NSE4 Hard Questions — 25 Difficult Questions

Question 1

An administrator needs to ensure that all HTTPS traffic to a critical server is inspected by the IPS. The server uses a valid certificate from a public CA. Which THREE steps are required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an IPS profile to the same firewall policy. Options A, C, and D are required. SSL deep inspection must be enabled on the firewall policy (D), an IPS profile must be applied to the same policy (A), and the FortiGate's CA certificate must be installed on client browsers (C) to prevent certificate warnings. Option E is unnecessary because the FortiGate does not need the server's private certificate; it can re-sign the server's certificate with its own CA.

Answer

Set the Antivirus profile to 'Deep Inspection'

Answer

Upload the server's certificate to the FortiGate

Question 2

An administrator configures FSSO (Fortinet Single Sign-On) with Active Directory polling. Users report that their web traffic is being blocked by the firewall even though they are logged into the domain. Which CLI command can the administrator use to verify the FSSO login status for a specific user?

Accepted Answer

diagnose debug authd fsso list. The command 'diagnose debug authd fsso list' displays the current FSSO login status for all users, including the Fortinet Single Sign-On (FSSO) session information such as username, IP address, and group membership. This command queries the authentication daemon (authd) which maintains the FSSO user database, allowing the administrator to verify if a specific user is authenticated and which firewall policies apply. It directly addresses the scenario where users are logged into the domain but web traffic is blocked, as it confirms whether the FSSO polling has successfully registered the user's login.

Answer

diagnose user fsso poll user <username>

Answer

diagnose wad user list

Answer

diagnose test authserver ldap

Question 3

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 4

An administrator runs the command 'diagnose ips anomaly list' and sees many entries for 'tcp_src_session' with high counts. Users report slow internet. What is the most likely issue?

Accepted Answer

A host on the network is infected with malware that is generating many outbound connections. The 'diagnose ips anomaly list' command displays anomalies detected by the IPS engine, and 'tcp_src_session' tracks the number of TCP sessions originating from a single source IP. A high count indicates a single host is initiating an excessive number of outbound TCP connections, which is a classic sign of malware infection (e.g., a botnet client or worm) that is generating numerous outbound connections, consuming bandwidth and causing slow internet for users.

Answer

The IPS signature database is corrupted

Answer

The FortiGate has a hardware failure

Answer

The FortiGate is under a DDoS attack

Question 5

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Accepted Answer

Assign an IP address to each VLAN subinterface for management. In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Answer

Enable NAT on the policies to translate addresses between VLANs

Answer

Configure static routes to route between VLANs

Question 6

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

Accepted Answer

The firmware image file is corrupted or not compatible with the platform. When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Answer

The FortiGate was in HA mode and the peer did not upgrade

Answer

The admin did not reboot after the upgrade

Answer

The admin forgot to save the configuration before upgrading

Question 7

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 8

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. In NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 9

An administrator configures an HA cluster of two FortiGates in active-passive mode. The cluster is synchronized, but after a failover, some existing TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization (session-pickup) is disabled. Session synchronization (session-pickup) is required for active-passive HA clusters to replicate TCP session state from the primary FortiGate to the secondary. When disabled, the backup unit has no knowledge of existing sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in NAT mode

Answer

The cluster is using a virtual MAC address for the HA interface

Question 10

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. The HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 11

An admin notices that a firewall policy allowing inbound HTTPS to a server is not matching traffic. The policy has source set to 'all', destination to the server's IP, and service to HTTPS. The admin checks the policy list and sees that policy ID 1 matches the traffic. What is the MOST likely reason the intended policy (ID 10) is not matching?

Accepted Answer

Policy ID 1 has a higher priority and matches before policy ID 10. Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

Answer

The firewall policy is disabled

Answer

The service object for HTTPS is misconfigured in policy ID 10

Answer

The destination address is incorrect in policy ID 10

Question 12

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Accepted Answer

Enable VLAN forwarding on the bridge. In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Answer

Create static routes for each VLAN subnet

Answer

Disable antivirus inspection on the policy

Answer

Assign IP addresses to the internal interfaces

Question 13

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session has been active for 1 hour and will expire in about 1 hour. The output shows `duration=3600` (seconds), meaning the session has been active for 1 hour, and `expire=3599` (seconds), meaning the session will expire in about 1 hour (3600 seconds minus 1 second already elapsed). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to an established TCP session. Therefore, option A is correct.

Answer

The session is blocked by the firewall

Answer

The session is using UDP protocol

Answer

The session is in a half-open state

Question 14

A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?

Accepted Answer

The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.. When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.

Answer

The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.

Answer

The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.

Answer

The user will see a warning about the certificate but will be able to proceed after accepting it.

Question 15

A FortiGate has a policy-based NAT rule that translates source IPs from subnet 192.168.1.0/24 to 203.0.113.10 when accessing the internet. The admin also enables Central SNAT with a rule that translates the same subnet to 203.0.113.20. If both are configured, which translation will be applied to traffic from 192.168.1.0/24 to the internet?

Accepted Answer

Policy-based NAT because it is evaluated first. Policy-based NAT is evaluated before Central SNAT because it is directly tied to the firewall policy that matches the traffic. When a policy-based NAT rule exists for the same traffic, it takes precedence over Central SNAT rules, regardless of any global settings or rule IDs. Therefore, the source IPs from 192.168.1.0/24 will be translated to 203.0.113.10.

Answer

Both translations will be applied, causing an error

Answer

Central SNAT because it is a global setting

Answer

The FortiGate will use the translation from the policy with the highest ID

Question 16

An admin configures a central SNAT rule to translate source IP 10.0.0.0/24 to IP pool 203.0.113.1-203.0.113.10 using overload (PAT). A policy-based NAT on a specific policy also translates the same source to the interface IP. Traffic from 10.0.0.0/24 to the internet shows source IP as the interface IP, not from the IP pool. What is the reason?

Accepted Answer

Policy-based NAT overrides central SNAT rules. Policy-based NAT (PBNAT) takes precedence over central SNAT rules because it is applied directly to a specific firewall policy. When a policy matches traffic, its NAT configuration (including translation to the interface IP) is evaluated before any central SNAT rules. This override occurs regardless of the central SNAT rule's order or status, as PBNAT is considered more specific and thus higher priority in FortiOS.

Answer

The central SNAT rule is disabled

Answer

The policy is using fixed port range

Answer

The IP pool is out of addresses

Question 17

Which THREE conditions must be met for a firewall policy with FSSO authentication to work correctly?

Accepted Answer

The FortiGate must be able to communicate with the domain controller. FSSO (Fortinet Single Sign-On) relies on the FortiGate communicating with the domain controller to retrieve user login events via NetAPI or WMI. Without this communication, the FortiGate cannot map user identities to IP addresses, which is essential for FSSO-based authentication in firewall policies.

Answer

The user's IP address must be in the destination address range of the policy

Answer

The user must be authenticated to the FortiGate locally

Question 18

A FortiGate administrator is troubleshooting a dial-up IPsec VPN where remote users can connect but traffic does not pass. The Phase 1 and Phase 2 status show 'up'. The administrator runs 'diagnose vpn tunnel list' and sees the tunnel is up. However, 'diagnose sys session list' shows no sessions for the remote user's IP. What is the MOST likely cause?

Accepted Answer

There is no firewall policy permitting traffic from the dial-up interface to the destination network. Even when Phase 1 and Phase 2 are up and the tunnel is established, traffic will not pass through a dial-up IPsec VPN unless a firewall policy explicitly permits traffic from the dial-up interface (often the virtual IPsec interface) to the destination network. The 'diagnose sys session list' showing no sessions for the remote user's IP confirms that the FortiGate is not processing any traffic for that user, which points to a missing or misconfigured firewall policy rather than an encryption or routing issue.

Answer

The Phase 2 proposal uses AES256 but the remote client only supports AES128

Answer

The FortiGate's routing table does not have a route to the remote user's subnet

Answer

The remote user's FortiClient is blocking split tunneling

Question 19

A FortiGate is configured with multiple VDOMs. The administrator creates a firewall policy in VDOM A that allows traffic from VDOM A to VDOM B using inter-VDOM links. Users in VDOM A can initiate traffic, but return traffic from VDOM B is not reaching them. What is the MOST likely cause?

Accepted Answer

The reverse path forwarding (RPF) check is blocking return traffic. In a multi-VDOM FortiGate, inter-VDOM traffic requires firewall policies in both involved VDOMs to establish a session. Once the initial session is successfully established, return traffic is handled by the session table and does not require a separate policy. If users in VDOM A can initiate traffic, the policies in both VDOMs for the forward direction must exist. The failure of return traffic is therefore more likely due to a reverse path forwarding (RPF) check, which validates that the source address of a packet is reachable via the interface on which the packet arrived. If the return path uses an asymmetric route, the RPF check may drop the packets.

Answer

The inter-VDOM link is down

Answer

The session helper is not configured for the application

Answer

A firewall policy is missing in VDOM B to allow return traffic

Question 20

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface