NSE4 System and Network Administration Practice Test 10 — 15 Questions

Question 1

A network administrator has configured a static route on a FortiGate with a distance of 10 and a priority of 0. Later, they add another static route to the same destination with a distance of 15 and priority of 0. Which route will be used for traffic forwarding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route with distance 10 because it has a lower administrative distance. The FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

Answer

The route with distance 15 because it has a higher priority

Answer

Both routes will be used for ECMP load balancing

Answer

The route with distance 15 will be used because it was added last

Question 2

You are troubleshooting a FortiGate HA cluster (active-passive) and notice that after a failover, some existing TCP sessions are not being maintained. The hbdev heartbeat interfaces are configured correctly, and session synchronization is enabled. What is the MOST likely cause?

Accepted Answer

NPU offloading is enabled on the primary FortiGate. When NPU offloading is enabled on the primary FortiGate, session synchronization for existing TCP sessions may fail because the NPU processes traffic directly without involving the CPU, bypassing the session synchronization mechanism. During a failover, the secondary unit does not have these offloaded sessions in its session table, causing established TCP connections to drop. This is a common issue in active-passive HA clusters where hardware acceleration interferes with stateful failover.

Answer

The secondary unit is in maintenance mode

Answer

The HA uptime monitor is not configured

Answer

Session pickup is not enabled in the HA configuration

Question 3

Which of the following FortiGate operating modes allows the firewall to act as a Layer 3 device, performing NAT and routing between interfaces?

Accepted Answer

NAT/Route mode. NAT/Route mode (option B) is correct because it configures the FortiGate as a Layer 3 device with distinct interfaces in different subnets, enabling it to perform routing (forwarding packets based on routing table entries) and Network Address Translation (NAT) to translate private IP addresses to public IP addresses. This mode is the default and most common operational mode for perimeter firewalls, allowing policy-based routing and NAT rules to be applied between zones.

Answer

Flow-based inspection mode

Answer

VLAN mode

Answer

Transparent mode

Question 4

You run the following diagnose command on a FortiGate and see the output:

diagnose sys session filter dport 443
diagnose sys session list

... proto=6 proto_state=01 duration=3600 expire=3599 ...

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in a half-open state (SYN_SENT). In FortiGate session diagnostics, 'proto_state=01' for a TCP session (proto=6) indicates the session is in a half-open state, specifically SYN_SENT, meaning the initial SYN packet has been sent but the three-way handshake has not yet completed. This is a transient state before the session becomes fully established (proto_state=02).

Answer

The session is UDP, indicated by proto_state 01

Answer

The session has been fully established

Answer

The session is being terminated

Question 5

A FortiGate administrator needs to configure a backup and restore strategy for the FortiGate configuration. Which TWO statements are correct regarding configuration backup and restore?

Accepted Answer

When restoring a configuration to a different FortiGate model, the interface names may cause the restore to fail.. FortiGate configurations include interface-specific names (e.g., port1, port2, wan1) that may not exist on a different model. If the target FortiGate lacks those exact interface names, the restore process will fail due to mismatched interface references, preventing the configuration from being applied.

Answer

The encrypted backup can only be restored on a FortiGate running the same firmware version.

Answer

It is not possible to restore only a specific section of the configuration (e.g., only firewall policies).

Answer

The backup file is encrypted by default to protect sensitive information.

Question 6

Which ONE of the following is a valid method to upgrade the FortiGate firmware? (Choose one.)

Accepted Answer

Use the GUI under System > Firmware.. The FortiGate GUI under System > Firmware allows uploading and installing firmware images, a standard upgrade method. Option B is incorrect because the command syntax is reversed; the correct syntax is 'execute upgrade image tftp '. Options C, D, and E are not firmware upgrade commands (they are backup/restore and reboot, respectively). Therefore, only option A is a valid upgrade method among the choices.

Answer

Use the command 'execute upgrade image tftp '.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 7

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

Accepted Answer

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.. SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Answer

Remove the slower link from the SD-WAN interface.

Answer

Increase the bandwidth on the slower link.

Answer

Configure policy-based routing for the SaaS application.

Question 8

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 9

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

Accepted Answer

No NAT policy is configured for internal users. The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Answer

The default route is incorrectly configured

Answer

An implicit deny policy is blocking traffic from internal to external

Answer

External access profile is set to read-only

Question 10

A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following:
- Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53).
- Outbound NAT (IP Pool) for internal users to 203.0.113.1.
- Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services).

Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?

Accepted Answer

The port forwarding rule maps the public IP to the DMZ server, not the internal server. The port forwarding rule is configured to forward external HTTP requests (port 80) to the DMZ web server at 10.0.0.10. The internal web server at 192.168.1.10 is not covered by any port forwarding rule. Therefore, when internal users try to access the public IP 203.0.113.1:80, the traffic is not redirected to the internal server, and the request fails. This is the primary cause, not a missing hairpin NAT or misconfigured outbound NAT.

Answer

The firewall policy from internal to DMZ is blocking traffic

Answer

Hairpin NAT is not enabled on the FortiGate

Answer

The IP Pool for outbound NAT is misconfigured

Question 11

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

Accepted Answer

Aggregate interface. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Answer

Loopback interface

Answer

VLAN interface

Answer

Software switch interface

Question 12

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

Accepted Answer

A firewall is blocking the required ports between FortiGate and FortiAnalyzer.. The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Answer

The FortiAnalyzer is not registered with the FortiGate.

Answer

The FortiGate is not generating any logs.

Answer

The FortiAnalyzer SNMP community string is incorrect.

Question 13

An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?

Accepted Answer

One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.. In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.

Answer

The cluster IP address is assigned to both units simultaneously.

Answer

Both units can forward traffic simultaneously.

Answer

Heartbeat interfaces are optional.

Question 14

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Accepted Answer

Authorize the FortiGate in the FortiManager GUI.. After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Answer

Enable VDOMs on the FortiGate.

Answer

Create a local admin account on the FortiGate for FortiManager to use.

Question 15

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover