NSE4 System and Network Administration Practice Test 13 — 15 Questions

Question 1

A FortiGate is deployed in NAT/Route mode. The administrator wants to create a policy that allows internal users to access the internet and also translates their private IP addresses to the public IP of the FortiGate's WAN interface. Which policy configuration is required?

Accepted Answer

Enable NAT on the firewall policy. Option D is correct because in NAT/Route mode, enabling NAT on the firewall policy performs source NAT (SNAT) by default, translating the private source IP addresses of internal users to the public IP address of the FortiGate's WAN interface. This is the standard method for allowing internal users to access the internet while hiding their private addresses behind a single public IP.

Answer

Configure a virtual IP (VIP) for the WAN interface

Answer

Set the policy action to ACCEPT and enable SNAT in the policy advanced options

Answer

Add a static route with NAT enabled

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in established state and has been active for 1 hour. Option A is correct because the output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED state per Fortinet's session state encoding), `duration=3600` seconds (1 hour), and `expire=3599` seconds (nearly full lifetime remaining). This indicates the session is actively established and has been ongoing for one hour, matching the description of an established state session.

Answer

The session is in FIN_WAIT state

Answer

The session is in TIME_WAIT state and will close soon

Answer

The session is in SYN_SENT state waiting for a SYN-ACK

Question 3

A FortiGate administrator needs to configure a policy route to send all traffic destined to 10.10.10.0/24 out through interface port3 instead of the default route. Which configuration steps are necessary?

Accepted Answer

Configure a policy route under 'config router policy' with destination 10.10.10.0/24 and output interface port3. Policy routes override the routing table for specific traffic based on criteria like source, destination, or protocol. Option D correctly configures a policy route under 'config router policy' to match destination 10.10.10.0/24 and set the output interface to port3, ensuring that traffic is forwarded out port3 regardless of the default route.

Answer

Add a firewall policy with source interface any, destination 10.10.10.0/24, and set the egress interface to port3

Answer

Create a static route for 10.10.10.0/24 with a lower distance pointing to port3

Answer

Set the default gateway to port3 and remove the existing default route

Question 4

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

Accepted Answer

The secondary unit detects loss of heartbeat from the primary and takes over. In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Answer

The administrator must manually reboot the secondary unit

Answer

The secondary unit becomes active only if the heartbeat link is also down

Answer

The secondary unit waits for a configuration change before becoming active

Question 5

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface

Question 6

An administrator is troubleshooting a loss of connectivity between two sites connected via a VPN tunnel. The FortiGate logs show 'Tunnel: phase 1 negotiation failed'. Which two parameters MUST match on both peers for phase 1 to succeed? (Select two. Not all options are used.)

Accepted Answer

Pre-shared key. The pre-shared key (PSK) is a mandatory authentication method for IKE phase 1. Both peers must use an identical PSK string; a mismatch causes the 'phase 1 negotiation failed' error because the IKE SA cannot be authenticated. FortiGate logs this failure when the calculated hash of the PSK does not match between the two endpoints.

Answer

IPsec proposal (encryption and authentication)

Answer

Local ID

Answer

Local and remote IP addresses

Question 7

A FortiGate administrator wants to ensure that all firewall policies are backed up before performing a firmware upgrade. Which backup method preserves the configuration in a format that can be restored to the same or different FortiGate model?

Accepted Answer

Backup the configuration via CLI using 'execute backup config tftp'. Option C is correct because 'execute backup config tftp' saves the FortiGate configuration in a plain-text, human-readable format that can be restored to the same or a different FortiGate model. This command backs up only the configuration (not firmware or logs) and is model-agnostic, allowing restoration across different hardware platforms as long as the firmware version is compatible.

Answer

Use 'execute backup full-config tftp'

Answer

Copy the configuration from the system config script

Answer

Save the running config from the GUI Dashboard

Question 8

An administrator needs to forward logs from a FortiGate to a FortiAnalyzer for centralized logging. The FortiAnalyzer IP is 10.10.10.10. Which configuration is required on the FortiGate?

Accepted Answer

config log fortianalyzer setting
 set status enable
 set server 10.10.10.10
 end. Option D is correct because the FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Answer

config system central-management
 set type fortianalyzer
 set ip 10.10.10.10
 end

Answer

config log setting
 set fortianalyzer ip 10.10.10.10
 end

Answer

config log syslogd setting
 set server 10.10.10.10
 end

Question 9

An administrator is configuring ECMP (Equal-Cost Multi-Path) on a FortiGate. Which TWO conditions are required for ECMP to load balance traffic across multiple routes?

Accepted Answer

Routes must have the same priority setting. Option B is correct because ECMP requires that multiple routes have the same priority (also known as 'distance' in some contexts) to be considered equal-cost. In FortiGate, priority is a metric that determines route preference; only routes with identical priority can be used simultaneously for load balancing. Option C is also correct because administrative distance must be the same for routes to be considered equal; if administrative distances differ, the route with the lower distance is preferred, and ECMP will not apply.

Answer

Routes must use different next-hop IP addresses

Answer

Routes must be static routes only

Answer

Routes must be through different interfaces

Question 10

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Accepted Answer

Enable VLAN forwarding on the bridge. In transparent mode, the FortiGate acts as a Layer 2 bridge, so VLAN tags must be preserved and forwarded across the bridge. Enabling VLAN forwarding on the bridge (option A) allows the FortiGate to pass 802.1Q-tagged frames between VLANs, which is essential for inter-VLAN HTTP traffic. Without this, the bridge will drop VLAN-tagged frames, blocking the traffic even if a firewall policy exists.

Answer

Create static routes for each VLAN subnet

Answer

Disable antivirus inspection on the policy

Answer

Assign IP addresses to the internal interfaces

Question 11

An administrator wants to allow only HTTPS and SSH administrative access to the FortiGate from a specific management subnet 192.168.100.0/24. Which TWO steps must be taken on the FortiGate?

Accepted Answer

Set the trusted host(s) on the administrator account to 192.168.100.0/24. Option A is correct because setting the trusted host(s) on an administrator account restricts administrative logins to only those originating from the specified subnet (192.168.100.0/24). This is a per-account access control that works in conjunction with interface-level allowaccess settings to enforce administrative source IP restrictions.

Answer

Create a local-in policy to allow traffic from 192.168.100.0/24

Answer

Enable HTTPS and SSH globally under system global

Answer

Configure a firewall policy to permit HTTPS and SSH from the management subnet to the FortiGate

Question 12

An administrator is planning a firmware upgrade from FortiOS 6.0 to 7.2. Which THREE steps should be performed before starting the upgrade process?

Accepted Answer

Read the release notes for the target firmware version. Reading the release notes for the target firmware version (FortiOS 7.2) is essential because they document critical upgrade-specific information, such as deprecated features, changed default behaviors, known issues, and hardware compatibility requirements. Skipping this step can lead to unexpected service disruptions or feature loss after the upgrade, as the release notes often include mandatory pre-upgrade actions like disabling certain features or adjusting configurations.

Answer

Remove all static routes to avoid routing issues

Answer

Disable all antivirus and IPS sensors

Question 13

A network administrator has configured a static route on a FortiGate with a distance of 10 and a priority of 0. Later, they add another static route to the same destination with a distance of 15 and priority of 0. Which route will be used for traffic forwarding?

Accepted Answer

The route with distance 10 because it has a lower administrative distance. The correct answer is D because the FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

Answer

The route with distance 15 because it has a higher priority

Answer

Both routes will be used for ECMP load balancing

Answer

The route with distance 15 will be used because it was added last

Question 14

You are troubleshooting a FortiGate HA cluster (active-passive) and notice that after a failover, some existing TCP sessions are not being maintained. The hbdev heartbeat interfaces are configured correctly, and session synchronization is enabled. What is the MOST likely cause?

Accepted Answer

NPU offloading is enabled on the primary FortiGate. In FortiGate HA, session synchronization relies on NPU offloaded sessions being re-synced. If the NPU offloading was enabled on the primary, sessions might not be fully synced to the backup. Disabling NPU offloading on the primary ensures all sessions are handled by the CPU and thus properly synced.

Answer

The secondary unit is in maintenance mode

Answer

The HA uptime monitor is not configured

Answer

Session pickup is not enabled in the HA configuration

Question 15

Which of the following FortiGate operating modes allows the firewall to act as a Layer 3 device, performing NAT and routing between interfaces?

Accepted Answer

NAT/Route mode. NAT/Route mode (option B) is correct because it configures the FortiGate as a Layer 3 device with distinct interfaces in different subnets, enabling it to perform routing (forwarding packets based on routing table entries) and Network Address Translation (NAT) to translate private IP addresses to public IP addresses. This mode is the default and most common operational mode for perimeter firewalls, allowing policy-based routing and NAT rules to be applied between zones.

Answer

Flow-based inspection mode

Answer

VLAN mode

Answer

Transparent mode