NSE4 System and Network Administration Practice Test 8 — 15 Questions

Question 1

A FortiGate has two WAN interfaces (wan1, wan2) configured with ECMP routes to the same destination. The administrator notices that traffic for a single session is being load-balanced across both links, causing performance issues. What should be configured to ensure sessions stick to one link?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based'.. Changing the ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based' ensures that all packets belonging to the same session (identified by source IP or source-destination IP pair) are hashed to the same egress interface. This prevents a single session from being split across multiple WAN links, which can cause out-of-order packets and performance degradation. FortiGate’s ECMP hash algorithm uses the configured method to compute a hash value that deterministically selects the outgoing interface for each flow.

Answer

Set policy routing to use source-based routing.

Answer

Configure SD-WAN rules to enforce per-session stickiness.

Answer

Disable ECMP and use a single default route.

Question 2

An administrator wants to back up the FortiGate configuration to a TFTP server at 10.10.10.10. Which CLI command should be used?

Accepted Answer

execute backup config tftp 10.10.10.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp <server-ip>'. This is because 'execute' is the FortiOS CLI keyword for initiating operational commands, and 'backup config tftp' specifies the action and protocol. The syntax is case-sensitive and must include the 'execute' prefix to be recognized by the FortiGate CLI.

Answer

backup config tftp 10.10.10.10

Answer

copy config tftp 10.10.10.10

Answer

execute save config tftp 10.10.10.10

Question 3

What is the purpose of configuring an NTP server on a FortiGate?

Accepted Answer

To synchronize the FortiGate's system clock with a reliable time source.. Configuring an NTP server on a FortiGate synchronizes the system clock with a reliable time source, which is essential for accurate logging, certificate validation, and time-based operations. While time-based firewall policies depend on an accurate clock, NTP itself is the mechanism to achieve that accuracy, not the policy feature itself.

Answer

To enable time-based firewall policies.

Answer

To allow the FortiGate to act as an NTP server for the network.

Answer

To authenticate with FortiGuard services.

Question 4

An administrator needs to ensure that all traffic from the internal network to the internet goes through a web proxy for content filtering. Which configuration is required on the FortiGate?

Accepted Answer

Configure an explicit web proxy and create a proxy policy.. To enforce web proxy-based content filtering for all internal-to-internet traffic, the FortiGate must be configured with an explicit web proxy (which listens on a specific IP and port, typically 8080) and a corresponding proxy policy that defines the traffic matching criteria and action. This setup ensures that client browsers are configured to send requests to the proxy, and the proxy policy applies content filtering rules.

Answer

Enable the proxy feature and set the web proxy port to 80.

Answer

Enable web proxy in the firewall policy and set action to accept.

Answer

Configure a transparent proxy by using an SSL inspection profile.

Question 5

A FortiGate in HA active-passive cluster is experiencing failover events. The administrator runs 'get system ha status' and sees that the 'sync status' is 'out of sync'. What is the most likely cause?

Accepted Answer

The passive unit has a different firmware version.. In an HA active-passive cluster, the 'sync status' indicates whether configuration and session data are synchronized between the primary and secondary units. When the passive unit has a different firmware version, the FortiGate cannot synchronize its configuration or sessions because the data structures and features may differ between versions, leading to an 'out of sync' status. This is a common prerequisite: both units must run the exact same firmware image for HA synchronization to function.

Answer

The HA mode is set to active-active.

Answer

The session synchronization is disabled.

Answer

The heartbeat interface is down.

Question 6

An administrator is configuring a new FortiGate and wants to ensure it can be managed centrally via FortiManager. Which TWO steps are required?

Accepted Answer

Enable FortiManager on the interface used for management.. FortiGate requires the 'FortiManager' feature to be explicitly enabled on the management interface to allow FortiManager to establish a connection. Option D is correct because the FortiManager IP address must be set under 'config system central-management' to define the central management server. Without these two steps, FortiManager cannot discover or manage the FortiGate.

Answer

Enable HTTPS access on the management interface.

Answer

Configure SNMP community for FortiManager to poll.

Answer

Create a firewall policy allowing FortiManager access from the management subnet.

Question 7

A FortiGate is configured in active-active HA mode. An administrator notices that session failover is not working properly during a failover event. Which THREE configurations should be checked?

Accepted Answer

Ensure the load-balance method is set to 'load-balance' or 'weighted-load-balance'.. In active-active HA mode, the load-balance method must be set to 'load-balance' or 'weighted-load-balance' to ensure that session ownership is properly distributed and that session failover can occur. If the method is set to 'hub' or 'spoke', session synchronization and failover may not function as expected, as these modes are designed for different topologies.

Answer

Increase the session TTL.

Answer

Set the HA mode to 'active-passive'.

Question 8

An administrator wants to integrate FortiGate with FortiAnalyzer for logging. Which TWO steps are necessary?

Accepted Answer

Set the FortiAnalyzer IP under 'config system log-fortianalyzer set status enable set server '.. The command 'config system log-fortianalyzer set status enable set server ' directly configures FortiGate to send logs to a specific FortiAnalyzer server. Option B is correct because enabling logging to FortiAnalyzer under the log settings activates the log forwarding mechanism, which is a necessary step to ensure logs are actually transmitted after the server IP is configured.

Answer

Create a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514.

Answer

Configure SNMP traps to send logs to FortiAnalyzer.

Answer

Install a FortiAnalyzer license on FortiGate.

Question 9

A FortiGate is configured with two WAN interfaces (port1 and port2) connected to different ISPs. The administrator wants to load-balance outbound traffic across both links using equal-cost routes. Which routing configuration should be applied?

Accepted Answer

Configure static routes with equal distance and enable ECMP.. ECMP (Equal-Cost Multi-Path) routing allows a FortiGate to load-balance outbound traffic across multiple interfaces when static routes have the same distance (administrative distance) and destination. By configuring two static routes with equal distance (e.g., 10) to 0.0.0.0/0 via port1 and port2, the FortiGate automatically distributes sessions across both links using a hash-based algorithm (e.g., source-destination IP), achieving the desired load balancing without dynamic routing protocols.

Answer

Configure policy routes to direct traffic based on source IP.

Answer

Enable BGP to dynamically learn routes from both ISPs.

Answer

Configure static routes with different distances (e.g., 10 and 20) to the same destination.

Question 10

An administrator runs the following CLI command on a FortiGate: 'diagnose sys session filter dport 443' and sees output indicating sessions with proto_state=01 and duration=3600. What does this indicate about the sessions?

Accepted Answer

The sessions are TCP connections in SYN state and have a timeout of 3600 seconds.. The command filters sessions on destination port 443. The output field 'proto_state=01' indicates a TCP session in SYN_SENT state (state 1), which is the initial step of a TCP handshake. The 'duration=3600' field shows that the session has been active for 3600 seconds (or represents a time value). Option B correctly identifies the state as TCP SYN and the number 3600 as a time value, making it the most accurate choice. Option A is wrong because UDP does not have a SYN state. Option C is wrong because state 01 is not established (established is state 06). Option D is wrong because ICMP does not use ports.

Answer

The sessions are UDP-based and have been active for 3600 seconds.

Answer

The sessions are TCP connections in established state with a duration of 3600 seconds.

Answer

The sessions are ICMP packets with a TTL of 3600.

Question 11

A FortiGate is operating in transparent mode. The administrator needs to configure a new VLAN interface for segmenting traffic. Which statement about VLAN interfaces in transparent mode is correct?

Accepted Answer

VLAN interfaces can be created on physical interfaces and are layer-2 only, requiring no IP addresses for traffic forwarding.. In transparent mode, FortiGate acts as a layer-2 bridge, forwarding traffic based on MAC addresses. VLAN interfaces can be created on physical interfaces to segment traffic at layer 2, and they do not require IP addresses for forwarding; IP addresses are only needed for management access if desired.

Answer

VLAN interfaces require IP addresses and act as routed interfaces in transparent mode.

Answer

VLAN interfaces can only be created on physical interfaces, and each VLAN requires a separate IP address in the management VDOM.

Answer

VLAN interfaces are not supported in transparent mode; the administrator must switch to NAT/Route mode.

Question 12

An administrator wants to upgrade the FortiOS firmware on a FortiGate. Which step is critical before starting the upgrade process?

Accepted Answer

Back up the configuration file.. Backing up the configuration file is critical before upgrading FortiOS because the upgrade process may fail or corrupt the configuration, and a backup ensures you can restore the FortiGate to its previous operational state. Without a valid backup, a failed upgrade could result in a complete loss of configuration, requiring manual reconfiguration or a factory reset. Fortinet recommends always backing up the configuration before any firmware upgrade to mitigate risks.

Answer

Reboot the FortiGate.

Answer

Clear all sessions.

Answer

Disable all firewall policies.

Question 13

A FortiGate administrator needs to integrate with FortiAnalyzer for centralized logging. After configuring the FortiAnalyzer IP and enabling logging, the FortiGate shows 'connection status: disconnected'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the FortiAnalyzer.. The most likely cause is that the FortiGate does not have a route to the FortiAnalyzer. Even with the correct IP and logging enabled, the FortiGate must be able to reach the FortiAnalyzer over the network; without a valid route, the TCP connection (typically on port 514 for syslog or port 443/541 for FortiGate-FortiAnalyzer protocol) will fail, resulting in a 'disconnected' status.

Answer

The FortiGate is in transparent mode.

Answer

The FortiAnalyzer firmware version is newer than the FortiGate's.

Answer

The administrator forgot to enable HTTPS for log upload.

Question 14

An administrator configures a FortiGate HA cluster with two units in active-passive mode. After setup, the secondary unit shows 'standby' status but traffic is not failing over when the primary is shut down. What is the most likely cause?

Accepted Answer

The primary unit's configuration changes were not synchronized to the secondary.. In an active-passive HA cluster, the secondary unit must have a synchronized copy of the primary's configuration to take over traffic. If configuration synchronization is not enabled or fails, the secondary remains in standby but lacks the necessary policies and settings to handle traffic, so failover does not occur even though HA status appears normal.

Answer

The HA heartbeat interface is not configured on the same subnet.

Answer

The cluster is in active-active mode.

Answer

The session failover feature is disabled.

Question 15

A FortiGate needs to resolve DNS names for outbound traffic. The administrator configures DNS servers under System > DNS. However, internal DNS queries for private domains fail. What additional configuration is required?

Accepted Answer

Create a DNS database entry for the private domain.. When a FortiGate is configured with DNS servers under System > DNS, it can resolve public DNS names for outbound traffic. However, for private domains (e.g., internal.company.local), the FortiGate cannot resolve these because they are not registered in public DNS. Creating a DNS database entry for the private domain allows the FortiGate to act as an authoritative DNS server for that domain, providing local resolution for internal queries.

Answer

Add a static route for DNS traffic.

Answer

Configure a DNS server on the WAN interface.

Answer

Enable DNS proxy on the FortiGate.