NSE4 System and Network Administration Practice Test 5 — 15 Questions

Question 1

You run the following command on a FortiGate:

```
diagnose sys session filter dport 443
diagnose sys session list
```

The output shows:
```
proto=6 proto_state=01 duration=3600 expire=3599
```

What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and has 3599 seconds remaining before timeout.. The output shows `duration=3600` and `expire=3599`, which indicate the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. The `proto=6` confirms TCP (protocol 6), and `proto_state=01` represents the TCP state for an established connection (ESTABLISHED), not a handshake state.

Answer

The session is using TCP state 01 (SYN_SENT) and is still in the process of establishing.

Answer

The session has been idle for 3600 seconds and will expire in 3599 seconds.

Answer

The session is using UDP protocol and will expire in 3599 seconds.

Question 2

A FortiGate administrator needs to upgrade the firmware from FortiOS 6.4 to 7.0. The administrator downloads the upgrade image but when uploading via the GUI, the FortiGate reboots and comes back with the same firmware version. What is the most likely cause?

Accepted Answer

The administrator uploaded the wrong image (e.g., for a different FortiGate model).. Uploading a firmware image intended for a different FortiGate model will cause the upgrade to fail silently. The FortiGate validates the image against its hardware platform; if the image does not match, the device rejects it and reboots with the existing firmware. This is a common issue when administrators accidentally download the image for a different series (e.g., FortiGate 100F vs. 200F).

Answer

The firmware image was corrupted during download.

Answer

The FortiGate does not support firmware upgrade via GUI; CLI must be used.

Answer

The administrator must first upgrade to an intermediate version before 7.0.

Question 3

An administrator configures a VLAN interface on a FortiGate trunk port. The VLAN is allowed on the trunk, but the FortiGate cannot ping the default gateway of that VLAN. Which two items must be verified? (Choose two.)

Accepted Answer

The VLAN interface has an IP address in the correct subnet.. The VLAN interface must have an IP address in the same subnet as the default gateway to enable routing. Option C is correct because an administratively down interface cannot transmit or receive traffic. Option E is incorrect because the VLAN is already allowed on the trunk, so the VLAN ID match is implicitly configured; the issue is more likely the interface IP or status. Options B and D are incorrect as explained.

Answer

A firewall policy allows ICMP from the FortiGate to the gateway.

Answer

The trunk port is set to access mode.

Answer

The VLAN ID matches the switch configuration. [wrong]

Question 4

An administrator needs to back up the FortiGate configuration to a remote server. Which protocol is supported for backup?

Accepted Answer

TFTP. FortiGate supports backing up its configuration to a remote server using TFTP (Trivial File Transfer Protocol). TFTP is a lightweight, UDP-based protocol (port 69) that is commonly used for network device configuration backups because it requires minimal overhead and is widely supported by TFTP servers. The backup command in FortiGate CLI, such as 'execute backup config tftp

', specifically uses TFTP for this purpose.

Answer

FTP

Answer

SNMP

Answer

HTTP

Question 5

A FortiGate administrator configures SNMPv2c on the FortiGate to send traps to a monitoring server. However, no traps are received. The monitoring server can ping the FortiGate. What is the MOST likely cause?

Accepted Answer

The SNMP community string does not match between FortiGate and server.. SNMPv2c uses community strings as a form of authentication. If the community string configured on the FortiGate does not match the one configured on the monitoring server, the server will reject the trap. Since the server can ping the FortiGate, network connectivity is fine, and the issue is most likely an authentication mismatch.

Answer

SNMPv2c is not supported on FortiGate; only v3 is supported.

Answer

The FortiGate's firewall policy blocks SNMP traffic from the monitoring server.

Answer

The monitoring server's IP is not in the SNMP trap receiver list on FortiGate.

Question 6

An administrator configures a FortiGate to use NTP for time synchronization. After configuration, the FortiGate still shows the wrong time. Which command should the administrator run to verify NTP status?

Accepted Answer

diagnose sys ntp status. 'diagnose sys ntp status' is the FortiGate CLI command that provides detailed NTP synchronization status, including whether the FortiGate is synchronized to an NTP server, the stratum level, and the last sync time. This command is specifically designed for troubleshooting NTP issues, unlike the other options which either show configuration or are invalid.

Answer

show system ntp

Answer

execute ntp status

Answer

diagnose sys time status

Question 7

A FortiGate is configured with multiple WAN interfaces and ECMP routing. The administrator notices that traffic to a particular destination is intermittently failing. What is the MOST likely cause?

Accepted Answer

The ECMP load balancing method is set to source-destination IP hash, causing asymmetric routing.. When ECMP is configured with the source-destination IP hash load balancing method, traffic for the same session may be sent over different WAN interfaces if the source or destination IP changes mid-session (e.g., due to NAT or asymmetric routing). This causes packets to arrive out of order or be dropped by stateful inspection, leading to intermittent failures. The FortiGate expects all packets in a session to traverse the same interface for proper state tracking.

Answer

The ECMP routes have different distances.

Answer

The FortiGate's session table is full.

Answer

The firewall policies are not configured for ECMP.

Question 8

An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)

Accepted Answer

Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).. FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Answer

Enable SNMP on the FortiGate to allow FortiManager to monitor.

Answer

Configure a VPN tunnel between FortiGate and FortiManager.

Answer

Set the FortiGate's operation mode to transparent.

Question 9

An administrator is configuring a loopback interface on a FortiGate for management purposes. Which three statements are true about loopback interfaces? (Choose three.)

Accepted Answer

Multiple loopback interfaces can be created.. FortiGate allows the creation of multiple loopback interfaces (up to 16, depending on the model) for various purposes such as management, routing, or VPN termination. Each loopback interface is a virtual interface that does not depend on any physical port, providing flexibility in network design.

Answer

Loopback interfaces support VLAN tagging.

Answer

A loopback interface requires a physical port to be associated.

Question 10

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is active and established. The output shows `proto=6` (TCP), `proto_state=01` (TCP ESTABLISHED), `duration=3600` seconds, and `expire=3599` seconds remaining. This indicates a fully established TCP session that has been active for one hour and still has nearly a full hour of idle timeout remaining. Therefore, the session is active and established, making option D correct.

Answer

The session is in a half-closed state

Answer

The session is about to expire

Answer

The session is a UDP session

Question 11

An administrator configures two FortiGate units in an active-passive HA cluster. After a failover, some existing TCP sessions are dropped. What is the most likely reason for this behavior?

Accepted Answer

Session synchronization is not enabled. In an active-passive HA cluster, session synchronization must be explicitly enabled to replicate TCP session state from the primary unit to the backup unit. Without session sync, the backup unit has no knowledge of existing TCP sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The failover time is too slow

Answer

The FortiGate units are running different firmware versions

Answer

The HA cluster is using a virtual MAC address

Question 12

You run 'get system performance status' and see CPU usage at 95% with high context switch rate. The FortiGate is not passing any traffic. What is the most likely cause?

Accepted Answer

A routing loop is causing continuous packet processing. A routing loop causes the FortiGate to continuously process and re-process packets as they are forwarded in a cycle between routers, leading to high CPU usage and context switch rates. The loop prevents traffic from being successfully delivered, resulting in zero traffic passing through the FortiGate. This matches the observed symptoms of 95% CPU usage and high context switching.

Answer

The FortiGate is under a DDoS attack

Answer

The antivirus engine is updating signatures

Answer

The FortiGate is in transparent mode

Question 13

An administrator creates a firewall policy to allow internal users to access the internet. The source interface is 'internal', destination interface is 'wan1', and NAT is enabled. Users complain that they cannot access external resources. The administrator verifies that the default route points to the ISP gateway. What is the most likely missing configuration?

Accepted Answer

The policy action is set to DENY. The most likely missing configuration is that the firewall policy action is set to DENY. Even with correct NAT, routing, and DNS settings, if the policy action is DENY, traffic from the internal interface to the wan1 interface will be dropped. The administrator must ensure the policy action is ACCEPT to permit outbound traffic.

Answer

The DNS server is not configured on the FortiGate

Answer

The FortiGate is in transparent mode

Answer

The session helper for FTP is disabled

Question 14

A FortiGate administrator wants to send logs to a FortiAnalyzer. The FortiAnalyzer IP is 192.168.1.100, and logging is configured under Log & Report. However, no logs are being received. Which command should the administrator use on the FortiGate to verify connectivity to the FortiAnalyzer?

Accepted Answer

diagnose log device status. The 'diagnose log device status' command specifically checks the connectivity status and last-acknowledged sequence number between the FortiGate and the configured FortiAnalyzer. This command verifies whether the FortiGate can reach the FortiAnalyzer at the logging protocol level (FGFM), which is essential for log transmission, unlike a basic ICMP ping that only tests network-layer reachability.

Answer

execute ping 192.168.1.100

Answer

show full-configuration log fortianalyzer

Answer

get system ha status

Question 15

An organization has two FortiGate units in an HA cluster. They need to perform a firmware upgrade on the primary unit without causing a failover. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a graceful failover, then upgrade the original primary. In an HA cluster, upgrading the secondary unit first ensures that the primary remains active and can take over if the upgrade fails. After the secondary is upgraded and stable, a graceful failover is performed to make it the new primary, allowing the original primary to be upgraded without causing an unplanned failover or service interruption.

Answer

Upgrade the primary unit first, then the secondary will automatically synchronize

Answer

Upgrade both units simultaneously using the GUI

Answer

Disable HA, upgrade both, then re-enable HA