NSE4 System and Network Administration Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

Accepted Answer

Upgrade to 7.0.6 first, then to 7.2.0. Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Answer

Upgrade to 7.2.0 directly after downgrading to 7.0.0

Answer

Upgrade to 7.4.0 first, then downgrade to 7.2.0

Answer

Upgrade directly from 7.0.5 to 7.2.0

Question 2

An administrator creates a firewall policy to allow internal users to access the internet. The source interface is 'internal', destination interface is 'wan1', and NAT is enabled. Users complain that they cannot access external resources. The administrator verifies that the default route points to the ISP gateway. What is the most likely missing configuration?

Accepted Answer

The policy action is set to DENY. The most likely missing configuration is that the firewall policy action is set to DENY. Even with correct NAT, routing, and DNS settings, if the policy action is DENY, traffic from the internal interface to the wan1 interface will be dropped. The administrator must ensure the policy action is ACCEPT to permit outbound traffic.

Answer

The DNS server is not configured on the FortiGate

Answer

The FortiGate is in transparent mode

Answer

The session helper for FTP is disabled

Question 3

A FortiGate is configured in transparent mode. Which of the following statements is true?

Accepted Answer

The FortiGate interfaces have IP addresses for management only. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Answer

The FortiGate can have multiple routing tables

Answer

The FortiGate supports VLAN sub-interfaces

Answer

The FortiGate acts as a router and performs NAT

Question 4

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
And you see the output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that was just established and will expire in about 1 hour. The command `diagnose sys session filter dport 443` filters sessions to destination port 443, and `diagnose sys session list` displays matching sessions. The output shows `proto=6` which is TCP, `proto_state=01` which corresponds to TCP state ESTABLISHED, `duration=3600` seconds indicating the session has been active for 1 hour, and `expire=3599` seconds meaning the session will timeout in approximately 1 hour. Therefore, option C is correct because it describes a TCP connection to port 443 that is established and will expire in about 1 hour. Note that the session is not 'just established' as it has been active for 1 hour, but the other options are incorrect.

Answer

The session is a UDP session to port 443

Answer

The session is in a CLOSE state

Answer

The session has been active for 1 hour and has 1 second remaining before expiry

Question 5

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

Accepted Answer

Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP. FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Answer

Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate

Answer

Configure a syslog server pointing to the FortiAnalyzer IP

Answer

Configure an SNMP community on the FortiAnalyzer

Question 6

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 7

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. Option A is correct because FortiGate HA synchronization requires the cluster members to share the same HA group ID and password (group-name/group-password) so they can authenticate and form a trusted cluster; without matching credentials, the units cannot establish the HA relationship needed for config sync. Option C is correct because the heartbeat interface (hbdev) must be up and properly configured on both units, since HA heartbeat and synchronization traffic flow over these interfaces; if the heartbeat link is down or misconfigured, the secondary cannot receive synchronized configuration from the primary. Option B is not required in the sense stated: while FortiOS HA generally expects matching firmware and compatible licensing for a supported cluster, the question asks specifically about conditions enabling automatic configuration synchronization, which are governed by HA membership and heartbeat connectivity rather than a license-matching requirement. Option D is incorrect because virtual MAC addresses are used for failover traffic handling, not as a prerequisite for configuration synchronization. Option E is incorrect because VDOM mode does not need to be enabled for HA configuration synchronization to occur.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 8

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that has been active for 1 hour. The best answer because the output shows proto=6 (TCP) and dport=443 (HTTPS). However, the duration=3600 and expire=3599 fields indicate the session has a total lifetime of 3600 seconds and has been active for only 1 second (duration - expire). The session will expire in 3599 seconds (about 1 hour). The option's wording 'active for 1 hour' is a common misinterpretation; the session has not yet been active for 1 hour, but it will expire in 1 hour. This is the most accurate among the given choices.

Answer

The session is blocked by a firewall policy

Answer

The session is a UDP connection to port 443

Answer

The session is experiencing high latency

Question 9

A FortiGate configured in NAT/Route mode is connected to the internet via port1 with an IP 10.0.0.1/24. The internal network uses 192.168.1.0/24. Users can browse the internet but cannot reach a public server at 203.0.113.5. A static default route exists. What is the most likely cause?

Accepted Answer

The public server is down. Since users can browse the internet, the existing firewall policy must be allowing outbound traffic with some form of NAT (either on the FortiGate or upstream). The inability to reach specifically 203.0.113.5 suggests the problem is related to that particular destination, such as the server being down, a route specific to that subnet, or a firewall rule blocking it. Among the given options, the most likely cause is that the public server is down (B).

Answer

The static default route points to the wrong gateway

Answer

The firewall policy for outbound traffic does not have NAT enabled

Answer

The DNS server is not configured

Question 10

An administrator wants to synchronize the FortiGate's time with a reliable NTP server. After configuring the NTP server, they notice the time is still incorrect. What could be the issue?

Accepted Answer

The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself. By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.

Answer

The NTP server is not reachable due to a missing route

Answer

The FortiGate does not support NTP

Answer

The NTP server is not configured correctly

Question 11

An administrator wants to configure HA on two FortiGate units. Which TWO of the following must match on both units for the cluster to form? (Choose two.)

Accepted Answer

HA heartbeat interface configuration. Option A is correct because the HA heartbeat interface configuration must match on both FortiGate units — the same physical interfaces must be designated as heartbeat/priority interfaces (with matching heartbeat settings such as heartbeat-interval and lost-heartbeat-threshold) so the units can exchange HA hello packets and form the cluster. Option E is correct because both units must be configured with the same HA mode (active-passive or active-active) and the same group ID/group name; if the mode or group ID differs, the units will not join the same cluster. Option B is not required to match because FortiGate HA can form between units with different license types (e.g., a FortiGate with a UTM bundle and one without), though feature parity may differ. Option C is not required to match because each unit keeps its own management IP or the cluster uses a dedicated HA management IP; identical management IPs would actually cause a conflict. Option D is not required to match because hostnames may differ between cluster members, and FortiOS can append or override the hostname for the primary unit.

Answer

License type

Answer

Management IP addresses

Answer

Hostname

Question 12

An administrator wants to allow management access to a FortiGate from a specific subnet 10.10.10.0/24 via HTTPS. Which configuration achieves this?

Accepted Answer

config system interface
edit port1
set allowaccess https
set trustedhosts 10.10.10.0 255.255.255.0
end. Management access to a FortiGate interface is controlled via the `config system interface` context, where `set allowaccess https` enables HTTPS management on that interface, and `set trustedhosts` restricts access to the specified subnet 10.10.10.0/24. This configuration ensures only hosts from that subnet can reach the FortiGate's HTTPS management interface on the given port.

Answer

config system global
set admin-sport 443
set allowaccess https 10.10.10.0/24
end

Answer

config router policy
edit 1
set src 10.10.10.0/24
set dst 10.0.0.0/8
set action accept
set protocol https
end

Answer

config system admin
edit admin
set trustedhost 10.10.10.0/24
set allowaccess https
end

Question 13

Which of the following is the correct way to upgrade the firmware on a FortiGate from the CLI?

Accepted Answer

execute upgrade tftp. The correct CLI command to upgrade firmware on a FortiGate is 'execute upgrade tftp'. This command triggers the TFTP-based firmware upgrade process, where the FortiGate acts as a TFTP client to download the firmware image from a TFTP server. The 'execute' keyword is used for operational commands in FortiOS, and 'upgrade' is the specific action for firmware updates, with 'tftp' specifying the transfer protocol.

Answer

execute update firmware tftp

Answer

config system firmware upgrade tftp

Answer

execute firmware upgrade tftp

Question 14

An administrator wants to configure SNMP on a FortiGate to allow a monitoring server 192.168.1.100 to poll read-only information. Which set of commands is correct?

Accepted Answer

config system snmp community
edit 1
set name public
set query enable
set query-port 161
set hosts 192.168.1.100
end. SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.

Answer

config system snmp sysinfo
set status enable
set community public
set trap-receiver 192.168.1.100
end

Answer

config system snmp
set enable
set community public
set host 192.168.1.100
end

Answer

config system interface
edit port1
set snmp-index 1
set allowaccess snmp
end

Question 15

An administrator configures a policy route to send all traffic from subnet 172.16.1.0/24 to a specific next-hop 10.0.0.2. However, the traffic is still using the default route. What could be the reason?

Accepted Answer

The policy route has a lower priority than the default route.. Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Answer

The policy route does not have a destination interface set.

Answer

The policy route must be configured before the default route.

Answer

The source subnet is not correctly defined in the policy route.