NSE4 Hard Questions — 25 Difficult Questions

Question 1

An administrator is configuring an IPS profile on FortiGate to detect and block SQL injection attacks. The profile must be applied to inbound traffic to a web server. Which TWO settings should the administrator enable to achieve this goal? (Choose two.)

Accepted Answer

Add the 'SQL.Injection' signature to the IPS sensor and set action to 'block'.. Option A is correct because SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Answer

Create a DoS policy to limit the number of connections per second.

Answer

Enable the HTTP protocol decoder in the application control profile.

Answer

Configure the IPS sensor to bypass traffic from trusted IP addresses.

Question 2

Which TWO are best practices for configuring IPsec VPN on FortiGate to ensure high availability and security?

Accepted Answer

Enable perfect forward secrecy (PFS) for phase2 to ensure session keys are not compromised if a private key is stolen.. Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Answer

Disable DPD on the phase1 interface to reduce overhead.

Answer

Use aggressive mode for faster IKE negotiation.

Answer

Disable PFS to reduce CPU load on the firewall.

Question 3

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Accepted Answer

Enable UDP session synchronization.. Option A is correct because UDP session synchronization must be enabled to replicate UDP session state between HA cluster members, ensuring that active sessions for voice traffic (which typically uses UDP) are seamlessly taken over by the standby unit during a failover. Without this setting, UDP sessions are not synchronized by default, and voice calls would drop.

Answer

Set HA override to enabled.

Answer

Enable configuration synchronization.

Answer

Set failover hold time to 1 second.

Question 4

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Accepted Answer

The gateway 203.0.113.1 (port1) is unreachable. When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

Answer

The second route is overwriting the first route

Answer

Both routes are equal-cost and load-balancing is not working

Answer

The configuration is invalid because duplicate default routes are not allowed

Question 5

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

Accepted Answer

No NAT policy is configured for internal users. The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Answer

The default route is incorrectly configured

Answer

An implicit deny policy is blocking traffic from internal to external

Answer

External access profile is set to read-only

Question 6

Refer to the exhibit. An administrator runs 'diagnose firewall auth list' and sees two authenticated users. The firewall policy requires authentication for HTTP traffic from 10.0.0.0/24 to 192.168.1.10. User 'jsmith' has been idle for 20 minutes, but the authentication session is still active. The idle timeout is set to 30 minutes. What will happen after 30 minutes of inactivity?

Accepted Answer

The authentication session will expire, and the user must re-authenticate for new traffic. Option D is correct because the authentication idle timeout of 30 minutes governs the authentication session, not the firewall session. Once the user 'jsmith' has been idle for 30 minutes, the authentication session expires. Any new HTTP traffic from 10.0.0.0/24 to 192.168.1.10 will then require re-authentication, as the firewall policy enforces authentication for that traffic. The existing firewall session may persist briefly, but it will not allow new traffic without a valid authentication entry.

Answer

The authentication session will remain active because the firewall session is still valid

Answer

The user will be automatically re-authenticated without prompting

Answer

The firewall session will be torn down immediately

Question 7

A company with multiple remote sites uses IPsec VPNs. One site reports intermittent connectivity. The administrator checks the logs and sees 'IPsec phase 2 negotiation failed' messages. Which configuration change is most likely to resolve the issue?

Accepted Answer

Enable Dead Peer Detection (DPD) on the Phase 1 interface.. Intermittent IPsec phase 2 negotiation failures often occur when one peer's Phase 2 security association (SA) expires while the other peer still considers it valid, causing a mismatch. Enabling Dead Peer Detection (DPD) on the Phase 1 interface allows the FortiGate to actively probe the peer's liveness and renegotiate Phase 1 and Phase 2 SAs before they expire, preventing the state mismatch that leads to intermittent failures.

Answer

Change the encryption algorithm from AES256 to 3DES.

Answer

Increase the Phase 2 lifetime.

Answer

Enable NAT traversal.

Question 8

A FortiGate administrator is troubleshooting a high CPU usage issue. The 'get system performance status' command shows that the CPU usage is consistently above 80% with no traffic. Which of the following is the most likely cause?

Accepted Answer

A process such as the IPS engine is stuck in an infinite loop.. When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.

Answer

An interface is in error-disable state causing CPU interrupts.

Answer

The firewall policy is misconfigured, causing packet drops.

Answer

A DDoS attack is overwhelming the CPU.

Question 9

An administrator needs to configure a FortiGate to send logs to two different syslog servers for redundancy. Which configuration method should be used?

Accepted Answer

Under 'config log syslogd setting', set 'status enable' and then add multiple servers using 'set server '.. Option A is correct because FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Answer

Configure two separate log settings for each server.

Answer

Configure one syslog server and use a load balancer.

Answer

Use a FortiAnalyzer to forward logs to syslog servers.

Question 10

A large enterprise is deploying a FortiGate 600F as the perimeter firewall. The security team requires that all administrative access (SSH, HTTPS, and Ping) to the FortiGate must be restricted to a dedicated management network (10.10.10.0/24). Additionally, any failed login attempt from outside the management network should be logged and the source IP should be blocked for 30 minutes. The administrator has configured a local-in policy to deny all administrative access from non-management networks and enabled logging. However, the administrator wants to automatically block the offending IPs. The FortiGate is not connected to any FortiAnalyzer or FortiManager. What should the administrator do to achieve this?

Accepted Answer

Create an automation stitch that triggers on local-in policy logging and adds the source IP to a blocked list via CLI script.. Option A is correct because an automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

Answer

Use a FortiAnalyzer to generate alerts and send to SIEM.

Answer

Configure a firewall policy to block the offending IPs manually based on logs.

Answer

Enable 'set block-session-ttl' on the local-in policy.

Question 11

Which TWO statements about IPS in FortiGate are true?

Accepted Answer

IPS can be applied to individual firewall policies via IPS sensors.. Option A is correct because IPS sensors are applied directly to individual firewall policies, allowing granular control over which traffic is inspected for intrusions. This enables administrators to enforce different IPS profiles for different traffic flows, such as applying a stricter sensor to internet-bound traffic and a lighter one to internal traffic.

Answer

An IPS sensor can only be applied to one firewall policy.

Answer

IPS is not supported in transparent mode.

Answer

IPS only works in flow-based inspection mode.

Question 12

Which THREE factors should be considered when tuning IPS to reduce false positives?

Accepted Answer

Excluding trusted source IP addresses from certain signatures.. Option A is correct because excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

Answer

Enabling hardware acceleration for IPS processing.

Answer

Increasing the sensitivity of signatures to catch more attacks.

Question 13

An administrator attempts to configure a policy route to route specific traffic from an internal subnet (10.1.1.0/24) to the internet via a different ISP. The policy route is created but traffic is still using the default route. What is the most likely cause?

Accepted Answer

The outgoing interface in the policy route is down.. Policy routes in FortiGate have a higher priority than static routes, but they are only applied if the specified outgoing interface is operationally up. If the outgoing interface is down, the policy route is skipped, and traffic falls back to the default route. This is the most likely cause because the administrator confirmed the policy route was created but traffic still uses the default route.

Answer

The policy route is not using the correct source interface.

Answer

The destination address in the policy route is incorrect.

Answer

The static default route has a lower administrative distance than the policy route.

Question 14

You run the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and see this output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is using TCP and has been open for 3600 seconds with a remaining lifetime of 3599 seconds, indicating it is a long-lived session. Option B is correct because the output shows a TCP session (proto=6) with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 3600 seconds and will be removed in 3599 seconds if no further traffic is seen. This indicates a long-lived session, typical for persistent connections like HTTPS, where the session timer resets with each packet.

Answer

The session is a TCP connection that has been active for 1 hour and will expire in 3599 seconds

Answer

The session is UDP (proto=6 is TCP? Actually proto=6 is TCP) and the output indicates an ICMP error

Answer

There is a problem because the session duration equals the expire time, meaning it will be removed immediately

Question 15

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure voice traffic uses the interface with the lowest latency. Which SD-WAN configuration should be used?

Accepted Answer

Configure an SD-WAN rule with a performance SLA that monitors latency and set strategy to 'Best Quality'. Option C is correct because SD-WAN rules with a performance SLA allow the FortiGate to monitor real-time latency on each WAN interface and dynamically route voice traffic to the interface with the lowest latency. The 'Best Quality' strategy selects the best-performing interface based on the SLA metrics, ensuring optimal voice quality.

Answer

Set the strategy to 'Manual'

Answer

Set the strategy to 'Load Balance'

Answer

Use policy-based routing with a higher priority for voice traffic

Question 16

An organization has two FortiGate units in an HA cluster. They need to perform a firmware upgrade on the primary unit without causing a failover. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a graceful failover, then upgrade the original primary. Option D is correct because in an HA cluster, upgrading the secondary unit first ensures that the primary remains active and can take over if the upgrade fails. After the secondary is upgraded and stable, a graceful failover is performed to make it the new primary, allowing the original primary to be upgraded without causing an unplanned failover or service interruption.

Answer

Upgrade the primary unit first, then the secondary will automatically synchronize

Answer

Upgrade both units simultaneously using the GUI

Answer

Disable HA, upgrade both, then re-enable HA

Question 17

A FortiGate administrator is planning an upgrade from FortiOS 6.4 to 7.2. Which THREE steps should be performed before the upgrade? (Choose three.)

Accepted Answer

Verify hardware compatibility with the target firmware. Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.

Answer

Remove all firewall policies

Answer

Enable automatic firmware checks

Question 18

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.. Option C is correct because the output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Answer

The session is an ICMP session with state 01 and expires in 1 second.

Answer

The session is a UDP session to port 443 and has been active for 3600 seconds.

Answer

The session is a TCP session that has timed out and will be removed in 3599 seconds.

Question 19

A FortiGate configured in NAT/Route mode is connected to the internet via port1 with an IP 10.0.0.1/24. The internal network uses 192.168.1.0/24. Users can browse the internet but cannot reach a public server at 203.0.113.5. A static default route exists. What is the most likely cause?

Accepted Answer

The firewall policy for outbound traffic does not have NAT enabled. Option C is correct because in NAT/Route mode, outbound traffic from a private IP (192.168.1.0/24) to a public internet destination requires source NAT (masquerading) to translate the private source IP to the interface IP (10.0.0.1). Without NAT enabled on the firewall policy, the FortiGate forwards the packet with the original private source IP, which is not routable on the public internet, so the return traffic cannot reach the internal host. The static default route exists and users can browse other sites, indicating routing is functional, but the specific public server is unreachable due to missing NAT.

Answer

The static default route points to the wrong gateway

Answer

The public server is down

Answer

The DNS server is not configured

Question 20

An administrator configures a FortiGate HA cluster with two units in active-passive mode. After setup, the secondary unit shows 'standby' status but traffic is not failing over when the primary is shut down. What is the most likely cause?

Accepted Answer

The primary unit's configuration changes were not synchronized to the secondary.. Option D is correct because in an active-passive HA cluster, the secondary unit must have a synchronized copy of the primary's configuration to take over traffic. If configuration synchronization is not enabled or fails, the secondary remains in standby but lacks the necessary policies and settings to handle traffic, so failover does not occur even though HA status appears normal.

Answer

The HA heartbeat interface is not configured on the same subnet.

Answer

The cluster is in active-active mode.

Answer

The session failover feature is disabled.