NSE4 System and Network Administration Practice Test 13 — 15 Questions

Question 1

An administrator wants to upgrade the FortiOS firmware on a FortiGate. Which step is critical before starting the upgrade process?

Accepted Answer

Back up the configuration file.. Backing up the configuration file is critical before upgrading FortiOS because the upgrade process may fail or corrupt the configuration, and a backup ensures you can restore the FortiGate to its previous operational state. Without a valid backup, a failed upgrade could result in a complete loss of configuration, requiring manual reconfiguration or a factory reset. Fortinet recommends always backing up the configuration before any firmware upgrade to mitigate risks.

Answer

Reboot the FortiGate.

Answer

Clear all sessions.

Answer

Disable all firewall policies.

Question 2

A FortiGate administrator needs to integrate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection status: disconnected'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the FortiAnalyzer.. The most likely cause is that the FortiGate does not have a route to the FortiAnalyzer. Even with the correct IP and logging enabled, the FortiGate must be able to reach the FortiAnalyzer over the network; without a valid route, the TCP connection (typically on port 514 for syslog or port 443/541 for FortiGate-FortiAnalyzer protocol) will fail, resulting in a 'disconnected' status.

Answer

The FortiGate is in transparent mode.

Answer

The FortiAnalyzer firmware version is newer than the FortiGate's.

Answer

The administrator forgot to enable HTTPS for log upload.

Question 3

A FortiGate needs to resolve DNS names for outbound traffic. The administrator configures DNS servers under System > DNS. However, internal DNS queries for private domains fail. What additional configuration is required?

Accepted Answer

Create a DNS database entry for the private domain.. When a FortiGate is configured with DNS servers under System > DNS, it can resolve public DNS names for outbound traffic. However, for private domains (e.g., internal.company.local), the FortiGate cannot resolve these because they are not registered in public DNS. Creating a DNS database entry for the private domain allows the FortiGate to act as an authoritative DNS server for that domain, providing local resolution for internal queries.

Answer

Add a static route for DNS traffic.

Answer

Configure a DNS server on the WAN interface.

Answer

Enable DNS proxy on the FortiGate.

Question 4

An administrator needs to configure a loopback interface on a FortiGate for management purposes. Which of the following is true regarding loopback interfaces?

Accepted Answer

Loopback interfaces are virtual and can be used as source IP for management traffic.. Loopback interfaces are virtual interfaces that are always up and do not depend on the physical link state. They can be assigned an IP address and used as the source IP for management traffic (e.g., SNMP, syslog, NTP, or administrative access), ensuring consistent reachability even if physical interfaces fail. This makes option A correct.

Answer

Loopback interfaces require a physical port to be associated.

Answer

Loopback interfaces cannot be used in firewall policies.

Answer

Loopback interfaces are only available in transparent mode.

Question 5

A FortiGate administrator configures policy-based routing (PBR) to direct traffic from subnet 192.168.1.0/24 to the internet via ISP1. However, traffic from that subnet is still using the default route via ISP2. What is the most likely cause?

Accepted Answer

The PBR rule's source address does not match the traffic correctly.. Policy-based routing (PBR) on FortiGate overrides the routing table only when the traffic matches all configured criteria, including the source address. If the source address in the PBR rule does not match 192.168.1.0/24 exactly (e.g., a typo, wrong subnet mask, or missing entry), the traffic falls through to the default route via ISP2. This is the most likely cause because PBR rules are evaluated before the routing table, but only for matching traffic.

Answer

The default route has a lower administrative distance than the PBR rule.

Answer

PBR is not supported on FortiGate.

Answer

The PBR rule has a higher priority than the default route.

Question 6

An administrator wants to configure SNMPv3 on a FortiGate for secure monitoring. Which configuration is required?

Accepted Answer

Create an SNMPv3 user with authentication and privacy protocols.. SNMPv3 requires a user-based security model (USM) with authentication (e.g., SHA) and privacy (e.g., AES) protocols to provide integrity, authentication, and encryption. Without these, SNMPv3 cannot secure monitoring traffic, making option A the mandatory configuration.

Answer

Enable SNMP agent on the WAN interface only.

Answer

Configure an access control list for SNMP.

Answer

Set SNMP community string to 'public' and enable SNMPv1/v2c.

Question 7

A FortiGate administrator needs to backup the configuration to a remote TFTP server. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The 'execute backup config tftp' command is the proper CLI syntax in FortiOS for backing up the current configuration to a remote TFTP server. This command triggers an immediate backup operation, and the filename and TFTP server IP are required parameters to specify the destination.

Answer

copy config tftp

Answer

execute restore config tftp

Answer

backup configuration to tftp <tftp_server_ip>

Question 8

A network administrator has two FortiGate units that need to be configured as an HA cluster. Which TWO of the following are prerequisites for HA formation?

Accepted Answer

Both units must have the same FortiOS firmware version.. FortiGate HA clusters require all members to run the exact same FortiOS firmware version to ensure protocol compatibility and configuration synchronization. Mismatched firmware versions can cause cluster instability, failover failures, or split-brain scenarios, as the HA heartbeat protocol relies on consistent state machine behavior across units.

Answer

Both units must have the same hostname.

Answer

Both units must be in NAT/Route mode.

Answer

The HA priority must be set to 0 on both units.

Question 9

A FortiGate administrator needs to configure a VLAN interface and an aggregate interface. Which THREE statements are correct regarding these interface types?

Accepted Answer

Aggregate interfaces require at least one physical member to be up.. An aggregate interface (LAG) requires at least one physical member port to be administratively and operationally up for the aggregate itself to be considered up. If all member ports are down, the aggregate interface goes down, which is a fundamental behavior of link aggregation groups (LAGs) per IEEE 802.3ad.

Answer

Aggregate interfaces are only supported in NAT/Route mode.

Answer

VLAN interfaces cannot be used in transparent mode.

Question 10

An administrator is troubleshooting why traffic from a specific source IP is not being matched by a policy route. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify the source address object in the policy route matches the traffic's source IP.. The most fundamental step in troubleshooting a policy route mismatch is to verify that the source address object defined in the policy route exactly matches the source IP of the traffic. If the object is misconfigured (e.g., wrong subnet mask, incorrect IP range, or a typo), the traffic will never hit the policy route, regardless of other settings.

Answer

Disable all firewall policies to test routing.

Answer

Change the administrative distance of the default route to 0.

Question 11

An administrator is configuring a new FortiGate and wants to allow management access from the internal network via HTTPS. The internal interface is port2 with IP 192.168.1.1/24. Which CLI command correctly enables HTTPS administrative access on port2?

Accepted Answer

config system interface
 edit port2
 set allowaccess https
 end. The `config system interface` command is the proper context to set the `allowaccess` parameter, which controls the administrative protocols (such as HTTPS) permitted on a specific FortiGate interface. By editing port2 and setting `allowaccess https`, the administrator enables HTTPS management access on that interface, allowing internal users to reach the FortiGate's web GUI via 192.168.1.1.

Answer

config firewall policy
 edit 1
 set allowaccess https
 end

Answer

config system admin
 edit admin
 set https enable
 end

Answer

config system global
 set admin-https enable
 end

Question 12

After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?

Accepted Answer

The next-hop IP is not directly connected to any FortiGate interface. In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.

Answer

FortiGate now requires a default administrative distance of 10 for static routes

Answer

The route was deleted during the upgrade and needs to be re-added

Answer

The remote gateway is down

Question 13

A FortiGate is deployed in NAT/Route mode. The administrator wants to create a policy that allows internal users to access the internet and also translates their private IP addresses to the public IP of the FortiGate's WAN interface. Which policy configuration is required?

Accepted Answer

Enable NAT on the firewall policy. In NAT/Route mode, enabling NAT on the firewall policy performs source NAT (SNAT) by default, translating the private source IP addresses of internal users to the public IP address of the FortiGate's WAN interface. This is the standard method for allowing internal users to access the internet while hiding their private addresses behind a single public IP.

Answer

Configure a virtual IP (VIP) for the WAN interface

Answer

Set the policy action to ACCEPT and enable SNAT in the policy advanced options

Answer

Add a static route with NAT enabled

Question 14

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in established state and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED state per Fortinet's session state encoding), `duration=3600` seconds (1 hour), and `expire=3599` seconds (nearly full lifetime remaining). This indicates the session is actively established and has been ongoing for one hour, matching the description of an established state session.

Answer

The session is in FIN_WAIT state

Answer

The session is in TIME_WAIT state and will close soon

Answer

The session is in SYN_SENT state waiting for a SYN-ACK

Question 15

A FortiGate administrator needs to configure a policy route to send all traffic destined to 10.10.10.0/24 out through interface port3 instead of the default route. Which configuration steps are necessary?

Accepted Answer

Configure a policy route under 'config router policy' with destination 10.10.10.0/24 and output interface port3. Policy routes override the routing table for specific traffic based on criteria like source, destination, or protocol. Option D correctly configures a policy route under 'config router policy' to match destination 10.10.10.0/24 and set the output interface to port3, ensuring that traffic is forwarded out port3 regardless of the default route.

Answer

Add a firewall policy with source interface any, destination 10.10.10.0/24, and set the egress interface to port3

Answer

Create a static route for 10.10.10.0/24 with a lower distance pointing to port3

Answer

Set the default gateway to port3 and remove the existing default route