NSE4 System and Network Administration Practice Test 2 — 15 Questions

Question 1

A company is deploying a FortiGate HA cluster in active-passive mode across two data centers. The network team reports that after a failover, some existing TCP sessions are dropped. Which configuration change should be applied to maintain session persistence during failover?

Accepted Answer

Enable session synchronization between cluster members. In an active-passive HA cluster, session synchronization (config.sys ha session-sync) ensures that TCP session state information is replicated from the active unit to the passive unit. Without this, the passive unit has no knowledge of existing sessions after a failover, causing them to be dropped. Enabling session synchronization allows the new active unit to continue forwarding traffic for established sessions seamlessly.

Answer

Disable NAT inspection on the firewall policy

Answer

Configure gratuitous ARP on the virtual IP

Answer

Increase the heartbeat interval to 2 seconds

Question 2

A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?

Accepted Answer

No NAT policy is configured for internal users. The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.

Answer

The default route is incorrectly configured

Answer

An implicit deny policy is blocking traffic from internal to external

Answer

External access profile is set to read-only

Question 3

An administrator needs to configure a FortiGate to allow web traffic from the internal network to the Internet. The internal network is 192.168.1.0/24 and the WAN interface is port1 with IP 203.0.113.1. Which firewall policy is correct?

Accepted Answer

Source: internal, Destination: port1, Service: HTTP/HTTPS, Action: ACCEPT. Option A is correct because the firewall policy must match traffic originating from the internal network (source: internal) destined for the Internet via the WAN interface (destination: port1), and the service must be restricted to HTTP/HTTPS to allow web traffic only. The action ACCEPT permits the traffic. This aligns with the standard stateful inspection flow where source and destination interfaces are defined based on traffic direction.

Answer

Source: port1, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: external, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

Answer

Source: internal, Destination: port1, Service: ALL, Action: ACCEPT

Question 4

A FortiGate administrator notices that the device's disk usage is critically high, causing logging failures. The administrator wants to free up space without losing important logs. Which action should be taken first?

Accepted Answer

Configure log compression. Log compression reduces the size of existing log files on the disk without deleting any data, directly addressing the critically high disk usage while preserving all important logs. This is the safest first step because it reclaims space immediately without risking data loss or altering logging behavior.

Answer

Delete all existing log files

Answer

Disable logging to the local disk

Answer

Increase the disk retention period

Question 5

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Accepted Answer

The gateway 203.0.113.1 (port1) is unreachable. When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

Answer

The second route is overwriting the first route

Answer

Both routes are equal-cost and load-balancing is not working

Answer

The configuration is invalid because duplicate default routes are not allowed

Question 6

Which TWO configuration changes can reduce the risk of unauthorized administrative access to a FortiGate?

Accepted Answer

Restrict administrative access to trusted hosts. Restricting administrative access to trusted hosts (Option B) is a fundamental security best practice that limits the source IP addresses allowed to connect to the FortiGate management interface. By configuring a trusted host list, the FortiGate will only accept administrative sessions (e.g., HTTPS, SSH, or Telnet) from specified IP addresses or subnets, effectively blocking all unauthorized sources. This reduces the attack surface and prevents brute-force or credential-stuffing attacks from untrusted networks.

Answer

Use the default 'admin' account for all administrators

Answer

Set a simple password for ease of use

Answer

Disable both HTTPS and HTTP administrative access

Question 7

Which THREE configuration steps are required to enable transparent proxy mode on a FortiGate?

Accepted Answer

Create a firewall policy with explicit proxy enabled. Option A is correct because in transparent proxy mode, the FortiGate must intercept web traffic without clients being explicitly configured to use a proxy. Enabling explicit proxy in the firewall policy allows the FortiGate to apply proxy-based security features (like web filtering and antivirus) to traffic that matches the policy, even though the clients are unaware of the proxy. This is a key step to activate transparent proxy inspection on the specified traffic.

Answer

Enable web proxy globally under config system settings

Answer

Assign an IP address to the proxy interface

Question 8

A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following:
- Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53).
- Outbound NAT (IP Pool) for internal users to 203.0.113.1.
- Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services).

Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?

Accepted Answer

The port forwarding rule maps the public IP to the DMZ server, not the internal server. The port forwarding rule explicitly maps external HTTP (port 80) to the DMZ web server at 10.0.0.10. Since the internal web server at 192.168.1.10 is not referenced in any port forwarding rule, traffic destined to the public IP 203.0.113.1:80 from the internal network will not be redirected to 192.168.1.10. This is the root cause of the issue, not a missing hairpin NAT or misconfigured outbound NAT.

Answer

The firewall policy from internal to DMZ is blocking traffic

Answer

Hairpin NAT is not enabled on the FortiGate

Answer

The IP Pool for outbound NAT is misconfigured

Question 9

Drag and drop the steps to configure a static route on a FortiGate firewall into the correct order.

Question 10

Drag and drop the steps to troubleshoot a user unable to access the internet through FortiGate into the correct order.

Question 11

Match each Fortinet security feature to its primary function.

Question 12

Match each FortiGate security profile component to its purpose.

Question 13

A network administrator needs to configure a FortiGate to allow HTTPS access to the GUI from the internal network. Which two steps must be performed?

Accepted Answer

Create a firewall policy that permits HTTPS traffic from internal to the FortiGate interface IP.. Option A is correct because a firewall policy must explicitly permit HTTPS traffic (TCP/443) from the internal network to the FortiGate's interface IP to allow GUI access. Option B is correct because HTTPS administrative access must be enabled on the internal interface via the CLI or GUI; without this, the FortiGate will not listen for HTTPS connections on that interface, even if a firewall policy exists.

Answer

Disable HTTP administrative access on the internal interface.

Answer

Enable SSH administrative access on the internal interface.

Question 14

An administrator runs 'diagnose sniffer packet any "host 10.0.1.100" 4' and sees packets being sent but no response. The FortiGate has a static route for 10.0.1.0/24 via 192.168.1.1. The administrator checks the routing table and sees the route is present. What is the most likely cause of no response?

Accepted Answer

The outgoing interface in the static route is incorrect or down.. Option B is correct because even if the route exists, the outgoing interface might be incorrectly configured. The sniffer shows packets leaving the FortiGate but the destination might not be reachable via that interface. Option A is incorrect because a missing route would show 'no matching route' in debug. Options C and D are less likely given the symptom.

Answer

The FortiGate has a policy route overriding the static route.

Answer

The destination host has a firewall blocking ICMP.

Answer

The static route has a higher administrative distance than a dynamic route.

Question 15

A FortiGate is configured in transparent mode. The administrator notices that traffic passing through the FortiGate is not being logged, even though log all sessions is enabled on the policy. What is the most likely reason?

Accepted Answer

Traffic is being bridged without session creation because the policy is set to 'accept' without logging enabled.. In transparent mode, FortiGate acts as a Layer 2 bridge and does not create sessions for traffic that is simply bridged between interfaces. Even with 'log all sessions' enabled on the policy, if the policy action is 'accept' without explicit logging enabled (i.e., the 'Logging' option is not set to 'All Sessions' or 'Security Events'), the traffic is forwarded without session logging. This is because transparent mode policies require separate logging configuration to generate logs, and the default 'accept' action does not log unless specifically configured.

Answer

The FortiGate is not operating in a VDOM.

Answer

The FortiGate is in transparent mode and cannot log traffic.

Answer

The log memory buffer is full and not sending to syslog.