NSE4 System and Network Administration Practice Test 12 — 15 Questions

Question 1

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

Accepted Answer

Enable SNMP agent and configure an SNMP community. To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Answer

Configure a performance SLA monitor

Answer

Enable SNMP on the interface and set administrative access to SNMP

Answer

Configure an SNMP v3 user and enable SNMP traps

Question 2

An admin is configuring ECMP (Equal Cost Multi-Path) on a FortiGate with two ISPs. Which TWO conditions must be met for ECMP to load balance traffic across both links? (Choose two.)

Accepted Answer

The routes must have the same priority. ECMP requires that multiple routes to the same destination have equal cost. On FortiGate, the cost is determined by administrative distance (AD) and priority (which is the route metric). Both routes must have the same AD and the same priority to be considered equal-cost and eligible for load balancing. If either value differs, one route will be preferred over the other, and ECMP will not activate.

Answer

The routes must be configured with the same metric

Answer

The FortiGate must be in transparent mode

Answer

The routes must point to different next-hop IP addresses

Question 3

A network administrator notices that after configuring a new static route on a FortiGate, traffic to a remote subnet is still being forwarded via the default route. The administrator confirms the static route is present in the routing table with a lower distance than the default route. What is the MOST likely cause?

Accepted Answer

The static route's gateway is not reachable via any interface.. If the gateway specified in the static route is not reachable via any interface (e.g., the next-hop IP is not on a directly connected subnet or there is no ARP resolution), FortiGate will not install the route in the forwarding information base (FIB). The route may appear in the routing table but will be marked as inactive, causing traffic to still use the default route with a higher distance. FortiGate requires the next-hop to be reachable on a directly connected interface for the static route to be active.

Answer

The static route is disabled by a firewall policy.

Answer

The static route is configured with a higher priority than the default route.

Answer

The static route's destination subnet overlaps with a directly connected subnet.

Question 4

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

Accepted Answer

Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.. Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Answer

Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

Answer

Enable SSH access on the WAN interface instead of HTTPS.

Answer

Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

Question 5

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

Accepted Answer

The management IP is not in the same subnet as the management network.. In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Answer

Transparent mode does not support management access; only NAT/Route mode does.

Answer

The FortiGate's firewall policy blocks management traffic even in transparent mode.

Answer

The administrator must configure a management VLAN interface to access the FortiGate.

Question 6

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

Accepted Answer

Policy-based routing (PBR). Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Answer

Equal-cost multi-path (ECMP) routing

Answer

Static route with higher distance

Answer

SD-WAN with load balancing

Question 7

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is not configured or is down.. In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Answer

The passive unit has a different firmware version.

Answer

The HA mode is set to active-active instead of active-passive.

Answer

The administrator must manually trigger a sync from the active unit.

Question 8

An administrator needs to configure DNS on a FortiGate so that internal hosts can resolve external domain names. Which two settings are required? (Choose two.)

Accepted Answer

Configure DNS servers under System > DNS.. Configuring DNS servers under System > DNS is the fundamental step that tells the FortiGate which external DNS resolvers (e.g., 8.8.8.8) to use for resolving domain names. Without this, the FortiGate cannot forward DNS queries from internal hosts to the internet. Option C is correct because enabling the DNS proxy on the FortiGate allows it to intercept DNS requests from internal clients, cache responses for performance, and forward them to the configured DNS servers, which is essential for internal hosts to resolve external domains through the FortiGate.

Answer

Create a firewall policy allowing DNS traffic from internal to external.

Answer

Set the FortiGate's hostname to the domain name.

Answer

Configure a static route for DNS servers.

Question 9

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

Accepted Answer

Enable SSH administrative access on the interface. To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Answer

Enable HTTPS administrative access only

Answer

Set the administrative access to 'any'

Answer

Configure a firewall policy allowing SSH from the subnet

Question 10

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

Accepted Answer

Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1. SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Answer

Disable wan2 in the SD-WAN zone

Answer

Use policy routing with a higher priority for wan1

Answer

Configure a static route with a higher distance for wan2

Question 11

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

Accepted Answer

Upgrade to 7.0.6 first, then to 7.2.0. Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Answer

Upgrade to 7.2.0 directly after downgrading to 7.0.0

Answer

Upgrade to 7.4.0 first, then downgrade to 7.2.0

Answer

Upgrade directly from 7.0.5 to 7.2.0

Question 12

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

Accepted Answer

Create a policy route with source address set to the specific IP and set the gateway to ISP1. Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Answer

Increase the administrative distance of the ISP2 default route to 20

Answer

Configure SD-WAN rules to steer the traffic

Answer

Add a static host route for the specific source IP via ISP1

Question 13

A FortiGate is configured in transparent mode. Which of the following statements is true?

Accepted Answer

The FortiGate interfaces have IP addresses for management only. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Answer

The FortiGate can have multiple routing tables

Answer

The FortiGate supports VLAN sub-interfaces

Answer

The FortiGate acts as a router and performs NAT

Question 14

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

Accepted Answer

Configure two static default routes with the same distance and metric. Configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Answer

Configure a single default gateway and rely on ARP for failover

Answer

Configure a policy route for each subnet directing traffic to a different ISP

Answer

Configure two static default routes with different distances

Question 15

A FortiGate administrator is upgrading firmware from version 6.0 to 7.0. The upgrade path requires multiple steps. Which of the following is the recommended method to ensure a successful upgrade?

Accepted Answer

Upgrade to 6.2, then to 6.4, then to 7.0, following the official upgrade path. FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

Answer

Perform a factory reset after upgrading to 7.0

Answer

Use the 'execute upgrade-version' command to automatically determine the path

Answer

Upload and install the 7.0 firmware directly, then restore configuration from backup