NSE4 System and Network Administration Practice Test 3 — 15 Questions

Question 1

An administrator attempts to configure a policy route to route specific traffic from an internal subnet (10.1.1.0/24) to the internet via a different ISP. The policy route is created but traffic is still using the default route. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The outgoing interface in the policy route is down.. Policy routes in FortiGate have a higher priority than static routes, but they are only applied if the specified outgoing interface is operationally up. If the outgoing interface is down, the policy route is skipped, and traffic falls back to the default route. This is the most likely cause because the administrator confirmed the policy route was created but traffic still uses the default route.

Answer

The policy route is not using the correct source interface.

Answer

The destination address in the policy route is incorrect.

Answer

The static default route has a lower administrative distance than the policy route.

Question 2

A FortiGate administrator wants to synchronize the system time with an external NTP server. Which CLI command should be used to configure the NTP server?

Accepted Answer

config system ntp. The `config system ntp` command enters the NTP configuration context in FortiOS, where you can specify NTP servers, authentication, and synchronization settings. This is the standard CLI path for configuring NTP on FortiGate devices, as opposed to other commands that only display status or set the date manually.

Answer

execute date

Answer

diagnose ntp status

Answer

config system global

Question 3

A FortiGate administrator is troubleshooting a VPN tunnel that is not coming up. The phase 1 parameters match on both sides. Which three configuration items should the administrator verify?

Accepted Answer

The local and remote interface IP addresses are correctly configured.. The local and remote interface IP addresses define the tunnel endpoints. If these are misconfigured, the VPN cannot establish a secure connection even if all other parameters match. The FortiGate uses these addresses to route IKE traffic to the correct peer.

Answer

NAT traversal is enabled on both sides.

Answer

The phase 2 proposal matches the remote device.

Question 4

A network administrator needs to configure a FortiGate to participate in SNMP monitoring. Which CLI command enables SNMP agent on the FortiGate?

Accepted Answer

config system snmp
set status enable. The correct command to enable the SNMP agent on a FortiGate is 'config system snmp' followed by 'set status enable'. This enters the SNMP configuration context and activates the SNMP agent, which is required for the FortiGate to respond to SNMP queries from management systems. Without this command, the SNMP service remains disabled regardless of other SNMP settings.

Answer

set system snmp enable

Answer

set snmp agent enable

Answer

enable snmp service

Question 5

An administrator is configuring a FortiGate in a transparent mode. Which of the following features is NOT available in transparent mode?

Accepted Answer

Source NAT. In transparent mode, the FortiGate operates as a Layer 2 bridge without routing capabilities, meaning it cannot perform Source NAT (SNAT) because SNAT requires Layer 3 routing to translate source IP addresses. Transparent mode does not have an IP address on its interfaces for routing, so features dependent on Layer 3 forwarding, such as NAT, are unavailable.

Answer

VLAN tagging

Answer

Intrusion Prevention System (IPS)

Answer

Security profiles (AV, web filter)

Question 6

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is about to expire in 3599 seconds. The 'expire=3599' field indicates the session will be removed from the session table in 3599 seconds. The 'duration=3600' shows the session has been active for 3600 seconds, so the total session lifetime is 7200 seconds (3600 + 3599). This is a normal TCP session (proto=6) in state 01 (SYN_SENT), not an error or idle condition.

Answer

The session is in an error state

Answer

The session has been idle for 3600 seconds

Answer

The session is to port 3600

Question 7

What is the purpose of configuring an aggregate interface on a FortiGate?

Accepted Answer

To combine multiple physical interfaces into one logical interface for increased throughput and redundancy. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical FortiGate interfaces into a single logical interface. This increases throughput by load-balancing traffic across the member links and provides redundancy: if one physical link fails, traffic continues over the remaining links. FortiGate supports both static aggregation and LACP (IEEE 802.3ad) for dynamic negotiation.

Answer

To enable VLAN tagging on a physical interface

Answer

To separate management traffic from data traffic

Answer

To connect two different network segments with a firewall in between

Question 8

An administrator plans to upgrade FortiGate firmware from version 6.0 to 7.2. The current version is 6.0.10. Which upgrade path is correct?

Accepted Answer

Upgrade to 6.2, then 6.4, then 7.0, then 7.2. FortiGate firmware upgrades must follow a supported path that does not skip major versions. Upgrading from 6.0.10 to 7.2.0 requires stepping through 6.2, 6.4, and 7.0 because Fortinet only supports upgrades from one major version to the next major version (e.g., 6.0→6.2→6.4→7.0→7.2). Option D correctly lists this sequential path.

Answer

Upgrade to 6.4 first, then to 7.2

Answer

It is not possible to upgrade from 6.0 to 7.2

Answer

Direct upgrade from 6.0.10 to 7.2.0 is supported

Question 9

Which command is used to back up the FortiGate configuration to a TFTP server?

Accepted Answer

execute backup config tftp . The correct command to back up the FortiGate configuration to a TFTP server is 'execute backup config tftp '. This is because FortiGate uses the 'execute' command for operational tasks, and 'backup config tftp' specifically instructs the system to export the running configuration to a TFTP server. The other options use incorrect syntax or commands that are not recognized by the FortiGate CLI.

Answer

save config tftp

Answer

backup tftp config

Answer

copy config tftp

Question 10

A FortiGate is set to NAT/Route mode. The admin wants traffic from internal users to the internet to use an IP address on the WAN interface for source NAT. Which configuration is required?

Accepted Answer

Enable NAT on the policy from internal to WAN and set the outgoing interface to the WAN interface. In NAT/Route mode, source NAT (SNAT) is configured by enabling NAT on the firewall policy that governs traffic from the internal network to the WAN interface. When NAT is enabled on the policy and the outgoing interface is set to the WAN interface, FortiGate automatically translates the source IP of internal users to the primary IP address of that WAN interface (or a configured IP pool). This is the standard method for allowing internal users to access the internet with a public IP address.

Answer

Set the FortiGate to transparent mode

Answer

Configure a policy route to force traffic through a specific interface

Answer

Configure a virtual IP mapping internal IPs to the WAN IP

Question 11

Which of the following is required to allow a FortiGate to synchronize its clock with an NTP server?

Accepted Answer

Firewall policy allowing NTP traffic (UDP 123) from the FortiGate to the NTP server. A FortiGate synchronizes its clock with an NTP server using NTP traffic, which relies on UDP port 123. Without a firewall policy that explicitly permits outbound UDP 123 traffic from the FortiGate to the NTP server, the NTP packets are dropped by the FortiGate's own firewall engine, preventing clock synchronization. This policy is required even for traffic originating from the FortiGate itself, as the FortiGate applies firewall rules to all traffic, including management traffic.

Answer

Enable NTP in the admin settings

Answer

Set the timezone using config system global

Answer

Disable daylight saving time

Question 12

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. Which two configurations are required? (Choose two.)

Accepted Answer

Configure FortiAnalyzer IP under config system central-management. The FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.

Answer

Enable log transfer under config log fortianalyzer setting

Answer

Configure a firewall policy to allow logs to leave

Answer

Create a log filter to send all logs

Question 13

An administrator is configuring a FortiGate HA cluster in active-passive mode with two units. Which two conditions must be met for failover to occur? (Choose two.)

Accepted Answer

A monitored interface on the primary unit goes down. In an active-passive FortiGate HA cluster, failover occurs only when the primary unit loses heartbeat communication with the secondary unit (option B) or a monitored interface on the primary unit goes down (option A). Options C, D, and E are not valid triggers for automatic failover. Therefore, only two of the listed options are correct.

Answer

The secondary unit receives a higher priority configuration

Answer

The primary unit's CPU usage exceeds 90%

Answer

The primary unit stops sending session synchronization packets

Question 14

A FortiGate admin needs to create a loopback interface for management purposes. Which two statements about loopback interfaces are correct? (Choose two.)

Accepted Answer

Loopback interfaces are always up and do not depend on physical links. Loopback interfaces are virtual interfaces that are always in an up/up state as long as the FortiGate is operational. They do not depend on any physical link or carrier status, making them ideal for management access and stable routing protocol peering.

Answer

Loopback interfaces cannot be assigned an IP address

Answer

Loopback interfaces are only used for routing protocols

Answer

Loopback interfaces require a physical port to be up

Question 15

An administrator is configuring a VLAN interface on a FortiGate. The physical interface is port2 and the VLAN ID is 100. Which of the following correctly creates the VLAN interface?

Accepted Answer

config system interface edit port2.100 set vlanid 100 set type vlan next end. It uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.

Answer

config system interface edit port2 set vlanid 100 next end

Answer

config system interface edit port2.100 set type vlan next end

Answer

config system vlan edit port2.100 set vlanid 100 next end