NSE4 System and Network Administration Practice Test 8 — 15 Questions

Question 1

An administrator configures two FortiGate units in an active-passive HA cluster. After a failover, some existing TCP sessions are dropped. What is the most likely reason for this behavior?

Accepted Answer

Session synchronization is not enabled. In an active-passive HA cluster, session synchronization must be explicitly enabled to replicate TCP session state from the primary unit to the backup unit. Without session sync, the backup unit has no knowledge of existing TCP sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The failover time is too slow

Answer

The FortiGate units are running different firmware versions

Answer

The HA cluster is using a virtual MAC address

Question 2

A FortiGate administrator needs to upgrade the firmware from 7.0.5 to 7.2.0. The current firmware is 7.0.5. What is the recommended upgrade path?

Accepted Answer

Upgrade to 7.0.6 first, then to 7.2.0. Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Answer

Upgrade to 7.2.0 directly after downgrading to 7.0.0

Answer

Upgrade to 7.4.0 first, then downgrade to 7.2.0

Answer

Upgrade directly from 7.0.5 to 7.2.0

Question 3

You run 'get system performance status' and see CPU usage at 95% with high context switch rate. The FortiGate is not passing any traffic. What is the most likely cause?

Accepted Answer

A routing loop is causing continuous packet processing. A routing loop causes the FortiGate to continuously process and re-process packets as they are forwarded in a cycle between routers, leading to high CPU usage and context switch rates. The loop prevents traffic from being successfully delivered, resulting in zero traffic passing through the FortiGate. This matches the observed symptoms of 95% CPU usage and high context switching.

Answer

The FortiGate is under a DDoS attack

Answer

The antivirus engine is updating signatures

Answer

The FortiGate is in transparent mode

Question 4

An administrator creates a firewall policy to allow internal users to access the internet. The source interface is 'internal', destination interface is 'wan1', and NAT is enabled. Users complain that they cannot access external resources. The administrator verifies that the default route points to the ISP gateway. What is the most likely missing configuration?

Accepted Answer

The policy action is set to DENY. The most likely missing configuration is that the firewall policy action is set to DENY. Even with correct NAT, routing, and DNS settings, if the policy action is DENY, traffic from the internal interface to the wan1 interface will be dropped. The administrator must ensure the policy action is ACCEPT to permit outbound traffic.

Answer

The DNS server is not configured on the FortiGate

Answer

The FortiGate is in transparent mode

Answer

The session helper for FTP is disabled

Question 5

A FortiGate administrator wants to send logs to a FortiAnalyzer. The FortiAnalyzer IP is 192.168.1.100, and logging is configured under Log & Report. However, no logs are being received. Which command should the administrator use on the FortiGate to verify connectivity to the FortiAnalyzer?

Accepted Answer

diagnose log device status. Option A is correct because the 'diagnose log device status' command specifically checks the connectivity status and last-acknowledged sequence number between the FortiGate and the configured FortiAnalyzer. This command verifies whether the FortiGate can reach the FortiAnalyzer at the logging protocol level (FGFM), which is essential for log transmission, unlike a basic ICMP ping that only tests network-layer reachability.

Answer

execute ping 192.168.1.100

Answer

show full-configuration log fortianalyzer

Answer

get system ha status

Question 6

An organization has two FortiGate units in an HA cluster. They need to perform a firmware upgrade on the primary unit without causing a failover. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a graceful failover, then upgrade the original primary. Option D is correct because in an HA cluster, upgrading the secondary unit first ensures that the primary remains active and can take over if the upgrade fails. After the secondary is upgraded and stable, a graceful failover is performed to make it the new primary, allowing the original primary to be upgraded without causing an unplanned failover or service interruption.

Answer

Upgrade the primary unit first, then the secondary will automatically synchronize

Answer

Upgrade both units simultaneously using the GUI

Answer

Disable HA, upgrade both, then re-enable HA

Question 7

A FortiGate is configured with two equal-cost default routes to different ISPs. The administrator notices that traffic for a specific destination is load-balanced across both links as expected. However, they want all traffic from a specific source IP to use only ISP1, while other traffic remains load-balanced. Which configuration should be applied?

Accepted Answer

Create a policy route with source address set to the specific IP and set the gateway to ISP1. Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

Answer

Increase the administrative distance of the ISP2 default route to 20

Answer

Configure SD-WAN rules to steer the traffic

Answer

Add a static host route for the specific source IP via ISP1

Question 8

After upgrading FortiGate firmware, the administrator notices that the 'config router static' command now shows a new keyword 'distance' instead of 'weight'. The upgrade also changed the ECMP load-balancing behavior. What was the likely change in the ECMP algorithm?

Accepted Answer

The ECMP algorithm changed from source-IP-based to weighted (hash-based). The correct answer is A because the upgrade replaced the 'weight' keyword with 'distance' in static routes, indicating a shift from a weighted ECMP algorithm (where routes with lower weight were preferred) to a hash-based algorithm (using source IP by default). This change aligns with FortiOS moving to a more deterministic ECMP load-balancing method, where the 'distance' parameter now influences route selection but ECMP hashing distributes traffic across equal-cost paths based on packet attributes.

Answer

The ECMP algorithm changed from weighted to source-dest-IP

Answer

The ECMP algorithm is now configurable via 'config system ecmp'

Answer

The ECMP algorithm changed from source-dest-IP to round-robin

Question 9

A FortiGate is configured in transparent mode. Which of the following statements is true?

Accepted Answer

The FortiGate interfaces have IP addresses for management only. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Answer

The FortiGate can have multiple routing tables

Answer

The FortiGate supports VLAN sub-interfaces

Answer

The FortiGate acts as a router and performs NAT

Question 10

A FortiGate administrator needs to allow SNMP monitoring from a management station at 10.10.10.50. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable SNMP agent globally. Option A is correct because the SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.

Answer

Configure an SNMP trap to send alerts to 10.10.10.50

Answer

Enable SNMP on the interface connected to the management station

Answer

Configure a firewall policy allowing SNMP from the management station

Question 11

A FortiGate in NAT/Route mode has multiple internal networks. The administrator wants to configure a loopback interface for management access. Which THREE statements about loopback interfaces are correct? (Choose three.)

Accepted Answer

The loopback interface is always up regardless of physical link status. Option B is correct because a loopback interface is a logical interface that is not tied to any physical link. It remains in an 'up' state as long as the FortiGate is operational, making it ideal for management access that must be available even if physical ports fail.

Answer

The loopback interface must be assigned to a physical port

Answer

The loopback interface cannot be used for firewall policies

Question 12

You are troubleshooting a FortiGate HA cluster that is not failing over correctly. The cluster has two units in active-passive mode. You check the HA status and see both units are in 'standalone' mode. Which THREE configurations could cause this? (Choose three.)

Accepted Answer

The HA group ID is different on each unit. Option B is correct because the HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Answer

The FortiGate is configured in transparent mode

Answer

The firmware versions are different but both are 7.0.x

Question 13

A network administrator configures a new FortiGate as the default gateway for a subnet. The FortiGate has two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to load-balance outbound traffic across both links. Which configuration method will achieve this goal?

Accepted Answer

Configure two static default routes with the same distance and metric. Option D is correct because configuring two static default routes with the same distance and metric enables ECMP (Equal-Cost Multi-Path) routing on FortiGate. This allows the FortiGate to load-balance outbound traffic across both WAN interfaces (port1 and port2) using a per-flow or per-packet algorithm, distributing sessions between the two ISPs.

Answer

Configure a single default gateway and rely on ARP for failover

Answer

Configure a policy route for each subnet directing traffic to a different ISP

Answer

Configure two static default routes with different distances

Question 14

A FortiGate administrator is setting up a new FortiGate in a network that requires the firewall to bridge traffic between two subnets without routing. Which operating mode should the administrator select?

Accepted Answer

Transparent mode. Transparent mode allows the FortiGate to act as a Layer 2 bridge, forwarding traffic between two subnets without performing any routing or NAT. In this mode, the firewall operates like a 'bump in the wire,' inspecting and filtering traffic based on MAC addresses and Layer 2 headers, while the IP addresses of connected devices remain unchanged. This is ideal for scenarios where the FortiGate must be inserted into an existing network without altering the IP topology.

Answer

NAT/Route mode

Answer

HA mode

Answer

VLAN mode

Question 15

An administrator configures an HA cluster of two FortiGates in active-passive mode. The cluster is synchronized, but after a failover, some existing TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization (session-pickup) is disabled. Session synchronization (session-pickup) is required for active-passive HA clusters to replicate TCP session state from the primary FortiGate to the secondary. When disabled, the backup unit has no knowledge of existing sessions after a failover, causing those sessions to be dropped because the new primary cannot match incoming packets to any session table entry.

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in NAT mode

Answer

The cluster is using a virtual MAC address for the HA interface