NSE4 System and Network Administration Practice Test 6 — 15 Questions

Question 1

An admin configures an aggregate interface on a FortiGate using two physical ports. After configuration, the admin notices that traffic is not load-balancing evenly. What is the MOST likely cause?

Accepted Answer

The aggregate interface is using the default load-balancing algorithm. The default load-balancing algorithm for an aggregate interface (LAG) on FortiGate is based on the source and destination MAC addresses. This algorithm often results in uneven traffic distribution, especially when traffic flows are limited to a small number of MAC pairs. To achieve more even load balancing, the algorithm should be changed to one that considers IP addresses or Layer 4 ports, such as 'src-dst-ip' or 'src-dst-ip-port'.

Answer

The aggregate interface is set to active-passive mode

Answer

The physical ports are connected to different switches

Answer

The MTU size is mismatched on the physical ports

Question 2

A FortiGate in NAT/Route mode has a policy with NAT enabled. The admin needs the source IP of traffic from internal users (192.168.1.0/24) to be translated to the interface IP of port1 (203.0.113.1) when accessing the internet. Which configuration is necessary?

Accepted Answer

Configure a firewall policy with NAT enabled and the outbound interface set to port1. Option D is correct because in NAT/Route mode, enabling NAT on a firewall policy with the outbound interface set to port1 causes the FortiGate to translate the source IP of traffic from the internal network (192.168.1.0/24) to the IP address of that interface (203.0.113.1) by default. This is the standard method for source NAT (SNAT) in a policy-based configuration, requiring no additional IP pool or static route for the translation itself.

Answer

Add a static route for 192.168.1.0/24 with next-hop 203.0.113.1

Answer

Set the administrative access to HTTPS on port1

Answer

Create a central NAT rule with source 192.168.1.0/24 and IP pool 203.0.113.2-203.0.113.10

Question 3

Which command is used to back up the full FortiGate configuration including all settings and objects?

Accepted Answer

execute backup config. The 'execute backup config' command is the correct method to back up the full FortiGate configuration, including all settings and objects, to a TFTP or FTP server. This command exports the entire running configuration in a text format that can be restored later. It is the standard CLI command for a complete configuration backup.

Answer

execute backup full-config

Answer

config backup tftp

Answer

system backup configuration

Question 4

An admin configures two static routes to the same destination with different distances. The route with distance 10 points to ISP1, and the route with distance 20 points to ISP2. The admin wants to use ISP2 only if ISP1 fails. What is the expected behavior?

Accepted Answer

Traffic will use ISP1 until its route is removed, then use ISP2. When two static routes have different administrative distances, the route with the lower distance (10) is preferred and installed in the routing table. The route with distance 20 remains in the routing table as a backup. If the preferred route (via ISP1) is removed due to a failure, the backup route (via ISP2) is automatically activated. This behavior is fundamental to how FortiGate (and most routers) handle static routes with unequal distances.

Answer

Traffic will load-balance between ISP1 and ISP2

Answer

The route with distance 20 will be ignored entirely

Answer

Both routes will be active simultaneously, and the FortiGate will choose based on source IP

Question 5

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

Accepted Answer

A layer 2 firewall policy. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Answer

A policy-based NAT rule

Answer

A firewall policy using zone-based security

Answer

A VIP policy to map the web server's public IP

Question 6

During a firmware upgrade, the admin uploads the image via the GUI and clicks 'Upgrade'. The FortiGate reboots but comes up with the old firmware. What is the MOST likely cause?

Accepted Answer

The firmware image file is corrupted or not compatible with the platform. When a FortiGate reboots after an upgrade but loads the old firmware, the most likely cause is that the uploaded firmware image was corrupted or incompatible with the platform. The FortiGate verifies the image integrity (e.g., checksum) during the upgrade process; if the image fails validation, the system will not commit the new firmware and will fall back to the previous version stored in the secondary boot partition. This ensures the device remains operational even if the upgrade image is invalid.

Answer

The FortiGate was in HA mode and the peer did not upgrade

Answer

The admin did not reboot after the upgrade

Answer

The admin forgot to save the configuration before upgrading

Question 7

Which CLI command is used to configure NTP on a FortiGate?

Accepted Answer

config system ntp. The correct command to configure NTP on a FortiGate is `config system ntp`, which enters the NTP configuration context where you can set the NTP server addresses, authentication, and sync interval. This is the top-level command for NTP settings in the FortiOS CLI, as documented in the FortiGate Administration Guide.

Answer

config system ntp-server

Answer

config system time

Answer

execute ntp sync

Question 8

An admin wants to monitor CPU and memory usage on a FortiGate using SNMP. Which configuration is required?

Accepted Answer

Enable SNMP agent and configure an SNMP community. To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

Answer

Configure a performance SLA monitor

Answer

Enable SNMP on the interface and set administrative access to SNMP

Answer

Configure an SNMP v3 user and enable SNMP traps

Question 9

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 10

An admin needs to configure a FortiGate to send logs to a FortiAnalyzer. Which TWO steps must be performed? (Choose two.)

Accepted Answer

Configure the FortiAnalyzer IP under config system log-fortianalyzer. Option D is correct because the FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

Answer

Set the log aggregation interval

Answer

Configure SNMP trap destinations

Answer

Create a firewall policy to allow traffic to FortiAnalyzer

Question 11

An admin wants to ensure that traffic between two internal subnets (10.0.1.0/24 and 10.0.2.0/24) is inspected by the FortiGate but does not have its source IP translated. Which THREE configuration elements are required? (Choose three.)

Accepted Answer

NAT disabled on that policy. Option A is correct because when traffic between two internal subnets does not require source IP translation, NAT must be explicitly disabled on the firewall policy. By default, FortiGate policies may have NAT enabled (especially on outbound interfaces), so disabling NAT ensures the original source IP (10.0.1.x) is preserved when communicating with 10.0.2.x. This is configured by setting the 'set nat enable' option to 'disable' in the policy or unchecking NAT in the GUI.

Answer

A static route for each subnet on the FortiGate

Answer

An IP pool for source NAT

Question 12

An admin is configuring ECMP (Equal Cost Multi-Path) on a FortiGate with two ISPs. Which TWO conditions must be met for ECMP to load balance traffic across both links? (Choose two.)

Accepted Answer

The routes must have the same priority. ECMP requires that multiple routes to the same destination have equal cost. On FortiGate, the cost is determined by administrative distance (AD) and priority (which is the route metric). Both routes must have the same AD and the same priority to be considered equal-cost and eligible for load balancing. If either value differs, one route will be preferred over the other, and ECMP will not activate.

Answer

The routes must be configured with the same metric

Answer

The FortiGate must be in transparent mode

Answer

The routes must point to different next-hop IP addresses

Question 13

A network administrator notices that after configuring a new static route on a FortiGate, traffic to a remote subnet is still being forwarded via the default route. The administrator confirms the static route is present in the routing table with a lower distance than the default route. What is the MOST likely cause?

Accepted Answer

The static route's gateway is not reachable via any interface.

Answer

The static route is disabled by a firewall policy.

Answer

The static route is configured with a higher priority than the default route.

Answer

The static route's destination subnet overlaps with a directly connected subnet.

Question 14

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

Accepted Answer

Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.. Option C is correct because remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Answer

Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

Answer

Enable SSH access on the WAN interface instead of HTTPS.

Answer

Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

Question 15

You run the following command on a FortiGate:

```
diagnose sys session filter dport 443
diagnose sys session list
```

The output shows:
```
proto=6 proto_state=01 duration=3600 expire=3599
```

What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and has 3599 seconds remaining before timeout.. Option A is correct because the output shows `duration=3600` and `expire=3599`, which indicate the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. The `proto=6` confirms TCP (protocol 6), and `proto_state=01` represents the TCP state for an established connection (ESTABLISHED), not a handshake state.

Answer

The session is using TCP state 01 (SYN_SENT) and is still in the process of establishing.

Answer

The session has been idle for 3600 seconds and will expire in 3599 seconds.

Answer

The session is using UDP protocol and will expire in 3599 seconds.