NSE4 System and Network Administration Practice Test 4 — 15 Questions

Question 1

You run the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and see this output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection that has been active for 1 hour and will expire in 3599 seconds. Both options A and B are correct. The output shows a TCP session (proto=6) with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds. This means the session has been active for 3600 seconds and will be removed in 3599 seconds if no further traffic is seen. Option A correctly states these facts. Option B adds that this indicates a long-lived session, which is accurate for persistent connections like HTTPS where the session timer resets with each packet. Option C incorrectly identifies proto=6 as UDP (it is TCP). Option D incorrectly claims the duration equals the expire time; they are different by 1 second.

Answer

The session is UDP (proto=6 is TCP? Actually proto=6 is TCP) and the output indicates an ICMP error

Answer

There is a problem because the session duration equals the expire time, meaning it will be removed immediately

Question 2

An administrator needs to upgrade the firmware on a FortiGate from version 6.4.10 to 7.0.1. The device currently runs FortiOS 6.4.10. Which upgrade path should be followed?

Accepted Answer

Upgrade to 7.0.0 first, then to 7.0.1. Fortinet requires a sequential upgrade path for major version jumps. FortiOS 6.4.10 can upgrade directly to 7.0.0, and then to 7.0.1, because 7.0.0 is the first release in the 7.0 branch. Upgrading directly from 6.4.10 to 7.0.1 is not supported as it skips the required intermediate version.

Answer

Downgrade to 6.2.0 then upgrade to 7.0.1

Answer

Upgrade directly from 6.4.10 to 7.0.1 via the GUI

Answer

Upgrade to 6.4.99 (if exists) then to 7.0.1

Question 3

A FortiGate in an HA active-passive cluster is experiencing frequent failovers. The administrator checks the HA statistics and sees that the primary unit's heartbeat interface has a high error rate. What is the most likely cause?

Accepted Answer

The heartbeat cable is faulty or the interface has a duplex mismatch. A high error rate on the heartbeat interface indicates physical-layer issues such as a faulty cable or duplex mismatch. In an HA active-passive cluster, the heartbeat link must be reliable and low-latency; errors cause packet loss, leading the primary unit to appear unresponsive and triggering a failover to the secondary unit.

Answer

The heartbeat interface is configured as a single link without redundancy

Answer

The failover threshold is set too low

Answer

The HA configuration has mismatched passwords

Question 4

A FortiGate is configured with two WAN links (port1 and port2) and uses ECMP routing. The administrator wants to ensure that traffic from a specific internal subnet (192.168.10.0/24) always uses port1, while all other traffic uses ECMP. Which configuration should be applied?

Accepted Answer

Create two static routes with equal distances to use ECMP, and add a policy route for 192.168.10.0/24 with outgoing interface port1. Policy routes override the routing table for matching traffic, allowing you to force traffic from 192.168.10.0/24 out port1 while ECMP handles all other traffic. ECMP distributes traffic across multiple equal-cost routes, but a policy route takes precedence over the routing table for specified traffic. This meets the requirement without disrupting ECMP for other traffic.

Answer

Create a separate VDOM for 192.168.10.0/24 and route it through port1

Answer

Configure a VIP to translate 192.168.10.0/24 to an IP on port1

Answer

Use a firewall policy to change the route based on source

Question 5

An administrator wants to send FortiGate logs to a FortiAnalyzer for centralized logging and reporting. Which configuration step is required on the FortiGate?

Accepted Answer

Under Log & Report, configure the FortiAnalyzer settings and set the log forwarding. FortiGate uses the Log & Report section to configure FortiAnalyzer settings, specifically under 'Log Settings' or 'Log Forwarding'. This enables the FortiGate to forward logs to a FortiAnalyzer device for centralized logging and reporting, using the FortiGate-FortiAnalyzer protocol (based on syslog over TCP with Fortinet extensions).

Answer

Enable SNMP traps to the FortiAnalyzer

Answer

Create a firewall policy to allow traffic to the FortiAnalyzer

Answer

Configure a syslog server under System > Settings

Question 6

Which of the following statements about FortiGate backup is true?

Accepted Answer

The backup file contains the full configuration and can be encrypted with a password. FortiGate backup files contain the full device configuration, including all settings and policies, and can be encrypted with a password using the 'execute backup config' command with the 'password' option. This ensures confidentiality during storage or transfer, as the backup is stored in a binary format that requires the password for decryption during restoration.

Answer

The backup includes all current sessions and logs

Answer

A backup can be restored only on the same hardware model

Answer

Backup files are saved in plain text format

Question 7

An administrator is setting up SNMP monitoring on a FortiGate. Which two configurations are necessary for a basic SNMP setup? (Choose two.)

Accepted Answer

Configure an SNMP community with read-only access. An SNMP community with read-only access defines the basic authentication and access control for SNMPv1/v2c queries, which is essential for monitoring. Option C is correct because the SNMP agent must be enabled on the FortiGate to process SNMP requests from the monitoring server.

Answer

Create a firewall policy to allow SNMP traffic from the monitoring server

Answer

Set the SNMP trap destination IP

Answer

Configure a user for SNMPv3

Question 8

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is an established TCP session for HTTPS traffic. The output shows `proto=6` (TCP), `proto_state=01` (TCP established), `dport=443` (HTTPS), and a duration/expire indicating an active session. This confirms an established TCP session for HTTPS traffic, making D correct.

Answer

The session is a half-open TCP connection

Answer

The session is a multicast session

Answer

The session is a UDP session for DNS over HTTPS

Question 9

An admin configures an aggregate interface on a FortiGate using two physical ports. After configuration, the admin notices that traffic is not load-balancing evenly. What is the MOST likely cause?

Accepted Answer

The aggregate interface is using the default load-balancing algorithm. The default load-balancing algorithm for an aggregate interface (LAG) on FortiGate is based on the source and destination MAC addresses. This algorithm often results in uneven traffic distribution, especially when traffic flows are limited to a small number of MAC pairs. To achieve more even load balancing, the algorithm should be changed to one that considers IP addresses or Layer 4 ports, such as 'src-dst-ip' or 'src-dst-ip-port'.

Answer

The aggregate interface is set to active-passive mode

Answer

The physical ports are connected to different switches

Answer

The MTU size is mismatched on the physical ports

Question 10

Which command is used to back up the full FortiGate configuration including all settings and objects?

Accepted Answer

execute backup config. The 'execute backup config' command is the correct method to back up the full FortiGate configuration, including all settings and objects, to a TFTP or FTP server. This command exports the entire running configuration in a text format that can be restored later. It is the standard CLI command for a complete configuration backup.

Answer

execute backup full-config

Answer

config backup tftp

Answer

system backup configuration

Question 11

An admin configures two static routes to the same destination with different distances. The route with distance 10 points to ISP1, and the route with distance 20 points to ISP2. The admin wants to use ISP2 only if ISP1 fails. What is the expected behavior?

Accepted Answer

Traffic will use ISP1 until its route is removed, then use ISP2. When two static routes have different administrative distances, the route with the lower distance (10) is preferred and installed in the routing table. The route with distance 20 remains in the routing table as a backup. If the preferred route (via ISP1) is removed due to a failure, the backup route (via ISP2) is automatically activated. This behavior is fundamental to how FortiGate (and most routers) handle static routes with unequal distances.

Answer

Traffic will load-balance between ISP1 and ISP2

Answer

The route with distance 20 will be ignored entirely

Answer

Both routes will be active simultaneously, and the FortiGate will choose based on source IP

Question 12

Which CLI command is used to configure NTP on a FortiGate?

Accepted Answer

config system ntp. The correct command to configure NTP on a FortiGate is `config system ntp`, which enters the NTP configuration context where you can set the NTP server addresses, authentication, and sync interval. This is the top-level command for NTP settings in the FortiOS CLI, as documented in the FortiGate Administration Guide.

Answer

config system ntp-server

Answer

config system time

Answer

execute ntp sync

Question 13

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 14

An admin needs to configure a FortiGate to send logs to a FortiAnalyzer. Which TWO steps must be performed? (Choose two.)

Accepted Answer

Configure the FortiAnalyzer IP under config system log-fortianalyzer. The FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

Answer

Set the log aggregation interval

Answer

Configure SNMP trap destinations

Answer

Create a firewall policy to allow traffic to FortiAnalyzer

Question 15

An admin wants to ensure that traffic between two internal subnets (10.0.1.0/24 and 10.0.2.0/24) is inspected by the FortiGate but does not have its source IP translated. Which THREE configuration elements are required? (Choose three.)

Accepted Answer

NAT disabled on that policy. When traffic between two internal subnets does not require source IP translation, NAT must be explicitly disabled on the firewall policy. By default, FortiGate policies may have NAT enabled (especially on outbound interfaces), so disabling NAT ensures the original source IP (10.0.1.x) is preserved when communicating with 10.0.2.x. This is configured by setting the 'set nat enable' option to 'disable' in the policy or unchecking NAT in the GUI.

Answer

A static route for each subnet on the FortiGate

Answer

An IP pool for source NAT