NSE4 System and Network Administration Practice Test 6 — 15 Questions

Question 1

After upgrading FortiGate firmware, the administrator notices that the 'config router static' command now shows a new keyword 'distance' instead of 'weight'. The upgrade also changed the ECMP load-balancing behavior. What was the likely change in the ECMP algorithm?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ECMP algorithm changed from weighted to source-dest-IP. In FortiOS 6.4, the default ECMP method was weighted, using the 'weight' parameter in static routes. Starting with FortiOS 7.0, the 'weight' parameter was replaced by 'distance', and the default ECMP algorithm changed to source-IP-based hash (also referred to as source-dest-IP hash). This change enhances load balancing by distributing traffic based on source/destination IP addresses rather than priority weights.

Answer

The ECMP algorithm changed from source-IP-based to weighted (hash-based)

Answer

The ECMP algorithm is now configurable via 'config system ecmp'

Answer

The ECMP algorithm changed from source-dest-IP to round-robin

Question 2

A FortiGate administrator needs to allow SNMP monitoring from a management station at 10.10.10.50. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable SNMP agent globally. The SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.

Answer

Configure an SNMP trap to send alerts to 10.10.10.50

Answer

Enable SNMP on the interface connected to the management station

Answer

Configure a firewall policy allowing SNMP from the management station

Question 3

A FortiGate in NAT/Route mode has multiple internal networks. The administrator wants to configure a loopback interface for management access. Which THREE statements about loopback interfaces are correct? (Choose three.)

Accepted Answer

The loopback interface is always up regardless of physical link status. A loopback interface is a logical interface that is not tied to any physical link. It remains in an 'up' state as long as the FortiGate is operational, making it ideal for management access that must be available even if physical ports fail.

Answer

The loopback interface must be assigned to a physical port

Answer

The loopback interface cannot be used for firewall policies

Question 4

You are troubleshooting a FortiGate HA cluster that is not failing over correctly. The cluster has two units in active-passive mode. You check the HA status and see both units are in 'standalone' mode. Which THREE configurations could cause this? (Choose three.)

Accepted Answer

The HA group ID is different on each unit. The HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Answer

The FortiGate is configured in transparent mode

Answer

The firmware versions are different but both are 7.0.x

Question 5

A FortiGate administrator is setting up a new FortiGate in a network that requires the firewall to bridge traffic between two subnets without routing. Which operating mode should the administrator select?

Accepted Answer

Transparent mode. Transparent mode allows the FortiGate to act as a Layer 2 bridge, forwarding traffic between two subnets without performing any routing or NAT. In this mode, the firewall operates like a 'bump in the wire,' inspecting and filtering traffic based on MAC addresses and Layer 2 headers, while the IP addresses of connected devices remain unchanged. This is ideal for scenarios where the FortiGate must be inserted into an existing network without altering the IP topology.

Answer

NAT/Route mode

Answer

HA mode

Answer

VLAN mode

Question 6

An administrator configures an HA cluster of two FortiGates in active-passive mode. The cluster is synchronized, but after a failover, some existing TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization (session-pickup) is disabled. Session synchronization (session-pickup) is required for active-passive HA clusters to replicate TCP session state from the primary FortiGate to the secondary. When disabled, the backup unit has no knowledge of existing sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in NAT mode

Answer

The cluster is using a virtual MAC address for the HA interface

Question 7

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
And you see the output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that was just established and will expire in about 1 hour. The command `diagnose sys session filter dport 443` filters sessions to destination port 443, and `diagnose sys session list` displays matching sessions. The output shows `proto=6` which is TCP, `proto_state=01` which corresponds to TCP state ESTABLISHED, `duration=3600` seconds indicating the session has been active for 1 hour, and `expire=3599` seconds meaning the session will timeout in approximately 1 hour. Therefore, option C is correct because it describes a TCP connection to port 443 that is established and will expire in about 1 hour. Note that the session is not 'just established' as it has been active for 1 hour, but the other options are incorrect.

Answer

The session is a UDP session to port 443

Answer

The session is in a CLOSE state

Answer

The session has been active for 1 hour and has 1 second remaining before expiry

Question 8

A FortiGate administrator needs to allow remote management of a FortiGate from the internet. Which administrative access protocols should be enabled on the WAN interface? (Choose the best single answer.)

Accepted Answer

HTTPS and SSH. HTTPS (port 443) and SSH (port 22) are the only secure administrative access protocols that provide encrypted communication for remote management over the internet. HTTP and Telnet transmit credentials and data in plaintext, making them unsuitable for WAN-facing interfaces. FortiGate best practices mandate disabling all insecure protocols on external interfaces and enabling only HTTPS and SSH for administrative access.

Answer

Ping and SNMP

Answer

HTTP and Telnet

Answer

FTP and TFTP

Question 9

An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?

Accepted Answer

The policy route's incoming interface is incorrectly configured. Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.

Answer

The static default route has a lower administrative distance than the policy route

Answer

The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM

Answer

The policy route has a lower priority than the static default route

Question 10

An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The correct command is 'execute backup config tftp ' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.

Answer

diagnose debug config-error-log read

Answer

show full-configuration

Answer

execute restore config tftp

Question 11

A FortiGate administrator needs to ensure that all DNS queries from internal clients are forwarded to a specific DNS server for security filtering. Which configuration should be applied?

Accepted Answer

Enable DNS forwarding under Network > DNS and set the system DNS to the desired server. DNS forwarding on FortiGate allows the device to act as a DNS relay, intercepting DNS queries from internal clients and forwarding them to a specified DNS server for security filtering. This is configured under Network > DNS by setting the system DNS to the desired server, which ensures all DNS traffic is redirected without requiring policy routing or firewall rule changes.

Answer

Use policy routing to redirect DNS traffic to the server

Answer

Create a firewall policy to allow DNS traffic to the external server only

Answer

Configure a DNS database on the FortiGate

Question 12

A network administrator is configuring SNMP on a FortiGate for monitoring. Which three pieces of information are required to complete the SNMPv2c configuration? (Choose THREE.)

Accepted Answer

SNMP manager IP address (allowed hosts). SNMPv2c uses community-based security, so the SNMP community string (Option D) is required for authentication. The SNMP manager IP address (Option B) is needed to define which hosts are allowed to query the FortiGate. The SNMP interface (Option E) specifies which network interface will listen for and respond to SNMP queries. These three pieces are mandatory for SNMPv2c configuration on a FortiGate.

Answer

SNMPv3 authentication protocol (MD5/SHA)

Answer

SNMP trap receiver IP and community

Question 13

An administrator wants to use FortiManager to manage multiple FortiGates. Which three steps must be performed to establish communication between a FortiGate and FortiManager? (Choose THREE.)

Accepted Answer

Ensure network connectivity between the FortiGate and FortiManager. FortiManager communicates with managed FortiGates over TCP/541 (FGFM protocol). Without IP-level connectivity between the two devices, the registration and management tunnel cannot be established. This is a prerequisite before any configuration steps can succeed.

Answer

Place the FortiGate in transparent mode

Answer

Configure the FortiGate's management interface with an IP address

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that has been active for 1 hour. The best answer because the output shows proto=6 (TCP) and dport=443 (HTTPS). However, the duration=3600 and expire=3599 fields indicate the session has a total lifetime of 3600 seconds and has been active for only 1 second (duration - expire). The session will expire in 3599 seconds (about 1 hour). The option's wording 'active for 1 hour' is a common misinterpretation; the session has not yet been active for 1 hour, but it will expire in 1 hour. This is the most accurate among the given choices.

Answer

The session is blocked by a firewall policy

Answer

The session is a UDP connection to port 443

Answer

The session is experiencing high latency

Question 15

A FortiGate configured in NAT/Route mode is connected to the internet via port1 with an IP 10.0.0.1/24. The internal network uses 192.168.1.0/24. Users can browse the internet but cannot reach a public server at 203.0.113.5. A static default route exists. What is the most likely cause?

Accepted Answer

The public server is down. Since users can browse the internet, the existing firewall policy must be allowing outbound traffic with some form of NAT (either on the FortiGate or upstream). The inability to reach specifically 203.0.113.5 suggests the problem is related to that particular destination, such as the server being down, a route specific to that subnet, or a firewall rule blocking it. Among the given options, the most likely cause is that the public server is down (B).

Answer

The static default route points to the wrong gateway

Answer

The firewall policy for outbound traffic does not have NAT enabled

Answer

The DNS server is not configured