NSE4 System and Network Administration Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Accepted Answer

The gateway 203.0.113.1 (port1) is unreachable. When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

Answer

The second route is overwriting the first route

Answer

Both routes are equal-cost and load-balancing is not working

Answer

The configuration is invalid because duplicate default routes are not allowed

Question 2

Which TWO configuration changes can reduce the risk of unauthorized administrative access to a FortiGate?

Accepted Answer

Restrict administrative access to trusted hosts. Restricting administrative access to trusted hosts (Option B) is a fundamental security best practice that limits the source IP addresses allowed to connect to the FortiGate management interface. By configuring a trusted host list, the FortiGate will only accept administrative sessions (e.g., HTTPS, SSH, or Telnet) from specified IP addresses or subnets, effectively blocking all unauthorized sources. This reduces the attack surface and prevents brute-force or credential-stuffing attacks from untrusted networks.

Answer

Use the default 'admin' account for all administrators

Answer

Set a simple password for ease of use

Answer

Disable both HTTPS and HTTP administrative access

Question 3

Which THREE configuration steps are required to enable transparent proxy mode on a FortiGate?

Accepted Answer

Create a firewall policy with explicit proxy enabled. In transparent proxy mode, the FortiGate must intercept web traffic without clients being explicitly configured to use a proxy. Enabling explicit proxy in the firewall policy allows the FortiGate to apply proxy-based security features (like web filtering and antivirus) to traffic that matches the policy, even though the clients are unaware of the proxy. This is a key step to activate transparent proxy inspection on the specified traffic.

Answer

Enable web proxy globally under config system settings

Answer

Assign an IP address to the proxy interface

Question 4

Drag and drop the steps to configure a static route on a FortiGate firewall into the correct order.

Accepted Answer

Enter config router static, then edit route with sequence number, then set destination, then set device, then set gateway, then end. Static routes on FortiGate are configured in the router static configuration context, requiring a sequence number, destination, device, and gateway.

Answer

Enter config router static, then edit route, then set gateway, then set destination, then set device, then end

Answer

Enter config router static, then set destination, then set device, then set gateway, then edit route, then end

Answer

Enter config router static, then edit route, then set device, then set gateway, then end, then set destination

Question 5

Drag and drop the steps to troubleshoot a user unable to access the internet through FortiGate into the correct order.

Accepted Answer

Check firewall policies, then check NAT rules, then check routing, then perform packet capture, then review logs. Troubleshooting follows a logical flow: policy, NAT, routing, packet capture, then logs.

Answer

Check routing, then check NAT rules, then check firewall policies, then review logs, then perform packet capture

Answer

Review logs, then check firewall policies, then check NAT rules, then check routing, then perform packet capture

Answer

Check NAT rules, then perform packet capture, then check firewall policies, then check routing, then review logs

Question 6

Match each Fortinet security feature to its primary function.

Accepted Answer

Antivirus: Scans files and traffic for known malware signatures.. The correct matches are: Antivirus scans for malware, IPS detects network attacks, Application Control identifies applications, Web Filtering blocks websites. Common confusions include mixing antivirus with anti-spam and IPS with antivirus.

Answer

Antivirus: Filters unwanted email messages.

Answer

IPS: Scans files for malware.

Question 7

Match each FortiGate security profile component to its purpose.

Accepted Answer

Antivirus profile: Scans files for malware. Antivirus profiles scan for malware, Web filter profiles block malicious websites, IPS profiles detect network attacks, and Application control profiles manage application usage. Common confusions include mixing IPS with Web filter and Antivirus with App Control.

Answer

Antivirus profile: Controls application usage and blocks risky applications

Answer

Web filter profile: Detects and prevents network attacks

Question 8

A network administrator needs to configure a FortiGate to allow HTTPS access to the GUI from the internal network. Which two steps must be performed?

Accepted Answer

Create a firewall policy that permits HTTPS traffic from internal to the FortiGate interface IP.. To allow HTTPS access to the GUI from the internal network, two actions are required. First, a firewall policy must be created to permit HTTPS traffic (TCP/443) from the internal network to the FortiGate's interface IP. This can be done via CLI with 'config firewall policy' or through the GUI. Second, HTTPS administrative access must be enabled on the internal interface. This is configured either via CLI with 'config system interface' and 'set allowaccess https' or by checking 'HTTPS' under Administrative Access in the GUI. Without both steps, GUI access will fail.

Answer

Disable HTTP administrative access on the internal interface.

Answer

Enable SSH administrative access on the internal interface.

Question 9

An administrator runs 'diagnose sniffer packet any "host 10.0.1.100" 4' and sees packets being sent but no response. The FortiGate has a static route for 10.0.1.0/24 via 192.168.1.1. The administrator checks the routing table and sees the route is present. What is the most likely cause of no response?

Accepted Answer

The outgoing interface in the static route is incorrect or down.. The sniffer output shows packets leaving the FortiGate but no reply, indicating a routing delivery problem. Since the static route is present in the routing table, the interface itself is up, but it may be incorrectly specified, causing packets to be sent out the wrong interface and never reach the next-hop (192.168.1.1). Option B is wrong because a policy route would still show packets being sent, but lack of response is more consistent with an incorrect interface. Option C is possible, but the symptoms suggest a routing issue, not a host firewall. Option D is wrong because static routes normally have lower administrative distance than dynamic routes, so they are preferred.

Answer

The FortiGate has a policy route overriding the static route.

Answer

The destination host has a firewall blocking ICMP.

Answer

The static route has a higher administrative distance than a dynamic route.

Question 10

A FortiGate is configured in transparent mode. The administrator notices that traffic passing through the FortiGate is not being logged, even though log all sessions is enabled on the policy. What is the most likely reason?

Accepted Answer

Traffic is being bridged without session creation because the policy is set to 'accept' without logging enabled.. In transparent mode, FortiGate acts as a Layer 2 bridge and does not create sessions for traffic that is simply bridged between interfaces. Even with 'log all sessions' enabled on the policy, if the policy action is 'accept' without explicit logging enabled (i.e., the 'Logging' option is not set to 'All Sessions' or 'Security Events'), the traffic is forwarded without session logging. This is because transparent mode policies require separate logging configuration to generate logs, and the default 'accept' action does not log unless specifically configured.

Answer

The FortiGate is not operating in a VDOM.

Answer

The FortiGate is in transparent mode and cannot log traffic.

Answer

The log memory buffer is full and not sending to syslog.

Question 11

An administrator needs to back up the FortiGate configuration to a remote server using SCP. Which command is correct?

Accepted Answer

execute backup config scp . The correct command is 'execute backup config scp ' because SCP (Secure Copy Protocol) is the only option listed that provides encrypted file transfer over SSH, which is required for securely backing up the FortiGate configuration to a remote server. FortiGate uses this CLI command to initiate an SCP session to the specified server and save the configuration file with the given filename.

Answer

execute backup config copy

Answer

execute backup config tftp

Answer

execute backup config ftp

Question 12

A FortiGate is configured with two equal-cost static routes to the same destination network (0.0.0.0/0) via two different ISPs. The administrator wants to use both links simultaneously for load balancing. What must be enabled?

Accepted Answer

ECMP (Equal Cost Multi-Path) routing. Equal Cost Multi-Path (ECMP) routing is the correct feature to enable because it allows a FortiGate to load-balance traffic across multiple static routes that have the same metric (distance) to the same destination (0.0.0.0/0). By default, FortiGate uses a single best route; enabling ECMP distributes sessions across both ISP links based on a hash algorithm (e.g., source-destination IP), achieving simultaneous utilization without requiring dynamic routing protocols.

Answer

SD-WAN

Answer

Link load balancing

Answer

Policy routing

Question 13

During a firmware upgrade, the FortiGate reboots and the administrator cannot access the GUI via HTTPS. The CLI shows the system is running the previous firmware. What is the most likely cause?

Accepted Answer

The upgrade failed and the system rolled back to the previous firmware.. FortiGate firmware upgrades include an automatic rollback mechanism. If the upgrade fails or the new firmware does not boot successfully, the system automatically reverts to the previous firmware partition during the next reboot. The administrator seeing the previous firmware and being unable to access the GUI indicates the upgrade did not complete successfully, triggering this rollback.

Answer

The firmware image was corrupted during upload.

Answer

The administrator booted from the wrong partition.

Answer

The administrator did not perform a factory reset before upgrading.

Question 14

An administrator configures SNMP on a FortiGate to monitor CPU and memory usage. After applying the configuration, the NMS cannot reach the FortiGate via SNMP. The FortiGate's interface has SNMP access enabled. What is the most likely missing configuration?

Accepted Answer

A firewall policy is missing to permit SNMP traffic from the NMS.. The most likely missing configuration is a firewall policy to permit SNMP traffic from the NMS. Even though SNMP access is enabled on the interface, FortiGate uses firewall policies to control all traffic traversing between zones, including management traffic from an NMS. Without an explicit policy allowing UDP ports 161 (SNMP queries) and 162 (traps) from the NMS source to the FortiGate interface, the SNMP requests are dropped by the firewall.

Answer

The SNMP community string is not configured.

Answer

NTP is not configured, causing time mismatch.

Answer

The FortiGate is not configured to send SNMP traps.

Question 15

A FortiGate is configured in NAT/Route mode. Which statement is correct about this mode?

Accepted Answer

The FortiGate routes traffic between different subnets and can perform NAT.. In NAT/Route mode, the FortiGate operates as a Layer 3 router, forwarding traffic between different subnets while also performing Network Address Translation (NAT) when configured. This is the default operational mode for most FortiGate deployments, enabling both routing and NAT capabilities on the same device.

Answer

Only one interface can be used for traffic.

Answer

VLAN interfaces are not supported in this mode.

Answer

The FortiGate acts as a Layer 2 bridge.