NSE4 System and Network Administration Practice Test 7 — 15 Questions

Question 1

An administrator wants to upgrade the FortiGate firmware from version 6.4.9 to 7.0.1. What is the most important consideration before proceeding?

Accepted Answer

Verify the upgrade path and check for any required intermediate versions. FortiGate firmware upgrades must follow a validated upgrade path to avoid configuration incompatibilities or boot failures. Version 6.4.9 to 7.0.1 requires an intermediate upgrade to 7.0.0 first, as direct jumps across major versions or skipping required intermediate releases can corrupt the firmware image or render the device unbootable. Fortinet publishes explicit upgrade paths in the release notes, and ignoring them is the most common cause of failed upgrades.

Answer

Upgrade to the latest 7.0.x directly without intermediate steps

Answer

Disable all firewall policies before upgrading

Answer

Ensure the configuration is backed up

Question 2

Which FortiGate operating mode is used when the device acts as a Layer 2 bridge without performing NAT?

Accepted Answer

Transparent mode. Transparent mode (Option B) is correct because in this mode the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any NAT or routing. The device is invisible to the network, and all interfaces share the same IP subnet, allowing it to inspect and filter traffic at the application layer while remaining transparent to connected devices.

Answer

HA mode

Answer

VPN mode

Answer

NAT/Route mode

Question 3

An administrator notices that traffic to a particular subnet is being load-balanced across two WAN links, but they want all traffic to that subnet to use a single link. Which feature should be configured?

Accepted Answer

Policy routing. Policy routing (also called PBR) allows you to override the routing table based on criteria such as source/destination IP, protocol, or port. By configuring a policy route that matches traffic to the specific subnet and sets the output interface to a single WAN link, you can force all that traffic to use one link instead of being load-balanced.

Answer

ECMP routing

Answer

Static route with higher distance

Answer

Route summarization

Question 4

A FortiGate administrator needs to allow SSH management access from a specific IP address 10.0.0.100. Which configuration is required?

Accepted Answer

Set the trusted host for the admin account to 10.0.0.100. FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.

Answer

Enable SSH on the WAN interface and allow all IPs

Answer

Configure an access list on the upstream router

Answer

Create a firewall policy allowing SSH from 10.0.0.100 to the FortiGate

Question 5

A FortiGate has two internet connections: port1 (ISP1) and port2 (ISP2). An administrator configures two static default routes with equal distance and priority. Traffic to a specific public IP is observed going out port1, but the admin wants it to go out port2. What should be configured?

Accepted Answer

Configure a policy route to direct the specific destination to port2. Policy routes (also called PBR) override the routing table for specific traffic matches. Since both default routes have equal distance and priority, the FortiGate uses ECMP or the route with the lowest cost by default. A policy route can match the specific destination IP and force the traffic out port2, bypassing the routing table lookup.

Answer

Use ECMP with source-based hashing

Answer

Increase the administrative distance of the default route on port1

Answer

Configure a blackhole route

Question 6

An administrator wants to back up the FortiGate configuration to a remote FTP server. Which command should be used?

Accepted Answer

execute backup config ftp . The `execute backup config ftp` command is the specific FortiGate CLI command designed to back up the configuration file to a remote FTP server. This command directly initiates an FTP transfer of the current system configuration, ensuring the backup is stored externally for disaster recovery.

Answer

execute restore config ftp

Answer

copy running-config startup-config

Answer

execute backup system ftp

Question 7

A FortiGate is configured with two WAN interfaces in an SD-WAN zone. The administrator wants to ensure voice traffic uses the interface with the lowest latency. Which SD-WAN configuration should be used?

Accepted Answer

Configure an SD-WAN rule with a performance SLA that monitors latency and set strategy to 'Best Quality'. SD-WAN rules with a performance SLA allow the FortiGate to monitor real-time latency on each WAN interface and dynamically route voice traffic to the interface with the lowest latency. The 'Best Quality' strategy selects the best-performing interface based on the SLA metrics, ensuring optimal voice quality.

Answer

Set the strategy to 'Manual'

Answer

Set the strategy to 'Load Balance'

Answer

Use policy-based routing with a higher priority for voice traffic

Question 8

Which protocol does FortiGate use to synchronize sessions between HA cluster members?

Accepted Answer

FGCP. FortiGate uses the FortiGate Cluster Protocol (FGCP) to synchronize session tables, configuration, and state information between HA cluster members. FGCP is a proprietary protocol that ensures seamless failover by replicating session data in real time, allowing the backup unit to take over active sessions without interruption.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 9

An administrator is configuring a FortiGate to send logs to a FortiAnalyzer. Which TWO of the following are required? (Choose two.)

Accepted Answer

Ensure network connectivity between FortiGate and FortiAnalyzer. The FortiGate must have IP reachability to the FortiAnalyzer to send logs over the network, typically using TCP port 514 (syslog) or FortiGate's proprietary log forwarding protocol. Without network connectivity, log transmission will fail regardless of configuration.

Answer

Enable local logging on the FortiAnalyzer

Answer

Create a firewall policy on the FortiGate to allow log traffic

Answer

Disable local logging on the FortiGate

Question 10

A FortiGate administrator is planning an upgrade from FortiOS 6.4 to 7.2. Which THREE steps should be performed before the upgrade? (Choose three.)

Accepted Answer

Verify hardware compatibility with the target firmware. Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.

Answer

Remove all firewall policies

Answer

Enable automatic firmware checks

Question 11

An administrator wants to configure HA on two FortiGate units. Which TWO of the following must match on both units for the cluster to form? (Choose two.)

Accepted Answer

HA heartbeat interface configuration. The HA heartbeat interface configuration must match on both FortiGate units because the heartbeat interface is used for cluster communication, synchronization, and failure detection. If the interfaces designated for heartbeat traffic differ between units, they cannot establish the required Layer 2 adjacency or exchange HA control packets, preventing cluster formation.

Answer

License type

Answer

Management IP addresses

Answer

Hostname

Question 12

A FortiGate administrator needs to configure a static route to reach a remote network 192.168.100.0/24 via next-hop 10.0.0.1. Which CLI command should be used?

Accepted Answer

config router static
edit 1
set dst 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
next
end. It uses the proper FortiGate CLI syntax for configuring a static route. The command 'config router static' enters the static route configuration context, and 'set dst' specifies the destination network with a subnet mask (not CIDR notation), while 'set gateway' defines the next-hop IP address. This matches the FortiGate CLI structure for static routes.

Answer

config network route
edit 1
set ip 192.168.100.0 255.255.255.0
set gateway 10.0.0.1
end

Answer

config route static
edit 1
set destination 192.168.100.0/24
set next-hop 10.0.0.1
end

Answer

config router static
edit 1
set dst 192.168.100.0/24
set next-hop 10.0.0.1
end

Question 13

An administrator wants to allow management access to a FortiGate from a specific subnet 10.10.10.0/24 via HTTPS. Which configuration achieves this?

Accepted Answer

config system interface
edit port1
set allowaccess https
set trustedhosts 10.10.10.0 255.255.255.0
end. Management access to a FortiGate interface is controlled via the `config system interface` context, where `set allowaccess https` enables HTTPS management on that interface, and `set trustedhosts` restricts access to the specified subnet 10.10.10.0/24. This configuration ensures only hosts from that subnet can reach the FortiGate's HTTPS management interface on the given port.

Answer

config system global
set admin-sport 443
set allowaccess https 10.10.10.0/24
end

Answer

config router policy
edit 1
set src 10.10.10.0/24
set dst 10.0.0.0/8
set action accept
set protocol https
end

Answer

config system admin
edit admin
set trustedhost 10.10.10.0/24
set allowaccess https
end

Question 14

An administrator configures a FortiGate in transparent mode. Which of the following is correct regarding transparent mode operation?

Accepted Answer

The FortiGate is invisible to end devices and does not modify IP addresses.. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any IP-level modifications. This means it does not perform NAT, and end devices are unaware of its presence, making option D correct.

Answer

The FortiGate performs NAT between its interfaces.

Answer

The FortiGate interfaces can be on different subnets.

Answer

The FortiGate requires a management IP on each interface.

Question 15

Which of the following is the correct way to upgrade the firmware on a FortiGate from the CLI?

Accepted Answer

execute upgrade tftp. The correct CLI command to upgrade firmware on a FortiGate is 'execute upgrade tftp'. This command triggers the TFTP-based firmware upgrade process, where the FortiGate acts as a TFTP client to download the firmware image from a TFTP server. The 'execute' keyword is used for operational commands in FortiOS, and 'upgrade' is the specific action for firmware updates, with 'tftp' specifying the transfer protocol.

Answer

execute update firmware tftp

Answer

config system firmware upgrade tftp

Answer

execute firmware upgrade tftp