NSE4 System and Network Administration — 40 Questions

Question 1

Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)

Accepted Answer

Use the GUI under System > Firmware.. The FortiGate GUI under System > Firmware allows uploading and installing firmware images, a standard upgrade method. Option B is incorrect because the command syntax is reversed; the correct syntax is 'execute upgrade image tftp '. Options C, D, and E are not firmware upgrade commands (they are backup/restore and reboot, respectively). Therefore, only option A is a valid upgrade method among the choices.

Answer

Use the command 'execute upgrade image tftp '.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 2

An administrator needs to configure a FortiGate to send logs to two different syslog servers for redundancy. Which configuration method should be used?

Accepted Answer

Under 'config log syslogd setting', set 'status enable' and then add multiple servers using 'set server '.. FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Answer

Configure two separate log settings for each server.

Answer

Configure one syslog server and use a load balancer.

Answer

Use a FortiAnalyzer to forward logs to syslog servers.

Question 3

Refer to the exhibit. The administrator notices that traffic from internal to wan1 is being logged, but the logs do not show the original source IP. What is the most likely reason?

Accepted Answer

NAT is enabled, so the source IP is replaced with the public IP.. When NAT is enabled on a FortiGate policy, the source IP of internal traffic is translated to the public IP of the FortiGate's WAN interface before the packet is logged. Since logging occurs after NAT processing, the log entries will show the translated (public) IP instead of the original internal source IP. This is the most likely reason the administrator sees logs without the original source IP.

Answer

The schedule is set to 'always', causing no time-based logging.

Answer

Logging is set to 'all' but only 'utma' events are logged.

Answer

The policy action is 'accept' without authentication.

Question 4

A company has a FortiGate 200F with FortiOS 7.2 and two ISPs (WAN1: 100 Mbps, WAN2: 50 Mbps). The company uses SD-WAN to load balance outbound internet traffic. Recently, the company added a new VoIP application that requires low latency and jitter. The administrator configured an SD-WAN rule to match the VoIP traffic and set the strategy to 'best quality' with a performance SLA measuring latency and jitter. However, after testing, the VoIP traffic is still using WAN2 (the slower link) even when WAN1 has lower latency. The performance SLA shows both links meeting the SLA thresholds. What is the most likely reason?

Accepted Answer

The 'best quality' strategy uses bandwidth as a tiebreaker when SLA is met.. When the 'best quality' strategy is used, FortiGate selects the link with the best performance based on the configured SLA metrics. However, if multiple links meet the SLA thresholds, FortiGate uses bandwidth as a tiebreaker, selecting the link with the lowest bandwidth to preserve higher-bandwidth links for other traffic. In this scenario, both WAN1 and WAN2 meet the SLA, so FortiGate selects WAN2 (50 Mbps) because it has lower bandwidth than WAN1 (100 Mbps), causing VoIP traffic to use the slower link despite WAN1 having lower latency.

Answer

The VoIP traffic is being offloaded by NPU bypassing SD-WAN.

Answer

The administrator needs to enable 'set internet-service enable' on the rule.

Answer

The SD-WAN rule is not matching the VoIP traffic correctly.

Question 5

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 6

Which THREE configuration steps are required to enable transparent proxy mode on a FortiGate?

Accepted Answer

Create a firewall policy with explicit proxy enabled. In transparent proxy mode, the FortiGate must intercept web traffic without clients being explicitly configured to use a proxy. Enabling explicit proxy in the firewall policy allows the FortiGate to apply proxy-based security features (like web filtering and antivirus) to traffic that matches the policy, even though the clients are unaware of the proxy. This is a key step to activate transparent proxy inspection on the specified traffic.

Answer

Enable web proxy globally under config system settings

Answer

Assign an IP address to the proxy interface

Question 7

Match each FortiGate security profile component to its purpose.

Accepted Answer

Antivirus profile: Scans files for malware. Antivirus profiles scan for malware, Web filter profiles block malicious websites, IPS profiles detect network attacks, and Application control profiles manage application usage. Common confusions include mixing IPS with Web filter and Antivirus with App Control.

Answer

Antivirus profile: Controls application usage and blocks risky applications

Answer

Web filter profile: Detects and prevents network attacks

Question 8

An administrator runs 'diagnose sniffer packet any "host 10.0.1.100" 4' and sees packets being sent but no response. The FortiGate has a static route for 10.0.1.0/24 via 192.168.1.1. The administrator checks the routing table and sees the route is present. What is the most likely cause of no response?

Accepted Answer

The outgoing interface in the static route is incorrect or down.. The sniffer output shows packets leaving the FortiGate but no reply, indicating a routing delivery problem. Since the static route is present in the routing table, the interface itself is up, but it may be incorrectly specified, causing packets to be sent out the wrong interface and never reach the next-hop (192.168.1.1). Option B is wrong because a policy route would still show packets being sent, but lack of response is more consistent with an incorrect interface. Option C is possible, but the symptoms suggest a routing issue, not a host firewall. Option D is wrong because static routes normally have lower administrative distance than dynamic routes, so they are preferred.

Answer

The FortiGate has a policy route overriding the static route.

Answer

The destination host has a firewall blocking ICMP.

Answer

The static route has a higher administrative distance than a dynamic route.

Question 9

A FortiGate is configured in transparent mode. The administrator notices that traffic passing through the FortiGate is not being logged, even though log all sessions is enabled on the policy. What is the most likely reason?

Accepted Answer

Traffic is being bridged without session creation because the policy is set to 'accept' without logging enabled.. In transparent mode, FortiGate acts as a Layer 2 bridge and does not create sessions for traffic that is simply bridged between interfaces. Even with 'log all sessions' enabled on the policy, if the policy action is 'accept' without explicit logging enabled (i.e., the 'Logging' option is not set to 'All Sessions' or 'Security Events'), the traffic is forwarded without session logging. This is because transparent mode policies require separate logging configuration to generate logs, and the default 'accept' action does not log unless specifically configured.

Answer

The FortiGate is not operating in a VDOM.

Answer

The FortiGate is in transparent mode and cannot log traffic.

Answer

The log memory buffer is full and not sending to syslog.

Question 10

An administrator configures SNMP on a FortiGate to monitor CPU and memory usage. After applying the configuration, the NMS cannot reach the FortiGate via SNMP. The FortiGate's interface has SNMP access enabled. What is the most likely missing configuration?

Accepted Answer

A firewall policy is missing to permit SNMP traffic from the NMS.. The most likely missing configuration is a firewall policy to permit SNMP traffic from the NMS. Even though SNMP access is enabled on the interface, FortiGate uses firewall policies to control all traffic traversing between zones, including management traffic from an NMS. Without an explicit policy allowing UDP ports 161 (SNMP queries) and 162 (traps) from the NMS source to the FortiGate interface, the SNMP requests are dropped by the firewall.

Answer

The SNMP community string is not configured.

Answer

NTP is not configured, causing time mismatch.

Answer

The FortiGate is not configured to send SNMP traps.

Question 11

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

Accepted Answer

A firewall is blocking the required ports between FortiGate and FortiAnalyzer.. The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Answer

The FortiAnalyzer is not registered with the FortiGate.

Answer

The FortiGate is not generating any logs.

Answer

The FortiAnalyzer SNMP community string is incorrect.

Question 12

An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?

Accepted Answer

One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.. In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.

Answer

The cluster IP address is assigned to both units simultaneously.

Answer

Both units can forward traffic simultaneously.

Answer

Heartbeat interfaces are optional.

Question 13

A FortiGate administrator is troubleshooting a VPN tunnel that is not coming up. The phase 1 parameters match on both sides. Which three configuration items should the administrator verify?

Accepted Answer

The local and remote interface IP addresses are correctly configured.. Option C is correct because IPsec phase 1 requires the local and remote gateway IP addresses (or interface identifiers) to be reachable and correctly configured on both peers; a wrong or unreachable peer address prevents IKE negotiation from even starting. Option D is correct because the pre-shared key must be byte-for-byte identical on both sides in aggressive or main mode PSK authentication; any mismatch causes phase 1 to fail with an authentication error. Option E is correct because IKE uses UDP 500 for negotiation and UDP 4500 for NAT-T, so firewall policies must permit this traffic to and from the VPN peers, otherwise the tunnel cannot establish. Option A is not among the marked correct answers because NAT traversal is only required when a NAT device exists in the path, and it is not a mandatory item to verify in every tunnel failure scenario. Option B is not among the marked correct answers because phase 2 parameters only matter after phase 1 succeeds, and the scenario states phase 1 parameters already match, so phase 2 is not the immediate focus here.

Answer

NAT traversal is enabled on both sides.

Answer

The phase 2 proposal matches the remote device.

Question 14

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Accepted Answer

Authorize the FortiGate in the FortiManager GUI.. After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Answer

Enable VDOMs on the FortiGate.

Answer

Create a local admin account on the FortiGate for FortiManager to use.

Question 15

Which of the following is required to allow a FortiGate to synchronize its clock with an NTP server?

Accepted Answer

Firewall policy allowing NTP traffic (UDP 123) from the FortiGate to the NTP server. A FortiGate synchronizes its clock with an NTP server using NTP traffic, which relies on UDP port 123. Without a firewall policy that explicitly permits outbound UDP 123 traffic from the FortiGate to the NTP server, the NTP packets are dropped by the FortiGate's own firewall engine, preventing clock synchronization. This policy is required even for traffic originating from the FortiGate itself, as the FortiGate applies firewall rules to all traffic, including management traffic.

Answer

Enable NTP in the admin settings

Answer

Set the timezone using config system global

Answer

Disable daylight saving time

Question 16

You run the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and see this output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection that has been active for 1 hour and will expire in 3599 seconds. Both options A and B are correct. The output shows a TCP session (proto=6) with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds. This means the session has been active for 3600 seconds and will be removed in 3599 seconds if no further traffic is seen. Option A correctly states these facts. Option B adds that this indicates a long-lived session, which is accurate for persistent connections like HTTPS where the session timer resets with each packet. Option C incorrectly identifies proto=6 as UDP (it is TCP). Option D incorrectly claims the duration equals the expire time; they are different by 1 second.

Answer

The session is UDP (proto=6 is TCP? Actually proto=6 is TCP) and the output indicates an ICMP error

Answer

There is a problem because the session duration equals the expire time, meaning it will be removed immediately

Question 17

A FortiGate administrator needs to configure NTP to ensure accurate time on the device. Which two steps are required? (Choose two.)

Accepted Answer

Specify at least one NTP server address. To configure NTP on a FortiGate, you must enable the NTP service under System > Settings (option C) and specify at least one NTP server address (option B) so the device can synchronize its clock. Without enabling the service, the NTP client process does not run, and without a server address, there is no source to query. Option A (Sync on Save) is unrelated to NTP; it refers to configuration changes. Option D (firewall policy) is not required because the FortiGate's NTP client uses the management interface and bypasses regular firewall policies. Option E (set time zone) is not a required step for NTP synchronization, though it may be configured separately.

Answer

Enable the 'Sync on Save' option

Answer

Configure a firewall policy to allow NTP traffic (UDP 123)

Answer

Set the time zone to the local time zone

Question 18

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Accepted Answer

Assign an IP address to each VLAN subinterface for management. In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Answer

Enable NAT on the policies to translate addresses between VLANs

Answer

Configure static routes to route between VLANs

Question 19

An admin configures an aggregate interface on a FortiGate using two physical ports. After configuration, the admin notices that traffic is not load-balancing evenly. What is the MOST likely cause?

Accepted Answer

The aggregate interface is using the default load-balancing algorithm. The default load-balancing algorithm for an aggregate interface (LAG) on FortiGate is based on the source and destination MAC addresses. This algorithm often results in uneven traffic distribution, especially when traffic flows are limited to a small number of MAC pairs. To achieve more even load balancing, the algorithm should be changed to one that considers IP addresses or Layer 4 ports, such as 'src-dst-ip' or 'src-dst-ip-port'.

Answer

The aggregate interface is set to active-passive mode

Answer

The physical ports are connected to different switches

Answer

The MTU size is mismatched on the physical ports

Question 20

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

Accepted Answer

The firmware image file is corrupted or not compatible with the platform. When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Answer

The FortiGate was in HA mode and the peer did not upgrade

Answer

The admin did not reboot after the upgrade

Answer

The admin forgot to save the configuration before upgrading