NSE4 System and Network Administration — 10 Questions

Question 1

Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)

Accepted Answer

Use the GUI under System > Firmware.. The FortiGate GUI under System > Firmware allows uploading and installing firmware images, a standard upgrade method. Option B is incorrect because the command syntax is reversed; the correct syntax is 'execute upgrade image tftp '. Options C, D, and E are not firmware upgrade commands (they are backup/restore and reboot, respectively). Therefore, only option A is a valid upgrade method among the choices.

Answer

Use the command 'execute upgrade image tftp '.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 2

An administrator needs to configure a FortiGate to send logs to two different syslog servers for redundancy. Which configuration method should be used?

Accepted Answer

Under 'config log syslogd setting', set 'status enable' and then add multiple servers using 'set server '.. FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Answer

Configure two separate log settings for each server.

Answer

Configure one syslog server and use a load balancer.

Answer

Use a FortiAnalyzer to forward logs to syslog servers.

Question 3

Refer to the exhibit. The administrator notices that traffic from internal to wan1 is being logged, but the logs do not show the original source IP. What is the most likely reason?

Accepted Answer

NAT is enabled, so the source IP is replaced with the public IP.. When NAT is enabled on a FortiGate policy, the source IP of internal traffic is translated to the public IP of the FortiGate's WAN interface before the packet is logged. Since logging occurs after NAT processing, the log entries will show the translated (public) IP instead of the original internal source IP. This is the most likely reason the administrator sees logs without the original source IP.

Answer

The schedule is set to 'always', causing no time-based logging.

Answer

Logging is set to 'all' but only 'utma' events are logged.

Answer

The policy action is 'accept' without authentication.

Question 4

A company has a FortiGate 200F with FortiOS 7.2 and two ISPs (WAN1: 100 Mbps, WAN2: 50 Mbps). The company uses SD-WAN to load balance outbound internet traffic. Recently, the company added a new VoIP application that requires low latency and jitter. The administrator configured an SD-WAN rule to match the VoIP traffic and set the strategy to 'best quality' with a performance SLA measuring latency and jitter. However, after testing, the VoIP traffic is still using WAN2 (the slower link) even when WAN1 has lower latency. The performance SLA shows both links meeting the SLA thresholds. What is the most likely reason?

Accepted Answer

The 'best quality' strategy uses bandwidth as a tiebreaker when SLA is met.. When the 'best quality' strategy is used, FortiGate selects the link with the best performance based on the configured SLA metrics. However, if multiple links meet the SLA thresholds, FortiGate uses bandwidth as a tiebreaker, selecting the link with the lowest bandwidth to preserve higher-bandwidth links for other traffic. In this scenario, both WAN1 and WAN2 meet the SLA, so FortiGate selects WAN2 (50 Mbps) because it has lower bandwidth than WAN1 (100 Mbps), causing VoIP traffic to use the slower link despite WAN1 having lower latency.

Answer

The VoIP traffic is being offloaded by NPU bypassing SD-WAN.

Answer

The administrator needs to enable 'set internet-service enable' on the rule.

Answer

The SD-WAN rule is not matching the VoIP traffic correctly.

Question 5

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 6

Which THREE configuration steps are required to enable transparent proxy mode on a FortiGate?

Accepted Answer

Create a firewall policy with explicit proxy enabled. In transparent proxy mode, the FortiGate must intercept web traffic without clients being explicitly configured to use a proxy. Enabling explicit proxy in the firewall policy allows the FortiGate to apply proxy-based security features (like web filtering and antivirus) to traffic that matches the policy, even though the clients are unaware of the proxy. This is a key step to activate transparent proxy inspection on the specified traffic.

Answer

Enable web proxy globally under config system settings

Answer

Assign an IP address to the proxy interface

Question 7

Match each FortiGate security profile component to its purpose.

Accepted Answer

Antivirus profile: Scans files for malware. Antivirus profiles scan for malware, Web filter profiles block malicious websites, IPS profiles detect network attacks, and Application control profiles manage application usage. Common confusions include mixing IPS with Web filter and Antivirus with App Control.

Answer

Antivirus profile: Controls application usage and blocks risky applications

Answer

Web filter profile: Detects and prevents network attacks

Question 8

An administrator runs 'diagnose sniffer packet any "host 10.0.1.100" 4' and sees packets being sent but no response. The FortiGate has a static route for 10.0.1.0/24 via 192.168.1.1. The administrator checks the routing table and sees the route is present. What is the most likely cause of no response?

Accepted Answer

The outgoing interface in the static route is incorrect or down.. The sniffer output shows packets leaving the FortiGate but no reply, indicating a routing delivery problem. Since the static route is present in the routing table, the interface itself is up, but it may be incorrectly specified, causing packets to be sent out the wrong interface and never reach the next-hop (192.168.1.1). Option B is wrong because a policy route would still show packets being sent, but lack of response is more consistent with an incorrect interface. Option C is possible, but the symptoms suggest a routing issue, not a host firewall. Option D is wrong because static routes normally have lower administrative distance than dynamic routes, so they are preferred.

Answer

The FortiGate has a policy route overriding the static route.

Answer

The destination host has a firewall blocking ICMP.

Answer

The static route has a higher administrative distance than a dynamic route.

Question 9

A FortiGate is configured in transparent mode. The administrator notices that traffic passing through the FortiGate is not being logged, even though log all sessions is enabled on the policy. What is the most likely reason?

Accepted Answer

Traffic is being bridged without session creation because the policy is set to 'accept' without logging enabled.. In transparent mode, FortiGate acts as a Layer 2 bridge and does not create sessions for traffic that is simply bridged between interfaces. Even with 'log all sessions' enabled on the policy, if the policy action is 'accept' without explicit logging enabled (i.e., the 'Logging' option is not set to 'All Sessions' or 'Security Events'), the traffic is forwarded without session logging. This is because transparent mode policies require separate logging configuration to generate logs, and the default 'accept' action does not log unless specifically configured.

Answer

The FortiGate is not operating in a VDOM.

Answer

The FortiGate is in transparent mode and cannot log traffic.

Answer

The log memory buffer is full and not sending to syslog.

Question 10

An administrator configures SNMP on a FortiGate to monitor CPU and memory usage. After applying the configuration, the NMS cannot reach the FortiGate via SNMP. The FortiGate's interface has SNMP access enabled. What is the most likely missing configuration?

Accepted Answer

A firewall policy is missing to permit SNMP traffic from the NMS.. The most likely missing configuration is a firewall policy to permit SNMP traffic from the NMS. Even though SNMP access is enabled on the interface, FortiGate uses firewall policies to control all traffic traversing between zones, including management traffic from an NMS. Without an explicit policy allowing UDP ports 161 (SNMP queries) and 162 (traps) from the NMS source to the FortiGate interface, the SNMP requests are dropped by the firewall.

Answer

The SNMP community string is not configured.

Answer

NTP is not configured, causing time mismatch.

Answer

The FortiGate is not configured to send SNMP traps.