NSE4 System and Network Administration Practice Test 12 — 15 Questions

Question 1

An administrator is configuring a FortiGate to send logs to a FortiAnalyzer. Which TWO of the following are required? (Choose two.)

Accepted Answer

Ensure network connectivity between FortiGate and FortiAnalyzer. The FortiGate must have IP reachability to the FortiAnalyzer to send logs over the network, typically using TCP port 514 (syslog) or FortiGate's proprietary log forwarding protocol. Without network connectivity, log transmission will fail regardless of configuration.

Answer

Enable local logging on the FortiAnalyzer

Answer

Create a firewall policy on the FortiGate to allow log traffic

Answer

Disable local logging on the FortiGate

Question 2

A FortiGate administrator is planning an upgrade from FortiOS 6.4 to 7.2. Which THREE steps should be performed before the upgrade? (Choose three.)

Accepted Answer

Verify hardware compatibility with the target firmware. Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.

Answer

Remove all firewall policies

Answer

Enable automatic firmware checks

Question 3

A FortiGate administrator needs to configure a static route to reach a remote network 192.168.100.0/24 via next-hop 10.0.0.1. Which CLI command should be used?

Accepted Answer

config router static
edit 1
set dst 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
next
end. It uses the proper FortiGate CLI syntax for configuring a static route. The command 'config router static' enters the static route configuration context, and 'set dst' specifies the destination network with a subnet mask (not CIDR notation), while 'set gateway' defines the next-hop IP address. This matches the FortiGate CLI structure for static routes.

Answer

config network route
edit 1
set ip 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
end

Answer

config route static
edit 1
set destination 192.168.100.0/24
set next-hop 10.0.0.1
end

Answer

config router static
edit 1
set dst 192.168.100.0/24
set next-hop 10.0.0.1
end

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.. The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Answer

The session is an ICMP session with state 01 and expires in 1 second.

Answer

The session is a UDP session to port 443 and has been active for 3600 seconds.

Answer

The session is a TCP session that has timed out and will be removed in 3599 seconds.

Question 5

An administrator configures a FortiGate in transparent mode. Which of the following is correct regarding transparent mode operation?

Accepted Answer

The FortiGate is invisible to end devices and does not modify IP addresses.. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any IP-level modifications. This means it does not perform NAT, and end devices are unaware of its presence, making option D correct.

Answer

The FortiGate performs NAT between its interfaces.

Answer

The FortiGate interfaces can be on different subnets.

Answer

The FortiGate requires a management IP on each interface.

Question 6

A FortiGate has two WAN interfaces (wan1, wan2) configured with ECMP routes to the same destination. The administrator notices that traffic for a single session is being load-balanced across both links, causing performance issues. What should be configured to ensure sessions stick to one link?

Accepted Answer

Change ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based'.. Changing the ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based' ensures that all packets belonging to the same session (identified by source IP or source-destination IP pair) are hashed to the same egress interface. This prevents a single session from being split across multiple WAN links, which can cause out-of-order packets and performance degradation. FortiGate’s ECMP hash algorithm uses the configured method to compute a hash value that deterministically selects the outgoing interface for each flow.

Answer

Set policy routing to use source-based routing.

Answer

Configure SD-WAN rules to enforce per-session stickiness.

Answer

Disable ECMP and use a single default route.

Question 7

An administrator wants to back up the FortiGate configuration to a TFTP server at 10.10.10.10. Which CLI command should be used?

Accepted Answer

execute backup config tftp 10.10.10.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp <server-ip>'. This is because 'execute' is the FortiOS CLI keyword for initiating operational commands, and 'backup config tftp' specifies the action and protocol. The syntax is case-sensitive and must include the 'execute' prefix to be recognized by the FortiGate CLI.

Answer

backup config tftp 10.10.10.10

Answer

copy config tftp 10.10.10.10

Answer

execute save config tftp 10.10.10.10

Question 8

What is the purpose of configuring an NTP server on a FortiGate?

Accepted Answer

To synchronize the FortiGate's system clock with a reliable time source.. Configuring an NTP server on a FortiGate synchronizes the system clock with a reliable time source, which is essential for accurate logging, certificate validation, and time-based operations. While time-based firewall policies depend on an accurate clock, NTP itself is the mechanism to achieve that accuracy, not the policy feature itself.

Answer

To enable time-based firewall policies.

Answer

To allow the FortiGate to act as an NTP server for the network.

Answer

To authenticate with FortiGuard services.

Question 9

An administrator needs to ensure that all traffic from the internal network to the internet goes through a web proxy for content filtering. Which configuration is required on the FortiGate?

Accepted Answer

Configure an explicit web proxy and create a proxy policy.. To enforce web proxy-based content filtering for all internal-to-internet traffic, the FortiGate must be configured with an explicit web proxy (which listens on a specific IP and port, typically 8080) and a corresponding proxy policy that defines the traffic matching criteria and action. This setup ensures that client browsers are configured to send requests to the proxy, and the proxy policy applies content filtering rules.

Answer

Enable the proxy feature and set the web proxy port to 80.

Answer

Enable web proxy in the firewall policy and set action to accept.

Answer

Configure a transparent proxy by using an SSL inspection profile.

Question 10

A FortiGate in HA active-passive cluster is experiencing failover events. The administrator runs 'get system ha status' and sees that the 'sync status' is 'out of sync'. What is the most likely cause?

Accepted Answer

The passive unit has a different firmware version.. In an HA active-passive cluster, the 'sync status' indicates whether configuration and session data are synchronized between the primary and secondary units. When the passive unit has a different firmware version, the FortiGate cannot synchronize its configuration or sessions because the data structures and features may differ between versions, leading to an 'out of sync' status. This is a common prerequisite: both units must run the exact same firmware image for HA synchronization to function.

Answer

The HA mode is set to active-active.

Answer

The session synchronization is disabled.

Answer

The heartbeat interface is down.

Question 11

A FortiGate is configured in active-active HA mode. An administrator notices that session failover is not working properly during a failover event. Which THREE configurations should be checked?

Accepted Answer

Ensure the load-balance method is set to 'load-balance' or 'weighted-load-balance'.. In active-active HA mode, the load-balance method must be set to 'load-balance' or 'weighted-load-balance' to ensure that session ownership is properly distributed and that session failover can occur. If the method is set to 'hub' or 'spoke', session synchronization and failover may not function as expected, as these modes are designed for different topologies.

Answer

Increase the session TTL.

Answer

Set the HA mode to 'active-passive'.

Question 12

A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?

Accepted Answer

Under system > admin > settings, restrict administrative access to trusted hosts.. The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.

Answer

Create a local-in policy to permit traffic from the management subnet.

Answer

Disable administrative access on all interfaces except the management interface.

Answer

Configure an inbound firewall policy allowing HTTPS from the management subnet to the FortiGate's interface IP.

Question 13

A FortiGate is configured with two WAN interfaces (port1 and port2) connected to different ISPs. The administrator wants to load-balance outbound traffic across both links using equal-cost routes. Which routing configuration should be applied?

Accepted Answer

Configure static routes with equal distance and enable ECMP.. ECMP (Equal-Cost Multi-Path) routing allows a FortiGate to load-balance outbound traffic across multiple interfaces when static routes have the same distance (administrative distance) and destination. By configuring two static routes with equal distance (e.g., 10) to 0.0.0.0/0 via port1 and port2, the FortiGate automatically distributes sessions across both links using a hash-based algorithm (e.g., source-destination IP), achieving the desired load balancing without dynamic routing protocols.

Answer

Configure policy routes to direct traffic based on source IP.

Answer

Enable BGP to dynamically learn routes from both ISPs.

Answer

Configure static routes with different distances (e.g., 10 and 20) to the same destination.

Question 14

An administrator runs the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and sees output indicating sessions with proto_state=01 and duration=3600. What does this indicate about the sessions?

Accepted Answer

The sessions are TCP connections in SYN state and have a timeout of 3600 seconds.. The command filters sessions on destination port 443. The output field 'proto_state=01' indicates a TCP session in SYN_SENT state (state 1), which is the initial step of a TCP handshake. The 'duration=3600' field shows that the session has been active for 3600 seconds (or represents a time value). Option B correctly identifies the state as TCP SYN and the number 3600 as a time value, making it the most accurate choice. Option A is wrong because UDP does not have a SYN state. Option C is wrong because state 01 is not established (established is state 06). Option D is wrong because ICMP does not use ports.

Answer

The sessions are UDP-based and have been active for 3600 seconds.

Answer

The sessions are TCP connections in established state with a duration of 3600 seconds.

Answer

The sessions are ICMP packets with a TTL of 3600.

Question 15

A FortiGate is operating in transparent mode. The administrator needs to configure a new VLAN interface for segmenting traffic. Which statement about VLAN interfaces in transparent mode is correct?

Accepted Answer

VLAN interfaces can be created on physical interfaces and are layer-2 only, requiring no IP addresses for traffic forwarding.. In transparent mode, FortiGate acts as a layer-2 bridge, forwarding traffic based on MAC addresses. VLAN interfaces can be created on physical interfaces to segment traffic at layer 2, and they do not require IP addresses for forwarding; IP addresses are only needed for management access if desired.

Answer

VLAN interfaces require IP addresses and act as routed interfaces in transparent mode.

Answer

VLAN interfaces can only be created on physical interfaces, and each VLAN requires a separate IP address in the management VDOM.

Answer

VLAN interfaces are not supported in transparent mode; the administrator must switch to NAT/Route mode.