NSE4 System and Network Administration Practice Test 4 — 15 Questions

Question 1

An administrator is configuring a new FortiGate and wants to ensure it can be managed centrally via FortiManager. Which TWO steps are required?

Accepted Answer

Enable FortiManager on the interface used for management.. Option C is correct because FortiManager management must be explicitly enabled on the interface the FortiGate will use to reach FortiManager, typically via 'set fmg' under the interface's allowaccess settings, otherwise the device will not permit FortiManager to manage it. Option D is correct because the FortiGate must be pointed to the FortiManager by configuring the FortiManager IP address under 'config system central-management' (for example, 'set fmg <IP>'), which establishes the central management relationship. Option A is not required because HTTPS access on the management interface is for GUI/administrative access, not for FortiManager central management. Option B is not required because SNMP is for monitoring/polling, not FortiManager management. Option E is not required because FortiManager communication is handled by the central-management/FGFM tunnel and does not depend on a firewall policy allowing FortiManager access from the management subnet.

Answer

Enable HTTPS access on the management interface.

Answer

Configure SNMP community for FortiManager to poll.

Answer

Create a firewall policy allowing FortiManager access from the management subnet.

Question 2

An administrator wants to integrate FortiGate with FortiAnalyzer for logging. Which TWO steps are necessary?

Accepted Answer

Set the FortiAnalyzer IP under 'config system log-fortianalyzer set status enable set server '.. Option A is correct because integrating FortiGate with FortiAnalyzer requires configuring the remote logging target under 'config system log fortianalyzer' (or the equivalent log fortianalyzer setting), where you enable the feature with 'set status enable' and specify the FortiAnalyzer's address with 'set server '. Option B is correct because, in addition to defining the FortiAnalyzer server, logging to FortiAnalyzer must be enabled in the log settings so the FortiGate actually forwards its logs to that device. Option C is not required because FortiGate-to-FortiAnalyzer communication uses the OFTP protocol over TCP port 514 (or port 514 for syslog-style transport depending on configuration), but the question asks for configuration steps, not a separate firewall policy, and no policy is inherently necessary for the FortiGate's own management/logging traffic. Option D is incorrect because SNMP traps are for monitoring/alerting, not for sending logs to FortiAnalyzer. Option E is incorrect because FortiAnalyzer licensing applies to the FortiAnalyzer appliance/VM, not to the FortiGate, and no FortiAnalyzer license is installed on the FortiGate for this integration.

Answer

Create a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514.

Answer

Configure SNMP traps to send logs to FortiAnalyzer.

Answer

Install a FortiAnalyzer license on FortiGate.

Question 3

An administrator configures a FortiGate HA cluster with two units in active-passive mode. After setup, the secondary unit shows 'standby' status but traffic is not failing over when the primary is shut down. What is the most likely cause?

Accepted Answer

The primary unit's configuration changes were not synchronized to the secondary.. In an active-passive HA cluster, the secondary unit must have a synchronized copy of the primary's configuration to take over traffic. If configuration synchronization is not enabled or fails, the secondary remains in standby but lacks the necessary policies and settings to handle traffic, so failover does not occur even though HA status appears normal.

Answer

The HA heartbeat interface is not configured on the same subnet.

Answer

The cluster is in active-active mode.

Answer

The session failover feature is disabled.

Question 4

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. D is correct because antivirus scanning of HTTPS traffic requires the firewall to decrypt the SSL/TLS-encrypted payload. Without SSL/TLS deep inspection enabled on the policy, FortiGate sees only encrypted packets and cannot inspect the content for viruses, even if an antivirus profile is applied. The admin must configure a deep inspection profile that includes SSL/TLS decryption to allow the antivirus engine to scan the decrypted traffic.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 5

An administrator is troubleshooting a loss of connectivity between two sites connected via a VPN tunnel. The FortiGate logs show 'Tunnel: phase 1 negotiation failed'. Which two parameters MUST match on both peers for phase 1 to succeed? (Select two. Not all options are used.)

Accepted Answer

Pre-shared key. This is a multi-select question requiring two correct answers. For IKE phase 1 to succeed, both peers must match on the pre-shared key (PSK) for authentication and the IKE version (v1 or v2) for the protocol negotiation. A mismatch in either the PSK or the IKE version results in a 'phase 1 negotiation failed' error. The IPsec proposal is negotiated in phase 2, not phase 1.

Answer

IPsec proposal (encryption and authentication)

Answer

Local ID

Answer

Local and remote IP addresses

Question 6

A FortiGate administrator wants to ensure that all firewall policies are backed up before performing a firmware upgrade. Which backup method preserves the configuration in a format that can be restored to the same or different FortiGate model?

Accepted Answer

Backup the configuration via CLI using 'execute backup config tftp'. 'execute backup config tftp' saves the FortiGate configuration in a plain-text, human-readable format that can be restored to the same or a different FortiGate model. This command backs up only the configuration (not firmware or logs) and is model-agnostic, allowing restoration across different hardware platforms as long as the firmware version is compatible.

Answer

Use 'execute backup full-config tftp'

Answer

Copy the configuration from the system config script

Answer

Save the running config from the GUI Dashboard

Question 7

A FortiGate configured in transparent mode needs to allow HTTP traffic between two VLANs. The administrator has created a firewall policy. However, traffic is still blocked. Which TWO additional configurations are necessary for transparent mode operation?

Accepted Answer

Enable VLAN forwarding on the bridge. Option A is correct because in transparent mode the FortiGate forwards traffic through a software bridge, and VLAN forwarding must be enabled on that bridge (config system interface, edit , set vlanforward enable) so the unit can pass VLAN-tagged frames between the two VLANs instead of dropping them. Option B is correct because a transparent-mode FortiGate has no IP on its forwarding interfaces, so it needs a management IP address (config system interface, set ip

, set allowaccess) to be reachable for administration, logging, and updates. Option C is wrong because transparent mode is a Layer 2 bridge and does not route between subnets, so static routes for the VLAN subnets are unnecessary. Option D is wrong because antivirus inspection is a security profile choice, not a requirement for transparent-mode forwarding, and disabling it would not fix blocked traffic. Option E is wrong because assigning IP addresses to the internal interfaces would convert them to Layer 3/NAT mode and break transparent bridging.

Answer

Create static routes for each VLAN subnet

Answer

Disable antivirus inspection on the policy

Answer

Assign IP addresses to the internal interfaces

Question 8

An administrator wants to allow only HTTPS and SSH administrative access to the FortiGate from a specific management subnet 192.168.100.0/24. Which TWO steps must be taken on the FortiGate?

Accepted Answer

Set the trusted host(s) on the administrator account to 192.168.100.0/24. Option A is correct because configuring the administrator account's trusted hosts to 192.168.100.0/24 restricts which source addresses can authenticate to the FortiGate, so only administrators connecting from that management subnet can log in. Option E is correct because the interface's allowaccess setting determines which management protocols (such as https and ssh) are enabled on that interface; setting allowaccess to https and ssh permits only those administrative access methods. Together, these two steps enforce both source-address restriction and protocol restriction for administrative access. Option B is not required because local-in policies control traffic destined to the FortiGate for services like management, but the trusted-host and allowaccess settings already satisfy the stated requirement. Option C is incorrect because HTTPS and SSH are enabled per interface via allowaccess, not globally under system global. Option D is incorrect because firewall policies do not govern administrative access to the FortiGate itself; management access is controlled by interface allowaccess and trusted hosts.

Answer

Create a local-in policy to allow traffic from 192.168.100.0/24

Answer

Enable HTTPS and SSH globally under system global

Answer

Configure a firewall policy to permit HTTPS and SSH from the management subnet to the FortiGate

Question 9

You are troubleshooting a FortiGate HA cluster (active-passive) and notice that after a failover, some existing TCP sessions are not being maintained. The hbdev heartbeat interfaces are configured correctly, and session synchronization is enabled. What is the MOST likely cause?

Accepted Answer

NPU offloading is enabled on the primary FortiGate. When NPU offloading is enabled on the primary FortiGate, session synchronization for existing TCP sessions may fail because the NPU processes traffic directly without involving the CPU, bypassing the session synchronization mechanism. During a failover, the secondary unit does not have these offloaded sessions in its session table, causing established TCP connections to drop. This is a common issue in active-passive HA clusters where hardware acceleration interferes with stateful failover.

Answer

The secondary unit is in maintenance mode

Answer

The HA uptime monitor is not configured

Answer

Session pickup is not enabled in the HA configuration

Question 10

An administrator configures a policy route to direct traffic from subnet 10.1.1.0/24 to the internet via ISP1 with a gateway of 203.0.113.1. However, traffic from that subnet is still using the default route via ISP2. What is the MOST likely cause?

Accepted Answer

The source interface is not specified in the policy route. Policy routes in FortiGate are evaluated based on the source interface and source address. If the source interface is not specified, the policy route may not match the incoming traffic because the firewall does not know which interface the traffic is arriving on. Without a matching source interface, the policy route is skipped, and the default route (via ISP2) is used instead.

Answer

The default route has a lower administrative distance

Answer

The policy route's destination is set to 'all' which conflicts with the default route

Answer

The policy route is configured after the default route in the routing table

Question 11

A FortiGate administrator needs to configure a backup and restore strategy for the FortiGate configuration. Which TWO statements are correct regarding configuration backup and restore?

Accepted Answer

When restoring a configuration to a different FortiGate model, the interface names may cause the restore to fail.. Option A is correct because interface names are model-specific (for example, internal, wan1, port1), so restoring a configuration from one FortiGate model to a different model can fail or misconfigure interfaces when the target lacks matching interface names. Option E is correct because the configuration backup file includes the full system settings and records the firmware version, which is why FortiGate can warn about version mismatches during restore. Option B is incorrect because an encrypted backup is not strictly limited to the exact same firmware version; it can be restored on compatible firmware, and the encryption is tied to the password, not solely the firmware build. Option C is incorrect because FortiGate supports restoring specific configuration sections or using partial restore/script methods rather than only a full restore. Option D is incorrect because backups are not encrypted by default; the administrator must enable password-based encryption when creating the backup.

Answer

The encrypted backup can only be restored on a FortiGate running the same firmware version.

Answer

It is not possible to restore only a specific section of the configuration (e.g., only firewall policies).

Answer

The backup file is encrypted by default to protect sensitive information.

Question 12

A FortiGate administrator is setting up a new FortiGate and needs to integrate it with FortiAnalyzer and FortiManager. Which THREE statements are correct regarding this integration?

Accepted Answer

FortiAnalyzer can generate reports based on the logs received from FortiGate.. Option A is correct because FortiAnalyzer's core function is to collect, store, and analyze logs from managed devices such as FortiGate, and it uses that log data to generate both predefined and custom reports (for example, traffic, security, and usage reports). Option B is correct because FortiManager is the centralized management platform that can manage multiple FortiGate devices from a single console, allowing administrators to push policy packages, provision devices, and monitor status across the fleet. Option E is correct because FortiGate can send its logs to FortiAnalyzer for centralized logging, storage, and analysis, which is the primary integration use case between the two products. Option C is not correct because pushing configuration changes to a FortiGate is a FortiManager function, not a FortiAnalyzer function; FortiAnalyzer is focused on logging, analysis, and reporting. Option D is not correct because FGFM (FortiGate-FortiManager protocol) is used between FortiGate and FortiManager for management tunnel communication, not between FortiGate and FortiAnalyzer; FortiGate sends logs to FortiAnalyzer using OFTP (FortiGate-to-FortiAnalyzer protocol) over port 514.

Answer

FortiAnalyzer can push configuration changes to the FortiGate.

Answer

FortiGate uses the FGFM protocol to communicate with FortiAnalyzer.

Question 13

A FortiGate is deployed at the network edge with two ISP links: wan1 (primary) and wan2 (backup). The administrator wants internal users' outbound web traffic to use wan1 normally, but automatically fail over to wan2 if wan1 becomes unreachable. Both interfaces have static IP addresses and default routes are already configured. Which FortiGate feature should the administrator configure to achieve this?

Accepted Answer

Link Health Monitor with a gateway ping server on wan1 and a lower distance on the wan1 default route.. The correct approach is to use a Link Health Monitor on wan1's default route. This feature actively probes the link and, upon failure, removes the route from the routing table, allowing the backup route on wan2 to take over. This provides automatic failover without manual intervention. Policy routes, ECMP, and SD-WAN are either static or designed for different use cases, making them less suitable for this straightforward failover requirement.

Answer

SD-WAN with two members (wan1 and wan2) and a performance SLA that measures latency and jitter.

Answer

ECMP with equal distance on both default routes, and enable spillover on wan1.

Answer

Policy routes that forward all outbound traffic to wan1, with a backup policy route pointing to wan2.

Question 14

An administrator configures an IPsec VPN between two FortiGates. The VPN is up, but traffic from the local subnet to the remote subnet is not passing through the tunnel. The administrator confirms that the Phase 2 selectors match on both sides. What should the administrator check next on the local FortiGate?

Accepted Answer

The firewall policy that permits traffic from the local subnet to the remote subnet and is associated with the IPsec VPN tunnel.. In a policy-based IPsec VPN, a firewall policy must explicitly permit traffic from the local subnet to the remote subnet and use the IPsec tunnel as the outgoing interface. Without this policy, the FortiGate drops the traffic, even though the tunnel is established and Phase 2 selectors match. This is a common oversight after configuring the VPN.

Answer

The route to the remote subnet via the IPsec tunnel, ensuring it is more specific than any other route.

Answer

The Phase 1 proposal settings, such as encryption and authentication algorithms, to ensure they match the remote peer.

Answer

The dead peer detection (DPD) settings to ensure the tunnel is not being torn down due to inactivity.

Question 15

A FortiGate is deployed at a branch office behind a NAT device. The administrator needs the FortiGate to establish an IPsec VPN to the head office, but the branch FortiGate does not have a static public IP address. Which configuration should be applied on the branch FortiGate to allow the tunnel to come up?

Accepted Answer

Enable NAT traversal (NAT-T) on the phase1 interface and set the local gateway to 0.0.0.0.. When a FortiGate is behind a NAT device and lacks a static public IP, the IPsec tunnel must use NAT-T to encapsulate ESP in UDP. Setting the local gateway to 0.0.0.0 allows the FortiGate to use the outgoing interface's IP dynamically. This combination ensures the branch can initiate the tunnel to the head office despite the NAT device.

Answer

Set the phase1 remote gateway to the head office public IP and enable IKE mode aggressive.

Answer

Configure the phase2 selector to 0.0.0.0/0 and enable auto-negotiate.

Answer

Create a static route to the head office public IP using the WAN interface and enable dead peer detection.