NSE4 System and Network Administration Practice Test 13 — 15 Questions

Question 1

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the load-balancing algorithm for the aggregate interface. The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Answer

Check the LACP mode (active vs passive)

Answer

Increase the MTU on the aggregate interface

Answer

Ensure the physical ports are in the same VDOM

Question 2

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

Accepted Answer

Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP. FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Answer

Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate

Answer

Configure a syslog server pointing to the FortiAnalyzer IP

Answer

Configure an SNMP community on the FortiAnalyzer

Question 3

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 4

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. The HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 5

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

Accepted Answer

Set the administrative access to HTTPS on the internal interface. Administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Answer

Enable HTTPS on the system global settings

Answer

Create a firewall policy allowing inbound HTTPS from internal to the FortiGate

Answer

Configure a static route for the management subnet

Question 6

An administrator wants to synchronize the FortiGate's time with a reliable NTP server. After configuring the NTP server, they notice the time is still incorrect. What could be the issue?

Accepted Answer

The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself. By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.

Answer

The NTP server is not reachable due to a missing route

Answer

The FortiGate does not support NTP

Answer

The NTP server is not configured correctly

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.. The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Answer

The session is an ICMP session with state 01 and expires in 1 second.

Answer

The session is a UDP session to port 443 and has been active for 3600 seconds.

Answer

The session is a TCP session that has timed out and will be removed in 3599 seconds.

Question 8

An administrator wants to configure SNMP on a FortiGate to allow a monitoring server 192.168.1.100 to poll read-only information. Which set of commands is correct?

Accepted Answer

config system snmp community
edit 1
set name public
set query enable
set query-port 161
set hosts 192.168.1.100
end. SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.

Answer

config system snmp sysinfo
set status enable
set community public
set trap-receiver 192.168.1.100
end

Answer

config system snmp
set enable
set community public
set host 192.168.1.100
end

Answer

config system interface
edit port1
set snmp-index 1
set allowaccess snmp
end

Question 9

An administrator configures a policy route to send all traffic from subnet 172.16.1.0/24 to a specific next-hop 10.0.0.2. However, the traffic is still using the default route. What could be the reason?

Accepted Answer

The policy route has a lower priority than the default route.. Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Answer

The policy route does not have a destination interface set.

Answer

The policy route must be configured before the default route.

Answer

The source subnet is not correctly defined in the policy route.

Question 10

A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?

Accepted Answer

Under system > admin > settings, restrict administrative access to trusted hosts.. The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.

Answer

Create a local-in policy to permit traffic from the management subnet.

Answer

Disable administrative access on all interfaces except the management interface.

Answer

Configure an inbound firewall policy allowing HTTPS from the management subnet to the FortiGate's interface IP.

Question 11

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

Accepted Answer

The PBR rule's source address does not match the traffic correctly.. Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Answer

The default route has a lower administrative distance than the PBR rule.

Answer

PBR is not supported on FortiGate.

Answer

The PBR rule has a higher priority than the default route.

Question 12

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 13

After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?

Accepted Answer

The next-hop IP is not directly connected to any FortiGate interface. In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.

Answer

FortiGate now requires a default administrative distance of 10 for static routes

Answer

The route was deleted during the upgrade and needs to be re-added

Answer

The remote gateway is down

Question 14

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

Accepted Answer

The secondary unit detects loss of heartbeat from the primary and takes over. In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Answer

The administrator must manually reboot the secondary unit

Answer

The secondary unit becomes active only if the heartbeat link is also down

Answer

The secondary unit waits for a configuration change before becoming active

Question 15

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface