NSE4 System and Network Administration Practice Test 11 — 15 Questions

Question 1

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

Accepted Answer

Create a local-in policy to allow management access only from the trusted host. A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Answer

Change the admin port to a non-standard port

Answer

Enable HTTPS and restrict admin access via admin host

Answer

Use a firewall policy with source address restriction

Question 2

You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?

Accepted Answer

The HA heartbeat interface is not configured correctly or is down. The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings. The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.

Answer

The secondary unit has a lower priority, so it never takes over

Answer

The password for HA synchronization is incorrect

Answer

The session pickup feature is disabled

Question 3

An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?

Accepted Answer

The policy route is applied to the wrong incoming interface. Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

Answer

The firewall policy denies the traffic before policy routing

Answer

The default route has a higher administrative distance

Answer

The policy route destination is set to all

Question 4

A network administrator is configuring a new FortiGate and needs to ensure that all traffic from the internal network to the internet is source NATed to the public IP address on port1. The default route points to port1. Which configuration step is required to achieve this?

Accepted Answer

Enable NAT on the firewall policy from internal to internet. Source NAT (SNAT) on a FortiGate is configured at the firewall policy level, not on the interface or via a static route. By enabling NAT on the firewall policy from the internal network to the internet, the FortiGate automatically translates the source IP of traffic egressing port1 to the interface's primary IP address (the public IP). This is the standard method for implementing source NAT in FortiOS, as defined in the FortiGate Administration Guide.

Answer

Configure a static route to the internet with NAT enabled

Answer

Set the interface port1 to NAT mode in its settings

Answer

Create an IP pool with the public IP and reference it in the policy

Question 5

Which FortiGate operating mode allows the device to act as a transparent layer 2 bridge, forwarding traffic without performing NAT or routing?

Accepted Answer

Transparent mode. Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Answer

HA mode

Answer

VDOM mode

Answer

NAT/Route mode

Question 6

An administrator needs to allow SSH access to the FortiGate's management interface from a specific management subnet (10.0.1.0/24). Which configuration achieves this?

Accepted Answer

Under system admin settings, set the trusted host for the administrator to 10.0.1.0/24 and enable SSH access. The trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Answer

Set the administrative access profile to allow SSH from any IP

Answer

Configure a firewall policy to allow SSH from 10.0.1.0/24 to the FortiGate

Answer

Create a local-in policy to allow SSH from 10.0.1.0/24

Question 7

What is the purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To create a logical interface that remains up regardless of physical link status. A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Answer

To provide a virtual IP address for NAT

Answer

To connect to a VLAN

Answer

To aggregate multiple physical interfaces for increased bandwidth

Question 8

An administrator is troubleshooting a connectivity issue. A ping from the FortiGate to 8.8.8.8 succeeds, but traffic from internal hosts to the internet is failing. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The internal hosts have the wrong default gateway configured. Since the FortiGate can ping 8.8.8.8, its default route and internet connectivity are working. The issue is that internal hosts cannot reach the internet, which points to a Layer 3 forwarding problem at the host level. The most likely cause is that the internal hosts have the wrong default gateway configured, so their traffic is not being sent to the FortiGate for routing.

Answer

The default route on the FortiGate is missing

Answer

DNS resolution is failing

Answer

The FortiGate's interface to the internal network is down

Question 9

A FortiGate administrator needs to configure NTP to ensure accurate time on the device. Which two steps are required? (Choose two.)

Accepted Answer

Specify at least one NTP server address. To configure NTP on a FortiGate, you must enable the NTP service under System > Settings (option C) and specify at least one NTP server address (option B) so the device can synchronize its clock. Without enabling the service, the NTP client process does not run, and without a server address, there is no source to query. Option A (Sync on Save) is unrelated to NTP; it refers to configuration changes. Option D (firewall policy) is not required because the FortiGate's NTP client uses the management interface and bypasses regular firewall policies. Option E (set time zone) is not a required step for NTP synchronization, though it may be configured separately.

Answer

Enable the 'Sync on Save' option

Answer

Configure a firewall policy to allow NTP traffic (UDP 123)

Answer

Set the time zone to the local time zone

Question 10

An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)

Accepted Answer

Assign an IP address to each VLAN subinterface for management. In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

Answer

Enable NAT on the policies to translate addresses between VLANs

Answer

Configure static routes to route between VLANs

Question 11

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. HTTPS traffic is encrypted with SSL/TLS, so an antivirus profile cannot inspect the payload unless the firewall can decrypt the traffic. Even with antivirus enabled in the policy, without SSL/TLS deep inspection (also called SSL inspection or HTTPS decryption), FortiGate only sees encrypted packets and cannot scan for malware. Therefore, the most likely reason is that SSL/TLS deep inspection is not enabled on the firewall policy.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Answer

The FortiGuard antivirus subscription has expired

Question 12

What is the primary purpose of configuring a loopback interface on a FortiGate?

Accepted Answer

To provide a stable IP address for management and routing protocols. A loopback interface on a FortiGate is a virtual interface that is always up, independent of physical link states. It provides a stable and reachable IP address for management access (e.g., HTTPS, SSH) and for routing protocols like OSPF or BGP to use as the router ID or source interface, ensuring consistent connectivity even if physical interfaces fail.

Answer

To aggregate bandwidth from multiple physical interfaces

Answer

To enable NAT for internal networks

Answer

To increase the number of available physical ports

Question 13

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. In NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 14

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

Accepted Answer

A layer 2 firewall policy. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Answer

A policy-based NAT rule

Answer

A firewall policy using zone-based security

Answer

A VIP policy to map the web server's public IP

Question 15

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

Accepted Answer

The firmware image file is corrupted or not compatible with the platform. When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Answer

The FortiGate was in HA mode and the peer did not upgrade

Answer

The admin did not reboot after the upgrade

Answer

The admin forgot to save the configuration before upgrading