NSE4 System and Network Administration Practice Test 11 — 15 Questions

Question 1

A FortiGate administrator is upgrading firmware from version 6.0 to 7.0. The upgrade path requires multiple steps. Which of the following is the recommended method to ensure a successful upgrade?

Accepted Answer

Upgrade to 6.2, then to 6.4, then to 7.0, following the official upgrade path. FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

Answer

Perform a factory reset after upgrading to 7.0

Answer

Use the 'execute upgrade-version' command to automatically determine the path

Answer

Upload and install the 7.0 firmware directly, then restore configuration from backup

Question 2

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

Accepted Answer

Verify the load-balancing algorithm for the aggregate interface. The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Answer

Check the LACP mode (active vs passive)

Answer

Increase the MTU on the aggregate interface

Answer

Ensure the physical ports are in the same VDOM

Question 3

An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The correct command is 'execute backup config tftp ' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.

Answer

diagnose debug config-error-log read

Answer

show full-configuration

Answer

execute restore config tftp

Question 4

A FortiGate administrator needs to ensure that all DNS queries from internal clients are forwarded to a specific DNS server for security filtering. Which configuration should be applied?

Accepted Answer

Enable DNS forwarding under Network > DNS and set the system DNS to the desired server. DNS forwarding on FortiGate allows the device to act as a DNS relay, intercepting DNS queries from internal clients and forwarding them to a specified DNS server for security filtering. This is configured under Network > DNS by setting the system DNS to the desired server, which ensures all DNS traffic is redirected without requiring policy routing or firewall rule changes.

Answer

Use policy routing to redirect DNS traffic to the server

Answer

Create a firewall policy to allow DNS traffic to the external server only

Answer

Configure a DNS database on the FortiGate

Question 5

A network administrator is configuring SNMP on a FortiGate for monitoring. Which three pieces of information are required to complete the SNMPv2c configuration? (Choose THREE.)

Accepted Answer

SNMP manager IP address (allowed hosts). SNMPv2c uses community-based security, so the SNMP community string (Option D) is required for authentication. The SNMP manager IP address (Option B) is needed to define which hosts are allowed to query the FortiGate. The SNMP interface (Option E) specifies which network interface will listen for and respond to SNMP queries. These three pieces are mandatory for SNMPv2c configuration on a FortiGate.

Answer

SNMPv3 authentication protocol (MD5/SHA)

Answer

SNMP trap receiver IP and community

Question 6

An administrator wants to use FortiManager to manage multiple FortiGates. Which three steps must be performed to establish communication between a FortiGate and FortiManager? (Choose THREE.)

Accepted Answer

Ensure network connectivity between the FortiGate and FortiManager. FortiManager communicates with managed FortiGates over TCP/541 (FGFM protocol). Without IP-level connectivity between the two devices, the registration and management tunnel cannot be established. This is a prerequisite before any configuration steps can succeed.

Answer

Place the FortiGate in transparent mode

Answer

Configure the FortiGate's management interface with an IP address

Question 7

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

Accepted Answer

Set the administrative access to HTTPS on the internal interface. Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Answer

Enable HTTPS on the system global settings

Answer

Create a firewall policy allowing inbound HTTPS from internal to the FortiGate

Answer

Configure a static route for the management subnet

Question 8

An administrator wants to upgrade the FortiGate firmware from version 6.4.9 to 7.0.1. What is the most important consideration before proceeding?

Accepted Answer

Verify the upgrade path and check for any required intermediate versions. FortiGate firmware upgrades must follow a validated upgrade path to avoid configuration incompatibilities or boot failures. Version 6.4.9 to 7.0.1 requires an intermediate upgrade to 7.0.0 first, as direct jumps across major versions or skipping required intermediate releases can corrupt the firmware image or render the device unbootable. Fortinet publishes explicit upgrade paths in the release notes, and ignoring them is the most common cause of failed upgrades.

Answer

Upgrade to the latest 7.0.x directly without intermediate steps

Answer

Disable all firewall policies before upgrading

Answer

Ensure the configuration is backed up

Question 9

Which FortiGate operating mode is used when the device acts as a Layer 2 bridge without performing NAT?

Accepted Answer

Transparent mode. Transparent mode (Option B) is correct because in this mode the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any NAT or routing. The device is invisible to the network, and all interfaces share the same IP subnet, allowing it to inspect and filter traffic at the application layer while remaining transparent to connected devices.

Answer

HA mode

Answer

VPN mode

Answer

NAT/Route mode

Question 10

An administrator notices that traffic to a particular subnet is being load-balanced across two WAN links, but they want all traffic to that subnet to use a single link. Which feature should be configured?

Accepted Answer

Policy routing. Policy routing (also called PBR) allows you to override the routing table based on criteria such as source/destination IP, protocol, or port. By configuring a policy route that matches traffic to the specific subnet and sets the output interface to a single WAN link, you can force all that traffic to use one link instead of being load-balanced.

Answer

ECMP routing

Answer

Static route with higher distance

Answer

Route summarization

Question 11

A FortiGate administrator needs to allow SSH management access from a specific IP address 10.0.0.100. Which configuration is required?

Accepted Answer

Set the trusted host for the admin account to 10.0.0.100. FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.

Answer

Enable SSH on the WAN interface and allow all IPs

Answer

Configure an access list on the upstream router

Answer

Create a firewall policy allowing SSH from 10.0.0.100 to the FortiGate

Question 12

A FortiGate has two internet connections: port1 (ISP1) and port2 (ISP2). An administrator configures two static default routes with equal distance and priority. Traffic to a specific public IP is observed going out port1, but the admin wants it to go out port2. What should be configured?

Accepted Answer

Configure a policy route to direct the specific destination to port2. Policy routes (also called PBR) override the routing table for specific traffic matches. Since both default routes have equal distance and priority, the FortiGate uses ECMP or the route with the lowest cost by default. A policy route can match the specific destination IP and force the traffic out port2, bypassing the routing table lookup.

Answer

Use ECMP with source-based hashing

Answer

Increase the administrative distance of the default route on port1

Answer

Configure a blackhole route

Question 13

An administrator wants to back up the FortiGate configuration to a remote FTP server. Which command should be used?

Accepted Answer

execute backup config ftp . The `execute backup config ftp` command is the specific FortiGate CLI command designed to back up the configuration file to a remote FTP server. This command directly initiates an FTP transfer of the current system configuration, ensuring the backup is stored externally for disaster recovery.

Answer

execute restore config ftp

Answer

copy running-config startup-config

Answer

execute backup system ftp

Question 14

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure voice traffic uses the interface with the lowest latency. Which SD-WAN configuration should be used?

Accepted Answer

Configure an SD-WAN rule with a performance SLA that monitors latency and set strategy to 'Best Quality'. SD-WAN rules with a performance SLA allow the FortiGate to monitor real-time latency on each WAN interface and dynamically route voice traffic to the interface with the lowest latency. The 'Best Quality' strategy selects the best-performing interface based on the SLA metrics, ensuring optimal voice quality.

Answer

Set the strategy to 'Manual'

Answer

Set the strategy to 'Load Balance'

Answer

Use policy-based routing with a higher priority for voice traffic

Question 15

Which protocol does FortiGate use to synchronize sessions between HA cluster members?

Accepted Answer

FGCP. FortiGate uses the FortiGate Cluster Protocol (FGCP) to synchronize session tables, configuration, and state information between HA cluster members. FGCP is a proprietary protocol that ensures seamless failover by replicating session data in real time, allowing the backup unit to take over active sessions without interruption.

Answer

HSRP

Answer

OSPF

Answer

VRRP