NSE4 System and Network Administration — 30 Questions

Question 1

A company wants to ensure that administrative access to FortiGate is only allowed from the internal trusted network (192.168.1.0/24) and that all other access attempts are blocked. Which CLI command should the administrator configure first?

Accepted Answer

config system admin; edit admin; set trusthost 192.168.1.0 255.255.255.0; end. Option A is correct because the `config system admin` command with `set trusthost` restricts administrative login attempts to only the specified source IP address or subnet. By setting `trusthost 192.168.1.0 255.255.255.0`, the FortiGate will only allow admin access from the 192.168.1.0/24 network, blocking all other sources. This is the foundational step to enforce source-based access control for administrative interfaces.

Answer

config system interface; edit port1; set allowaccess ping https ssh; end

Answer

config system global; set admin-http-redirect enable; end

Answer

set admin-sport 443

Question 2

A FortiGate administrator is troubleshooting a high CPU usage issue. The 'get system performance status' command shows that the CPU usage is consistently above 80% with no traffic. Which of the following is the most likely cause?

Accepted Answer

A process such as the IPS engine is stuck in an infinite loop.. When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.

Answer

An interface is in error-disable state causing CPU interrupts.

Answer

The firewall policy is misconfigured, causing packet drops.

Answer

A DDoS attack is overwhelming the CPU.

Question 3

An administrator needs to back up the FortiGate configuration to a TFTP server at 10.0.0.10. Which command should be used?

Accepted Answer

execute backup config tftp mybackup.conf 10.0.0.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp

'. This is a standard FortiOS CLI command that uses TFTP (Trivial File Transfer Protocol) to transfer the configuration file to the specified server at 10.0.0.10. Option B matches this syntax exactly.

Answer

tftp -p -l mybackup.conf 10.0.0.10

Answer

execute backup config ftp mybackup.conf 10.0.0.10

Answer

copy config tftp://10.0.0.10/mybackup.conf

Question 4

Refer to the exhibit. An administrator wants to enable SNMP access on the wan1 interface. Which of the following is the most efficient method?

Accepted Answer

Execute 'config system interface' and edit wan1, then set allowaccess ping https ssh snmp.. Option A is correct because the 'allowaccess' parameter under 'config system interface' controls which management protocols (ping, https, ssh, snmp, etc.) are permitted on a given interface. By adding 'snmp' to the allowaccess list for wan1, the administrator enables SNMP access on that interface without changing its role or type.

Answer

Change the interface type to 'management' to allow SNMP.

Answer

Execute 'config system interface' and edit wan1, then set snmp-index 1.

Answer

Configure an SNMP community under 'config system snmp community'.

Question 5

Which TWO of the following are valid methods to upgrade the FortiGate firmware? (Choose two.)

Accepted Answer

Use the GUI under System > Firmware.. Option A is correct because the FortiGate GUI provides a dedicated interface under System > Firmware to upload and install firmware images, which is a standard and supported upgrade method. This method allows administrators to select a local or remote firmware file and apply it with minimal disruption when proper procedures are followed.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 6

An administrator is troubleshooting a FortiGate that is not passing traffic. The policy allows traffic, but the session table shows no sessions. Which THREE steps should the administrator take to diagnose the issue? (Choose three.)

Accepted Answer

Verify the interface status and link state.. Option A is correct because if the interface is down or has a link issue, the FortiGate cannot send or receive any traffic, resulting in no sessions being created even if the policy allows traffic. Verifying interface status and link state is a fundamental first step in troubleshooting connectivity issues, as it ensures the physical or logical layer is operational before checking higher-layer configurations.

Answer

Run 'diagnose npu np6 show' to check offloading.

Answer

Disable the firewall policy and check if traffic flows.

Question 7

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

Accepted Answer

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.. Option A is correct because SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Answer

Remove the slower link from the SD-WAN interface.

Answer

Increase the bandwidth on the slower link.

Answer

Configure policy-based routing for the SaaS application.

Question 8

What is the default administrative account on a FortiGate?

Accepted Answer

admin. The default administrative account on a FortiGate is 'admin'. This account is created automatically during the initial boot process and has full super-admin privileges, allowing complete access to the device's configuration and management interfaces. It is the only default account with administrative rights, and its password must be set during initial setup.

Answer

master

Answer

root

Answer

guest

Question 9

An administrator needs to configure a FortiGate to send logs to two different syslog servers for redundancy. Which configuration method should be used?

Accepted Answer

Under 'config log syslogd setting', set 'status enable' and then add multiple servers using 'set server '.. Option A is correct because FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Answer

Configure two separate log settings for each server.

Answer

Configure one syslog server and use a load balancer.

Answer

Use a FortiAnalyzer to forward logs to syslog servers.

Question 10

Refer to the exhibit. The administrator notices that traffic from internal to wan1 is being logged, but the logs do not show the original source IP. What is the most likely reason?

Accepted Answer

NAT is enabled, so the source IP is replaced with the public IP.. When NAT is enabled on a FortiGate policy, the source IP of internal traffic is translated to the public IP of the FortiGate's WAN interface before the packet is logged. Since logging occurs after NAT processing, the log entries will show the translated (public) IP instead of the original internal source IP. This is the most likely reason the administrator sees logs without the original source IP.

Answer

The schedule is set to 'always', causing no time-based logging.

Answer

Logging is set to 'all' but only 'utma' events are logged.

Answer

The policy action is 'accept' without authentication.

Question 11

Which TWO of the following are prerequisites for configuring a high availability (HA) cluster on FortiGate? (Choose two.)

Accepted Answer

The FortiGate units must be running the same firmware version.. Option C is correct because FortiGate HA requires all cluster members to run the same firmware version to ensure configuration compatibility and consistent behavior. Mismatched firmware can lead to synchronization failures or unpredictable failover events, as the HA heartbeat and session synchronization protocols depend on identical code bases.

Answer

An HA heartbeat interface must be a dedicated interface.

Answer

All interfaces must be configured with static IP addresses.

Answer

The configuration must be identical on both units.

Question 12

Which THREE statements about FortiGate's 'config system global' settings are true? (Choose three.)

Accepted Answer

The 'admin-login-retry-limit' setting limits the number of failed login attempts before lockout.. Option B is correct because the 'admin-login-retry-lockout' setting (often referred to as 'admin-login-retry-limit' in older firmware) defines the number of consecutive failed administrative login attempts before the administrator account is locked out for a specified duration. This is a security feature to prevent brute-force attacks against the management interface.

Answer

The 'trusthost' setting restricts administrative access to specific source IPs.

Answer

The 'allowaccess' setting controls which protocols are allowed on an interface.

Question 13

A company has a FortiGate 200F with FortiOS 7.2 and two ISPs (WAN1: 100 Mbps, WAN2: 50 Mbps). The company uses SD-WAN to load balance outbound internet traffic. Recently, the company added a new VoIP application that requires low latency and jitter. The administrator configured an SD-WAN rule to match the VoIP traffic and set the strategy to 'best quality' with a performance SLA measuring latency and jitter. However, after testing, the VoIP traffic is still using WAN2 (the slower link) even when WAN1 has lower latency. The performance SLA shows both links meeting the SLA thresholds. What is the most likely reason?

Accepted Answer

The 'best quality' strategy uses bandwidth as a tiebreaker when SLA is met.. When the 'best quality' strategy is used in an SD-WAN rule, FortiGate selects the best-performing link based on the configured performance SLA metrics (e.g., latency and jitter). However, if multiple links meet the SLA thresholds, the tiebreaker is the link with the highest bandwidth. In this scenario, both WAN1 and WAN2 meet the SLA, so FortiGate selects WAN2 because it has higher bandwidth (100 Mbps vs. 50 Mbps), not because of latency. This explains why VoIP traffic uses WAN2 despite WAN1 having lower latency.

Answer

The VoIP traffic is being offloaded by NPU bypassing SD-WAN.

Answer

The administrator needs to enable 'set internet-service enable' on the rule.

Answer

The SD-WAN rule is not matching the VoIP traffic correctly.

Question 14

A large enterprise is deploying a FortiGate 600F as the perimeter firewall. The security team requires that all administrative access (SSH, HTTPS, and Ping) to the FortiGate must be restricted to a dedicated management network (10.10.10.0/24). Additionally, any failed login attempt from outside the management network should be logged and the source IP should be blocked for 30 minutes. The administrator has configured a local-in policy to deny all administrative access from non-management networks and enabled logging. However, the administrator wants to automatically block the offending IPs. The FortiGate is not connected to any FortiAnalyzer or FortiManager. What should the administrator do to achieve this?

Accepted Answer

Create an automation stitch that triggers on local-in policy logging and adds the source IP to a blocked list via CLI script.. Option A is correct because an automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

Answer

Use a FortiAnalyzer to generate alerts and send to SIEM.

Answer

Configure a firewall policy to block the offending IPs manually based on logs.

Answer

Enable 'set block-session-ttl' on the local-in policy.

Question 15

Which command is used to display the current FortiGate firmware version?

Accepted Answer

get system status. The 'get system status' command is the correct way to display the current FortiGate firmware version. This command outputs a comprehensive summary of the system state, including the firmware version (e.g., FortiOS v7.4.0), the system uptime, serial number, and HA status. It is the standard CLI command for verifying the exact build and patch level of the FortiGate.

Answer

get system statistics

Answer

get hardware status

Answer

get system performance status

Question 16

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 17

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

Accepted Answer

No NAT policy is configured for internal users. The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Answer

The default route is incorrectly configured

Answer

An implicit deny policy is blocking traffic from internal to external

Answer

External access profile is set to read-only

Question 18

An administrator needs to configure a FortiGate to allow web traffic from the internal network to the Internet. The internal network is 192.168.1.0/24 and the WAN interface is port1 with IP 203.0.113.1. Which firewall policy is correct?

Accepted Answer

Source: internal, Destination: port1, Service: HTTP/HTTPS, Action: ACCEPT. Option A is correct because the firewall policy must match traffic originating from the internal network (source: internal) destined for the Internet via the WAN interface (destination: port1), and the service must be restricted to HTTP/HTTPS to allow web traffic only. The action ACCEPT permits the traffic. This aligns with the standard stateful inspection flow where source and destination interfaces are defined based on traffic direction.

Answer

Source: port1, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: external, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: internal, Destination: port1, Service: ALL, Action: ACCEPT

Question 19

A FortiGate administrator notices that the device's disk usage is critically high, causing logging failures. The administrator wants to free up space without losing important logs. Which action should be taken first?

Accepted Answer

Configure log compression. Log compression reduces the size of existing log files on the disk without deleting any data, directly addressing the critically high disk usage while preserving all important logs. This is the safest first step because it reclaims space immediately without risking data loss or altering logging behavior.

Answer

Delete all existing log files

Answer

Disable logging to the local disk

Answer

Increase the disk retention period

Question 20

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Accepted Answer

The gateway 203.0.113.1 (port1) is unreachable. When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

Answer

The second route is overwriting the first route

Answer

Both routes are equal-cost and load-balancing is not working

Answer

The configuration is invalid because duplicate default routes are not allowed