NSE4 System and Network Administration Practice Test 10 — 15 Questions

Question 1

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

Accepted Answer

Enable SSH administrative access on the interface. To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Answer

Enable HTTPS administrative access only

Answer

Set the administrative access to 'any'

Answer

Configure a firewall policy allowing SSH from the subnet

Question 2

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

Accepted Answer

Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1. SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Answer

Disable wan2 in the SD-WAN zone

Answer

Use policy routing with a higher priority for wan1

Answer

Configure a static route with a higher distance for wan2

Question 3

You run 'get system performance status' and see CPU usage at 95% with high context switch rate. The FortiGate is not passing any traffic. What is the most likely cause?

Accepted Answer

A routing loop is causing continuous packet processing. A routing loop causes the FortiGate to continuously process and re-process packets as they are forwarded in a cycle between routers, leading to high CPU usage and context switch rates. The loop prevents traffic from being successfully delivered, resulting in zero traffic passing through the FortiGate. This matches the observed symptoms of 95% CPU usage and high context switching.

Answer

The FortiGate is under a DDoS attack

Answer

The antivirus engine is updating signatures

Answer

The FortiGate is in transparent mode

Question 4

A FortiGate administrator wants to send logs to a FortiAnalyzer. The FortiAnalyzer IP is 192.168.1.100, and logging is configured under Log & Report. However, no logs are being received. Which command should the administrator use on the FortiGate to verify connectivity to the FortiAnalyzer?

Accepted Answer

diagnose log device status. The 'diagnose log device status' command specifically checks the connectivity status and last-acknowledged sequence number between the FortiGate and the configured FortiAnalyzer. This command verifies whether the FortiGate can reach the FortiAnalyzer at the logging protocol level (FGFM), which is essential for log transmission, unlike a basic ICMP ping that only tests network-layer reachability.

Answer

execute ping 192.168.1.100

Answer

show full-configuration log fortianalyzer

Answer

get system ha status

Question 5

An organization has two FortiGate units in an HA cluster. They need to perform a firmware upgrade on the primary unit without causing a failover. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a graceful failover, then upgrade the original primary. In an HA cluster, upgrading the secondary unit first ensures that the primary remains active and can take over if the upgrade fails. After the secondary is upgraded and stable, a graceful failover is performed to make it the new primary, allowing the original primary to be upgraded without causing an unplanned failover or service interruption.

Answer

Upgrade the primary unit first, then the secondary will automatically synchronize

Answer

Upgrade both units simultaneously using the GUI

Answer

Disable HA, upgrade both, then re-enable HA

Question 6

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

Accepted Answer

Create a policy route with source address set to the specific IP and set the gateway to ISP1. Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Answer

Increase the administrative distance of the ISP2 default route to 20

Answer

Configure SD-WAN rules to steer the traffic

Answer

Add a static host route for the specific source IP via ISP1

Question 7

After upgrading FortiGate firmware, the administrator notices that the 'config router static' command now shows a new keyword 'distance' instead of 'weight'. The upgrade also changed the ECMP load-balancing behavior. What was the likely change in the ECMP algorithm?

Accepted Answer

The ECMP algorithm changed from weighted to source-dest-IP. In FortiOS 6.4, the default ECMP method was weighted, using the 'weight' parameter in static routes. Starting with FortiOS 7.0, the 'weight' parameter was replaced by 'distance', and the default ECMP algorithm changed to source-IP-based hash (also referred to as source-dest-IP hash). This change enhances load balancing by distributing traffic based on source/destination IP addresses rather than priority weights.

Answer

The ECMP algorithm changed from source-IP-based to weighted (hash-based)

Answer

The ECMP algorithm is now configurable via 'config system ecmp'

Answer

The ECMP algorithm changed from source-dest-IP to round-robin

Question 8

A FortiGate administrator needs to allow SNMP monitoring from a management station at 10.10.10.50. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable SNMP agent globally. The SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.

Answer

Configure an SNMP trap to send alerts to 10.10.10.50

Answer

Enable SNMP on the interface connected to the management station

Answer

Configure a firewall policy allowing SNMP from the management station

Question 9

A FortiGate in NAT/Route mode has multiple internal networks. The administrator wants to configure a loopback interface for management access. Which THREE statements about loopback interfaces are correct? (Choose three.)

Accepted Answer

The loopback interface is always up regardless of physical link status. Option B is correct because a FortiGate loopback interface is a logical interface with no dependency on any physical link, so its operational state remains up even if physical ports go down. Option C is correct because the loopback's stable IP address is commonly configured as the source-ip for management protocols such as HTTPS, SSH, SNMP, and syslog, ensuring consistent management reachability. Option E is correct because loopback interfaces can be included in routing protocol configurations (for example, OSPF or BGP) and advertised as a stable router ID or network, which is a standard design practice. Option A is wrong because a loopback is a logical interface that is not bound to a physical port. Option D is wrong because loopback interfaces can absolutely be referenced in firewall policies as source or destination interfaces.

Answer

The loopback interface must be assigned to a physical port

Answer

The loopback interface cannot be used for firewall policies

Question 10

You are troubleshooting a FortiGate HA cluster that is not failing over correctly. The cluster has two units in active-passive mode. You check the HA status and see both units are in 'standalone' mode. Which THREE configurations could cause this? (Choose three.)

Accepted Answer

The HA group ID is different on each unit. The HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Answer

The FortiGate is configured in transparent mode

Answer

The firmware versions are different but both are 7.0.x

Question 11

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

Accepted Answer

Configure two static default routes with the same distance and metric. Configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Answer

Configure a single default gateway and rely on ARP for failover

Answer

Configure a policy route for each subnet directing traffic to a different ISP

Answer

Configure two static default routes with different distances

Question 12

A FortiGate administrator is setting up a new FortiGate in a network that requires the firewall to bridge traffic between two subnets without routing. Which operating mode should the administrator select?

Accepted Answer

Transparent mode. Transparent mode allows the FortiGate to act as a Layer 2 bridge, forwarding traffic between two subnets without performing any routing or NAT. In this mode, the firewall operates like a 'bump in the wire,' inspecting and filtering traffic based on MAC addresses and Layer 2 headers, while the IP addresses of connected devices remain unchanged. This is ideal for scenarios where the FortiGate must be inserted into an existing network without altering the IP topology.

Answer

NAT/Route mode

Answer

HA mode

Answer

VLAN mode

Question 13

An administrator configures an HA cluster of two FortiGates in active-passive mode. The cluster is synchronized, but after a failover, some existing TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization (session-pickup) is disabled. Session synchronization (session-pickup) is required for active-passive HA clusters to replicate TCP session state from the primary FortiGate to the secondary. When disabled, the backup unit has no knowledge of existing sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in NAT mode

Answer

The cluster is using a virtual MAC address for the HA interface

Question 14

A FortiGate administrator needs to allow remote management of a FortiGate from the internet. Which administrative access protocols should be enabled on the WAN interface? (Choose the best single answer.)

Accepted Answer

HTTPS and SSH. HTTPS (port 443) and SSH (port 22) are the only secure administrative access protocols that provide encrypted communication for remote management over the internet. HTTP and Telnet transmit credentials and data in plaintext, making them unsuitable for WAN-facing interfaces. FortiGate best practices mandate disabling all insecure protocols on external interfaces and enabling only HTTPS and SSH for administrative access.

Answer

Ping and SNMP

Answer

HTTP and Telnet

Answer

FTP and TFTP

Question 15

An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?

Accepted Answer

The policy route's incoming interface is incorrectly configured. Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.

Answer

The static default route has a lower administrative distance than the policy route

Answer

The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM

Answer

The policy route has a lower priority than the static default route