NSE4 System and Network Administration Practice Test 7 — 15 Questions

Question 1

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

Accepted Answer

The management IP is not in the same subnet as the management network.. In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Answer

Transparent mode does not support management access; only NAT/Route mode does.

Answer

The FortiGate's firewall policy blocks management traffic even in transparent mode.

Answer

The administrator must configure a management VLAN interface to access the FortiGate.

Question 2

A FortiGate administrator needs to upgrade the firmware from FortiOS 6.4 to 7.0. The administrator downloads the upgrade image but when uploading via the GUI, the FortiGate reboots and comes back with the same firmware version. What is the most likely cause?

Accepted Answer

The administrator uploaded the wrong image (e.g., for a different FortiGate model).. Option C is correct because uploading a firmware image intended for a different FortiGate model will cause the upgrade to fail silently. The FortiGate validates the image against its hardware platform; if the image does not match, the device rejects it and reboots with the existing firmware. This is a common issue when administrators accidentally download the image for a different series (e.g., FortiGate 100F vs. 200F).

Answer

The firmware image was corrupted during download.

Answer

The FortiGate does not support firmware upgrade via GUI; CLI must be used.

Answer

The administrator must first upgrade to an intermediate version before 7.0.

Question 3

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

Accepted Answer

Policy-based routing (PBR). Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Answer

Equal-cost multi-path (ECMP) routing

Answer

Static route with higher distance

Answer

SD-WAN with load balancing

Question 4

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is not configured or is down.. In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Answer

The passive unit has a different firmware version.

Answer

The HA mode is set to active-active instead of active-passive.

Answer

The administrator must manually trigger a sync from the active unit.

Question 5

An administrator configures a VLAN interface on a FortiGate trunk port. The VLAN is allowed on the trunk, but the FortiGate cannot ping the default gateway of that VLAN. Which two items must be verified? (Choose two.)

Accepted Answer

The VLAN interface has an IP address in the correct subnet.. Option A is correct because the VLAN interface must have an IP address in the correct subnet to communicate with the default gateway. Without a matching subnet, the FortiGate cannot route ICMP packets to the gateway, even if the VLAN is allowed on the trunk.

Answer

A firewall policy allows ICMP from the FortiGate to the gateway.

Answer

The trunk port is set to access mode.

Question 6

An administrator needs to back up the FortiGate configuration to a remote server. Which protocol is supported for backup?

Accepted Answer

TFTP

Answer

FTP

Answer

SNMP

Answer

HTTP

Question 7

A FortiGate administrator configures SNMPv2c on the FortiGate to send traps to a monitoring server. However, no traps are received. The monitoring server can ping the FortiGate. What is the MOST likely cause?

Accepted Answer

The SNMP community string does not match between FortiGate and server.. SNMPv2c uses community strings as a form of authentication. If the community string configured on the FortiGate does not match the one configured on the monitoring server, the server will reject the trap. Since the server can ping the FortiGate, network connectivity is fine, and the issue is most likely an authentication mismatch.

Answer

SNMPv2c is not supported on FortiGate; only v3 is supported.

Answer

The FortiGate's firewall policy blocks SNMP traffic from the monitoring server.

Answer

The monitoring server's IP is not in the SNMP trap receiver list on FortiGate.

Question 8

An administrator configures a FortiGate to use NTP for time synchronization. After configuration, the FortiGate still shows the wrong time. Which command should the administrator run to verify NTP status?

Accepted Answer

diagnose sys ntp status. Option D is correct because 'diagnose sys ntp status' is the FortiGate CLI command that provides detailed NTP synchronization status, including whether the FortiGate is synchronized to an NTP server, the stratum level, and the last sync time. This command is specifically designed for troubleshooting NTP issues, unlike the other options which either show configuration or are invalid.

Answer

show system ntp

Answer

execute ntp status

Answer

diagnose sys time status

Question 9

A FortiGate is configured with multiple WAN interfaces and ECMP routing. The administrator notices that traffic to a particular destination is intermittently failing. What is the MOST likely cause?

Accepted Answer

The ECMP load balancing method is set to source-destination IP hash, causing asymmetric routing.. When ECMP is configured with the source-destination IP hash load balancing method, traffic for the same session may be sent over different WAN interfaces if the source or destination IP changes mid-session (e.g., due to NAT or asymmetric routing). This causes packets to arrive out of order or be dropped by stateful inspection, leading to intermittent failures. The FortiGate expects all packets in a session to traverse the same interface for proper state tracking.

Answer

The ECMP routes have different distances.

Answer

The FortiGate's session table is full.

Answer

The firewall policies are not configured for ECMP.

Question 10

An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)

Accepted Answer

Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).. Option B is correct because FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Answer

Enable SNMP on the FortiGate to allow FortiManager to monitor.

Answer

Configure a VPN tunnel between FortiGate and FortiManager.

Answer

Set the FortiGate's operation mode to transparent.

Question 11

An administrator is configuring a loopback interface on a FortiGate for management purposes. Which three statements are true about loopback interfaces? (Choose three.)

Accepted Answer

Multiple loopback interfaces can be created.. Option A is correct because FortiGate allows the creation of multiple loopback interfaces (up to 16, depending on the model) for various purposes such as management, routing, or VPN termination. Each loopback interface is a virtual interface that does not depend on any physical port, providing flexibility in network design.

Answer

Loopback interfaces support VLAN tagging.

Answer

A loopback interface requires a physical port to be associated.

Question 12

An administrator needs to configure DNS on a FortiGate so that internal hosts can resolve external domain names. Which two settings are required? (Choose two.)

Accepted Answer

Configure DNS servers under System > DNS.. Option A is correct because configuring DNS servers under System > DNS is the fundamental step that tells the FortiGate which external DNS resolvers (e.g., 8.8.8.8) to use for resolving domain names. Without this, the FortiGate cannot forward DNS queries from internal hosts to the internet. Option C is correct because enabling the DNS proxy on the FortiGate allows it to intercept DNS requests from internal clients, cache responses for performance, and forward them to the configured DNS servers, which is essential for internal hosts to resolve external domains through the FortiGate.

Answer

Create a firewall policy allowing DNS traffic from internal to external.

Answer

Set the FortiGate's hostname to the domain name.

Answer

Configure a static route for DNS servers.

Question 13

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is active and established. The output shows `proto=6` (TCP), `proto_state=01` (TCP ESTABLISHED), `duration=3600` seconds, and `expire=3599` seconds remaining. This indicates a fully established TCP session that has been active for one hour and still has nearly a full hour of idle timeout remaining. Therefore, the session is active and established, making option D correct.

Answer

The session is in a half-closed state

Answer

The session is about to expire

Answer

The session is a UDP session

Question 14

A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?

Accepted Answer

Enable SSH administrative access on the interface. Option C is correct because to allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

Answer

Enable HTTPS administrative access only

Answer

Set the administrative access to 'any'

Answer

Configure a firewall policy allowing SSH from the subnet

Question 15

A FortiGate has been configured with two WAN interfaces (wan1, wan2) in an SD-WAN zone. The administrator wants to ensure that traffic for a specific internal server uses only wan1. What is the most appropriate method?

Accepted Answer

Create an SD-WAN rule to match the server's traffic and set the preferred member to wan1. Option D is correct because SD-WAN rules allow granular traffic steering based on application, source, or destination. By creating an SD-WAN rule that matches the traffic destined for the internal server and setting the preferred member to wan1, the FortiGate will use SD-WAN's policy-based routing to ensure that traffic egresses exclusively via wan1, while other traffic can still use both WAN interfaces as per other rules.

Answer

Disable wan2 in the SD-WAN zone

Answer

Use policy routing with a higher priority for wan1

Answer

Configure a static route with a higher distance for wan2