression will never match credit card numbers. This is the most likely reason the DLP sensor is not triggering.

Answer

The regular expression is case-sensitive and credit card numbers are lowercase

Answer

The DLP sensor is configured to 'monitor' only

Answer

The DLP profile is applied to the inbound policy only