NSE4 System and Network Administration Practice Test 7 — 15 Questions

Question 1

A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

source-destination-ip. The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.

Answer

weighted-round-robin

Answer

vip-inbound-grpc

Answer

spillover

Question 2

An administrator is configuring a FortiGate in a transparent mode. Which of the following features is NOT available in transparent mode?

Accepted Answer

Source NAT. In transparent mode, the FortiGate operates as a Layer 2 bridge without routing capabilities, meaning it cannot perform Source NAT (SNAT) because SNAT requires Layer 3 routing to translate source IP addresses. Transparent mode does not have an IP address on its interfaces for routing, so features dependent on Layer 3 forwarding, such as NAT, are unavailable.

Answer

VLAN tagging

Answer

Intrusion Prevention System (IPS)

Answer

Security profiles (AV, web filter)

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is about to expire in 3599 seconds. The 'expire=3599' field indicates the session will be removed from the session table in 3599 seconds. The 'duration=3600' shows the session has been active for 3600 seconds, so the total session lifetime is 7200 seconds (3600 + 3599). This is a normal TCP session (proto=6) in state 01 (SYN_SENT), not an error or idle condition.

Answer

The session is in an error state

Answer

The session has been idle for 3600 seconds

Answer

The session is to port 3600

Question 4

What is the purpose of configuring an aggregate interface on a FortiGate?

Accepted Answer

To combine multiple physical interfaces into one logical interface for increased throughput and redundancy. An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical FortiGate interfaces into a single logical interface. This increases throughput by load-balancing traffic across the member links and provides redundancy: if one physical link fails, traffic continues over the remaining links. FortiGate supports both static aggregation and LACP (IEEE 802.3ad) for dynamic negotiation.

Answer

To enable VLAN tagging on a physical interface

Answer

To separate management traffic from data traffic

Answer

To connect two different network segments with a firewall in between

Question 5

A FortiGate administrator needs to allow remote management from the internet only from a specific IP address. Which configuration achieves this?

Accepted Answer

Create a local-in policy to allow management access only from the trusted host. A local-in policy is the correct method to restrict remote management access to a FortiGate from the internet because it operates at the control plane level, filtering traffic destined to the FortiGate itself before it reaches the management daemons. By specifying a source IP address in a local-in policy, you can explicitly allow HTTPS or SSH management only from that trusted host, while implicitly denying all other sources. This is more secure than relying on firewall policies, which apply to traffic passing through the FortiGate, not to traffic destined to the FortiGate's own IP addresses.

Answer

Change the admin port to a non-standard port

Answer

Enable HTTPS and restrict admin access via admin host

Answer

Use a firewall policy with source address restriction

Question 6

An administrator plans to upgrade FortiGate firmware from version 6.0 to 7.2. The current version is 6.0.10. Which upgrade path is correct?

Accepted Answer

Upgrade to 6.2, then 6.4, then 7.0, then 7.2. FortiGate firmware upgrades must follow a supported path that does not skip major versions. Upgrading from 6.0.10 to 7.2.0 requires stepping through 6.2, 6.4, and 7.0 because Fortinet only supports upgrades from one major version to the next major version (e.g., 6.0→6.2→6.4→7.0→7.2). Option D correctly lists this sequential path.

Answer

Upgrade to 6.4 first, then to 7.2

Answer

It is not possible to upgrade from 6.0 to 7.2

Answer

Direct upgrade from 6.0.10 to 7.2.0 is supported

Question 7

Which command is used to back up the FortiGate configuration to a TFTP server?

Accepted Answer

execute backup config tftp . The correct command to back up the FortiGate configuration to a TFTP server is 'execute backup config tftp '. This is because FortiGate uses the 'execute' command for operational tasks, and 'backup config tftp' specifically instructs the system to export the running configuration to a TFTP server. The other options use incorrect syntax or commands that are not recognized by the FortiGate CLI.

Answer

save config tftp

Answer

backup tftp config

Answer

copy config tftp

Question 8

A FortiGate is set to NAT/Route mode. The admin wants traffic from internal users to the internet to use an IP address on the WAN interface for source NAT. Which configuration is required?

Accepted Answer

Enable NAT on the policy from internal to WAN and set the outgoing interface to the WAN interface. In NAT/Route mode, source NAT (SNAT) is configured by enabling NAT on the firewall policy that governs traffic from the internal network to the WAN interface. When NAT is enabled on the policy and the outgoing interface is set to the WAN interface, FortiGate automatically translates the source IP of internal users to the primary IP address of that WAN interface (or a configured IP pool). This is the standard method for allowing internal users to access the internet with a public IP address.

Answer

Set the FortiGate to transparent mode

Answer

Configure a policy route to force traffic through a specific interface

Answer

Configure a virtual IP mapping internal IPs to the WAN IP

Question 9

You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?

Accepted Answer

The HA heartbeat interface is not configured correctly or is down. The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings. The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.

Answer

The secondary unit has a lower priority, so it never takes over

Answer

The password for HA synchronization is incorrect

Answer

The session pickup feature is disabled

Question 10

An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?

Accepted Answer

The policy route is applied to the wrong incoming interface. Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

Answer

The firewall policy denies the traffic before policy routing

Answer

The default route has a higher administrative distance

Answer

The policy route destination is set to all

Question 11

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. Which two configurations are required? (Choose two.)

Accepted Answer

Configure FortiAnalyzer IP under config system central-management. The FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.

Answer

Enable log transfer under config log fortianalyzer setting

Answer

Configure a firewall policy to allow logs to leave

Answer

Create a log filter to send all logs

Question 12

An administrator is configuring a FortiGate HA cluster in active-passive mode with two units. Which two conditions must be met for failover to occur? (Choose two.)

Accepted Answer

A monitored interface on the primary unit goes down. Option A is correct because in an active-passive FortiGate HA cluster, failover is triggered when a monitored interface (configured under config system ha with monitor-interface) goes down on the primary unit, causing the cluster to renegotiate and the secondary to take over. Option B is correct because loss of all heartbeat communication (via the HA heartbeat interfaces, using FGCP over UDP/703 or Ethernet frames) causes the secondary to conclude the primary has failed and assume the primary role. Option C is not correct because priority is only evaluated at cluster formation or when a unit rejoins; a higher priority on the secondary does not by itself force a failover of an established cluster. Option D is not correct because CPU usage thresholds are not a native HA failover trigger in FortiOS. Option E is not correct because session synchronization packets are not heartbeats; stopping session sync alone does not trigger failover, only loss of heartbeat or a monitored interface failure does.

Answer

The secondary unit receives a higher priority configuration

Answer

The primary unit's CPU usage exceeds 90%

Answer

The primary unit stops sending session synchronization packets

Question 13

A FortiGate admin needs to create a loopback interface for management purposes. Which two statements about loopback interfaces are correct? (Choose two.)

Accepted Answer

Loopback interfaces are always up and do not depend on physical links. Loopback interfaces are virtual interfaces that are always in an up/up state as long as the FortiGate is operational. They do not depend on any physical link or carrier status, making them ideal for management access and stable routing protocol peering.

Answer

Loopback interfaces cannot be assigned an IP address

Answer

Loopback interfaces are only used for routing protocols

Answer

Loopback interfaces require a physical port to be up

Question 14

A network administrator is configuring a new FortiGate and needs to ensure that all traffic from the internal network to the internet is source NATed to the public IP address on port1. The default route points to port1. Which configuration step is required to achieve this?

Accepted Answer

Enable NAT on the firewall policy from internal to internet. Source NAT (SNAT) on a FortiGate is configured at the firewall policy level, not on the interface or via a static route. By enabling NAT on the firewall policy from the internal network to the internet, the FortiGate automatically translates the source IP of traffic egressing port1 to the interface's primary IP address (the public IP). This is the standard method for implementing source NAT in FortiOS, as defined in the FortiGate Administration Guide.

Answer

Configure a static route to the internet with NAT enabled

Answer

Set the interface port1 to NAT mode in its settings

Answer

Create an IP pool with the public IP and reference it in the policy

Question 15

An administrator is configuring a VLAN interface on a FortiGate. The physical interface is port2 and the VLAN ID is 100. Which of the following correctly creates the VLAN interface?

Accepted Answer

config system interface edit port2.100 set vlanid 100 set type vlan next end. It uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.

Answer

config system interface edit port2 set vlanid 100 next end

Answer

config system interface edit port2.100 set type vlan next end

Answer

config system vlan edit port2.100 set vlanid 100 next end