NSE4 System and Network Administration Practice Test 14 — 15 Questions

Question 1

An administrator has configured two FortiGate units in an active-passive HA cluster. The primary unit fails. How does the secondary unit become active?

Accepted Answer

The secondary unit detects loss of heartbeat from the primary and takes over. In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

Answer

The administrator must manually reboot the secondary unit

Answer

The secondary unit becomes active only if the heartbeat link is also down

Answer

The secondary unit waits for a configuration change before becoming active

Question 2

An administrator configures an aggregate interface (port1 and port2) on a FortiGate. After connecting the switch ports, the aggregate interface shows 'down'. The individual member ports are up. What is the MOST likely cause?

Accepted Answer

The switch ports are not configured for LACP or static aggregation. The aggregate interface remains down because the switch ports are not configured for LACP or static aggregation. For a FortiGate aggregate interface to come up, both the FortiGate member ports and the corresponding switch ports must be configured with the same aggregation protocol (LACP active/passive or static). Without this, the switch treats the ports as individual links, causing a mismatch that keeps the aggregate interface down.

Answer

The member ports are set to different speeds

Answer

The aggregate interface IP address is in the same subnet as the management interface

Answer

The FortiGate needs a reboot after creating an aggregate interface

Question 3

An administrator needs to forward logs from a FortiGate to a FortiAnalyzer for centralized logging. The FortiAnalyzer IP is 10.10.10.10. Which configuration is required on the FortiGate?

Accepted Answer

config log fortianalyzer setting
 set status enable
 set server 10.10.10.10
 end. The FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Answer

config system central-management
 set type fortianalyzer
 set ip 10.10.10.10
 end

Answer

config log setting
 set fortianalyzer ip 10.10.10.10
 end

Answer

config log syslogd setting
 set server 10.10.10.10
 end

Question 4

An administrator is configuring ECMP (Equal-Cost Multi-Path) on a FortiGate. Which TWO conditions are required for ECMP to load balance traffic across multiple routes?

Accepted Answer

Routes must have the same priority setting. ECMP requires that multiple routes have the same priority (also known as 'distance' in some contexts) to be considered equal-cost. In FortiGate, priority is a metric that determines route preference; only routes with identical priority can be used simultaneously for load balancing. Option C is also correct because administrative distance must be the same for routes to be considered equal; if administrative distances differ, the route with the lower distance is preferred, and ECMP will not apply.

Answer

Routes must use different next-hop IP addresses

Answer

Routes must be static routes only

Answer

Routes must be through different interfaces

Question 5

An administrator is planning a firmware upgrade from FortiOS 6.0 to 7.2. Which THREE steps should be performed before starting the upgrade process?

Accepted Answer

Read the release notes for the target firmware version. Reading the release notes for the target firmware version (FortiOS 7.2) is essential because they document critical upgrade-specific information, such as deprecated features, changed default behaviors, known issues, and hardware compatibility requirements. Skipping this step can lead to unexpected service disruptions or feature loss after the upgrade, as the release notes often include mandatory pre-upgrade actions like disabling certain features or adjusting configurations.

Answer

Remove all static routes to avoid routing issues

Answer

Disable all antivirus and IPS sensors

Question 6

A network administrator has configured a static route on a FortiGate with a distance of 10 and a priority of 0. Later, they add another static route to the same destination with a distance of 15 and priority of 0. Which route will be used for traffic forwarding?

Accepted Answer

The route with distance 10 because it has a lower administrative distance. The FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

Answer

The route with distance 15 because it has a higher priority

Answer

Both routes will be used for ECMP load balancing

Answer

The route with distance 15 will be used because it was added last

Question 7

Which of the following FortiGate operating modes allows the firewall to act as a Layer 3 device, performing NAT and routing between interfaces?

Accepted Answer

NAT/Route mode. NAT/Route mode (option B) is correct because it configures the FortiGate as a Layer 3 device with distinct interfaces in different subnets, enabling it to perform routing (forwarding packets based on routing table entries) and Network Address Translation (NAT) to translate private IP addresses to public IP addresses. This mode is the default and most common operational mode for perimeter firewalls, allowing policy-based routing and NAT rules to be applied between zones.

Answer

Flow-based inspection mode

Answer

VLAN mode

Answer

Transparent mode

Question 8

You run the following diagnose command on a FortiGate and see the output:

diagnose sys session filter dport 443
diagnose sys session list

... proto=6 proto_state=01 duration=3600 expire=3599 ...

What does the 'proto_state=01' indicate?

Accepted Answer

The session is in a half-open state (SYN_SENT). In FortiGate session diagnostics, 'proto_state=01' for a TCP session (proto=6) indicates the session is in a half-open state, specifically SYN_SENT, meaning the initial SYN packet has been sent but the three-way handshake has not yet completed. This is a transient state before the session becomes fully established (proto_state=02).

Answer

The session is UDP, indicated by proto_state 01

Answer

The session has been fully established

Answer

The session is being terminated

Question 9

An administrator is configuring SNMP on a FortiGate for monitoring. Which THREE items are required for SNMPv3 configuration?

Accepted Answer

Security level (authPriv or authNoPriv). For SNMPv3 on a FortiGate, the security level (Option A) must be specified because SNMPv3 defines whether messages are authenticated only (authNoPriv) or both authenticated and encrypted (authPriv), which directly determines the security mechanisms applied to the user. Option B is required because SNMPv3 authentication uses a hash protocol such as SHA (or MD5) and privacy uses an encryption protocol such as AES (or DES); these protocol selections must be configured alongside the passwords to build the user's security parameters. Option E is required because SNMPv3 is user-based rather than community-based, so an SNMP user must be created with a username and authentication password (and, when authPriv is used, a privacy password) before the FortiGate can respond to SNMPv3 queries. Option C is not required for basic SNMPv3 configuration because views are optional MIB access restrictions, not mandatory parameters for creating an SNMPv3 user. Option D is incorrect because community strings apply to SNMPv1 and SNMPv2c, not to SNMPv3, which replaces communities with users and security levels.

Answer

SNMP view definition for the user

Answer

SNMP community string (read-only or read-write)

Question 10

A FortiGate is deployed at a branch office with a single WAN link. The administrator wants to ensure that the FortiGate itself can resolve external hostnames for features like FortiGuard lookups, but does not want internal clients to use the FortiGate as their DNS server. Which configuration should the administrator apply?

Accepted Answer

Configure DNS servers under System > DNS on the FortiGate, and leave the internal interface DNS settings unchanged.. The FortiGate needs its own DNS settings for system lookups, which are configured under System > DNS. This does not affect clients unless the interface DNS server feature is enabled or DHCP hands out the FortiGate as a DNS server. Leaving the internal interface DNS settings unchanged ensures clients continue using their own DNS servers.

Answer

Configure a DNS filter profile on the outbound firewall policy and set the FortiGate as the primary DNS in the DHCP server.

Answer

Set the FortiGate as a DNS forwarder under Network > DNS Servers and configure a firewall policy to allow DNS.

Answer

Enable DNS server on the internal interface and set the same DNS servers in the DHCP scope.

Question 11

A FortiGate administrator is configuring a new VLAN interface on a managed FortiSwitch. The FortiGate is the FortiLink parent. The administrator wants to ensure that the VLAN is properly recognized and that traffic can flow between the FortiGate and devices on that VLAN. Which two actions must the administrator perform? (Choose two.)

Accepted Answer

Configure the VLAN on the FortiSwitch using the FortiGate GUI or CLI, assigning it to the desired ports.. For a VLAN to function on a FortiLink-managed FortiSwitch, the FortiGate must have a VLAN interface with the matching VLAN ID bound to the FortiLink interface, and the FortiSwitch must have the VLAN configured on the appropriate ports. These two steps ensure the VLAN is recognized and traffic can flow. Other options are either optional security features or unnecessary configuration steps.

Answer

Enable DHCP snooping on the FortiGate for the VLAN to prevent rogue DHCP servers.

Answer

Set the FortiLink interface to dedicated mode to allow VLAN tagging.

Answer

Configure a static route on the FortiGate for the VLAN subnet pointing to the FortiLink interface.

Question 12

A FortiGate is configured with two VDOMs: root and vdom1. The administrator wants to allow a server in vdom1 to be accessible from the internet via a virtual IP (VIP) configured in the root VDOM. Which configuration is required to achieve this?

Accepted Answer

Create inter-VDOM links between root and vdom1, and configure firewall policies to allow traffic.. To allow a server in one VDOM to be accessible via a VIP in another VDOM, inter-VDOM links must be configured to route traffic between them. Firewall policies on both VDOMs are also required to permit the traffic. This ensures that the VIP in the root VDOM can forward traffic to the server in vdom1, and return traffic can flow back.

Answer

Enable asymmetric routing on both VDOMs and disable session helpers.

Answer

Assign the same interface to both VDOMs and enable VDOM sharing.

Answer

Configure a static route in vdom1 pointing to the root VDOM's VIP as the gateway.

Question 13

An administrator needs to allow management access to a FortiGate from the internal network only via HTTPS and SSH. The internal interface is named internal. Which configuration should the administrator apply?

Accepted Answer

Under Network > Interfaces, edit the internal interface and enable HTTPS and SSH in the Administrative Access section.. Management access protocols are enabled per interface under Network > Interfaces by selecting the desired protocols in the Administrative Access section. This directly controls which protocols are allowed on that interface. Firewall policies, trusthost, and global settings do not enable management protocols on an interface.

Answer

Create a firewall policy allowing HTTPS and SSH from the internal network to the FortiGate's internal IP address.

Answer

Enable HTTPS and SSH under System > Settings and set the management port to the internal interface.

Answer

Configure an admin user with a trusthost of the internal subnet and set the admin profile to allow HTTPS and SSH.

Question 14

An administrator is configuring a FortiGate to authenticate users via LDAP. The LDAP server uses a self-signed certificate. When testing the connection, the FortiGate returns an error about certificate validation. Which action should the administrator take to resolve this issue while maintaining security?

Accepted Answer

Import the LDAP server's CA certificate into the FortiGate's local certificate store and configure the LDAP server to use LDAPS.. The certificate validation error occurs because the FortiGate does not trust the self-signed certificate of the LDAP server. Importing the CA certificate into the FortiGate's local store allows it to validate the server's certificate. Configuring LDAPS ensures the connection is encrypted. This maintains security without disabling validation.

Answer

Disable certificate validation on the FortiGate for LDAP connections.

Answer

Set the LDAP server to use port 389 with StartTLS and enable certificate validation.

Answer

Configure the LDAP server to use a public CA-signed certificate instead of a self-signed one.

Question 15

A FortiGate is configured as a DHCP server for the internal network. The administrator wants to ensure that clients receive the FortiGate's internal IP address as the default gateway and a specific DNS server. Which configuration step is required?

Accepted Answer

In the DHCP server settings, configure the default gateway and DNS server options, and ensure the internal interface IP is set as the gateway.. When configuring a DHCP server on a FortiGate, you can specify the default gateway and DNS servers that clients receive in the DHCP options. Setting the default gateway to the FortiGate's internal IP ensures clients use it as their gateway. The DNS server option provides the desired DNS server. Other options do not achieve this.

Answer

Configure a DHCP relay on the internal interface pointing to the FortiGate's internal IP address.

Answer

Enable DNS forwarding on the internal interface and set the DNS server in the system settings.

Answer

Create a firewall policy that allows DHCP traffic from the internal network to the FortiGate's internal interface.