NSE4 System and Network Administration Practice Test 3 — 15 Questions

Question 1

An administrator wants to aggregate two physical interfaces (port1 and port2) on a FortiGate to increase bandwidth and provide redundancy. Which interface type should be created?

Accepted Answer

Aggregate interface. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

Answer

Loopback interface

Answer

VLAN interface

Answer

Software switch interface

Question 2

An administrator needs to back up the FortiGate configuration to a remote server using SCP. Which command is correct?

Accepted Answer

execute backup config scp . The correct command is 'execute backup config scp ' because SCP (Secure Copy Protocol) is the only option listed that provides encrypted file transfer over SSH, which is required for securely backing up the FortiGate configuration to a remote server. FortiGate uses this CLI command to initiate an SCP session to the specified server and save the configuration file with the given filename.

Answer

execute backup config copy

Answer

execute backup config tftp

Answer

execute backup config ftp

Question 3

A FortiGate is configured with two equal-cost static routes to the same destination network (0.0.0.0/0) via two different ISPs. The administrator wants to use both links simultaneously for load balancing. What must be enabled?

Accepted Answer

ECMP (Equal Cost Multi-Path) routing. Equal Cost Multi-Path (ECMP) routing is the correct feature to enable because it allows a FortiGate to load-balance traffic across multiple static routes that have the same metric (distance) to the same destination (0.0.0.0/0). By default, FortiGate uses a single best route; enabling ECMP distributes sessions across both ISP links based on a hash algorithm (e.g., source-destination IP), achieving simultaneous utilization without requiring dynamic routing protocols.

Answer

SD-WAN

Answer

Link load balancing

Answer

Policy routing

Question 4

During a firmware upgrade, the FortiGate reboots and the administrator cannot access the GUI via HTTPS. The CLI shows the system is running the previous firmware. What is the most likely cause?

Accepted Answer

The upgrade failed and the system rolled back to the previous firmware.. Option D is correct because FortiGate firmware upgrades include an automatic rollback mechanism. If the upgrade fails or the new firmware does not boot successfully, the system automatically reverts to the previous firmware partition during the next reboot. The administrator seeing the previous firmware and being unable to access the GUI indicates the upgrade did not complete successfully, triggering this rollback.

Answer

The firmware image was corrupted during upload.

Answer

The administrator booted from the wrong partition.

Answer

The administrator did not perform a factory reset before upgrading.

Question 5

An administrator configures SNMP on a FortiGate to monitor CPU and memory usage. After applying the configuration, the NMS cannot reach the FortiGate via SNMP. The FortiGate's interface has SNMP access enabled. What is the most likely missing configuration?

Accepted Answer

A firewall policy is missing to permit SNMP traffic from the NMS.. The most likely missing configuration is a firewall policy to permit SNMP traffic from the NMS. Even though SNMP access is enabled on the interface, FortiGate uses firewall policies to control all traffic traversing between zones, including management traffic from an NMS. Without an explicit policy allowing UDP ports 161 (SNMP queries) and 162 (traps) from the NMS source to the FortiGate interface, the SNMP requests are dropped by the firewall.

Answer

The SNMP community string is not configured.

Answer

NTP is not configured, causing time mismatch.

Answer

The FortiGate is not configured to send SNMP traps.

Question 6

A FortiGate is configured in NAT/Route mode. Which statement is correct about this mode?

Accepted Answer

The FortiGate routes traffic between different subnets and can perform NAT.. In NAT/Route mode, the FortiGate operates as a Layer 3 router, forwarding traffic between different subnets while also performing Network Address Translation (NAT) when configured. This is the default operational mode for most FortiGate deployments, enabling both routing and NAT capabilities on the same device.

Answer

Only one interface can be used for traffic.

Answer

VLAN interfaces are not supported in this mode.

Answer

The FortiGate acts as a Layer 2 bridge.

Question 7

An administrator attempts to configure a policy route to route specific traffic from an internal subnet (10.1.1.0/24) to the internet via a different ISP. The policy route is created but traffic is still using the default route. What is the most likely cause?

Accepted Answer

The outgoing interface in the policy route is down.. Policy routes in FortiGate have a higher priority than static routes, but they are only applied if the specified outgoing interface is operationally up. If the outgoing interface is down, the policy route is skipped, and traffic falls back to the default route. This is the most likely cause because the administrator confirmed the policy route was created but traffic still uses the default route.

Answer

The policy route is not using the correct source interface.

Answer

The destination address in the policy route is incorrect.

Answer

The static default route has a lower administrative distance than the policy route.

Question 8

A FortiGate administrator wants to synchronize the system time with an external NTP server. Which CLI command should be used to configure the NTP server?

Accepted Answer

config system ntp. Option C is correct because the `config system ntp` command enters the NTP configuration context in FortiOS, where you can specify NTP servers, authentication, and synchronization settings. This is the standard CLI path for configuring NTP on FortiGate devices, as opposed to other commands that only display status or set the date manually.

Answer

execute date

Answer

diagnose ntp status

Answer

config system global

Question 9

An administrator needs to integrate a FortiGate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection refused' for FortiAnalyzer. What is the most likely cause?

Accepted Answer

A firewall is blocking the required ports between FortiGate and FortiAnalyzer.. The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

Answer

The FortiAnalyzer is not registered with the FortiGate.

Answer

The FortiGate is not generating any logs.

Answer

The FortiAnalyzer SNMP community string is incorrect.

Question 10

An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?

Accepted Answer

One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.. In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.

Answer

The cluster IP address is assigned to both units simultaneously.

Answer

Both units can forward traffic simultaneously.

Answer

Heartbeat interfaces are optional.

Question 11

A FortiGate administrator is troubleshooting a VPN tunnel that is not coming up. The phase 1 parameters match on both sides. Which three configuration items should the administrator verify?

Accepted Answer

The local and remote interface IP addresses are correctly configured.. Option C is correct because the local and remote interface IP addresses define the tunnel endpoints. If these are misconfigured, the VPN cannot establish a secure connection even if all other parameters match. The FortiGate uses these addresses to route IKE traffic to the correct peer.

Answer

NAT traversal is enabled on both sides.

Answer

The phase 2 proposal matches the remote device.

Question 12

An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?

Accepted Answer

Authorize the FortiGate in the FortiManager GUI.. Option B is correct because after the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

Answer

Enable VDOMs on the FortiGate.

Answer

Create a local admin account on the FortiGate for FortiManager to use.

Question 13

A network administrator needs to configure a FortiGate to participate in SNMP monitoring. Which CLI command enables SNMP agent on the FortiGate?

Accepted Answer

config system snmp
set status enable. The correct command to enable the SNMP agent on a FortiGate is 'config system snmp' followed by 'set status enable'. This enters the SNMP configuration context and activates the SNMP agent, which is required for the FortiGate to respond to SNMP queries from management systems. Without this command, the SNMP service remains disabled regardless of other SNMP settings.

Answer

set system snmp enable

Answer

set snmp agent enable

Answer

enable snmp service

Question 14

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover

Question 15

An administrator is configuring a FortiGate in a transparent mode. Which of the following features is NOT available in transparent mode?

Accepted Answer

Source NAT. In transparent mode, the FortiGate operates as a Layer 2 bridge without routing capabilities, meaning it cannot perform Source NAT (SNAT) because SNAT requires Layer 3 routing to translate source IP addresses. Transparent mode does not have an IP address on its interfaces for routing, so features dependent on Layer 3 forwarding, such as NAT, are unavailable.

Answer

VLAN tagging

Answer

Intrusion Prevention System (IPS)

Answer

Security profiles (AV, web filter)