NSE4 System and Network Administration Practice Test 9 — 15 Questions

Question 1

An admin configures two static routes to the same destination with different distances. The route with distance 10 points to ISP1, and the route with distance 20 points to ISP2. The admin wants to use ISP2 only if ISP1 fails. What is the expected behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traffic will use ISP1 until its route is removed, then use ISP2. When two static routes have different administrative distances, the route with the lower distance (10) is preferred and installed in the routing table. The route with distance 20 remains in the routing table as a backup. If the preferred route (via ISP1) is removed due to a failure, the backup route (via ISP2) is automatically activated. This behavior is fundamental to how FortiGate (and most routers) handle static routes with unequal distances.

Answer

Traffic will load-balance between ISP1 and ISP2

Answer

The route with distance 20 will be ignored entirely

Answer

Both routes will be active simultaneously, and the FortiGate will choose based on source IP

Question 2

A FortiGate is operating in transparent mode. The admin needs to allow HTTP traffic from users to a web server. Which type of firewall policy is required?

Accepted Answer

A layer 2 firewall policy. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Answer

A policy-based NAT rule

Answer

A firewall policy using zone-based security

Answer

A VIP policy to map the web server's public IP

Question 3

A FortiGate is configured in an HA active-passive cluster. The primary unit fails. After the secondary takes over, a policy route configured on the primary is not working. What is the MOST likely reason?

Accepted Answer

The policy route references an interface that does not exist on the new primary. When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Answer

The secondary unit does not support policy routes

Answer

The policy route configuration is not synchronized in HA

Answer

The HA cluster requires a reboot after failover

Question 4

An admin needs to configure a FortiGate to send logs to a FortiAnalyzer. Which TWO steps must be performed? (Choose two.)

Accepted Answer

Configure the FortiAnalyzer IP under config system log-fortianalyzer. The FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

Answer

Set the log aggregation interval

Answer

Configure SNMP trap destinations

Answer

Create a firewall policy to allow traffic to FortiAnalyzer

Question 5

An admin wants to ensure that traffic between two internal subnets (10.0.1.0/24 and 10.0.2.0/24) is inspected by the FortiGate but does not have its source IP translated. Which THREE configuration elements are required? (Choose three.)

Accepted Answer

NAT disabled on that policy. When traffic between two internal subnets does not require source IP translation, NAT must be explicitly disabled on the firewall policy. By default, FortiGate policies may have NAT enabled (especially on outbound interfaces), so disabling NAT ensures the original source IP (10.0.1.x) is preserved when communicating with 10.0.2.x. This is configured by setting the 'set nat enable' option to 'disable' in the policy or unchecking NAT in the GUI.

Answer

A static route for each subnet on the FortiGate

Answer

An IP pool for source NAT

Question 6

An administrator needs to configure a FortiGate to allow remote management via HTTPS from the internet. Which configuration step is required?

Accepted Answer

Enable HTTPS access on the WAN interface and create a firewall policy allowing inbound HTTPS from any to the FortiGate's IP.. Remote HTTPS management of a FortiGate from the internet requires two steps: enabling HTTPS access on the WAN interface (under config system interface) and creating a firewall policy that allows inbound HTTPS traffic (TCP/443) from any source to the FortiGate's own IP address. Without the explicit policy, the traffic is dropped by the implicit deny rule, even if the interface is configured to listen for HTTPS.

Answer

Create a firewall policy from WAN to LAN with HTTPS service and set action to ACCEPT.

Answer

Enable SSH access on the WAN interface instead of HTTPS.

Answer

Configure a port forwarding rule to redirect HTTPS from WAN to the internal management IP.

Question 7

You run the following command on a FortiGate:

```
diagnose sys session filter dport 443
diagnose sys session list
```

The output shows:
```
proto=6 proto_state=01 duration=3600 expire=3599
```

What does this indicate?

Accepted Answer

The session has been established for 3600 seconds and has 3599 seconds remaining before timeout.. The output shows `duration=3600` and `expire=3599`, which indicate the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. The `proto=6` confirms TCP (protocol 6), and `proto_state=01` represents the TCP state for an established connection (ESTABLISHED), not a handshake state.

Answer

The session is using TCP state 01 (SYN_SENT) and is still in the process of establishing.

Answer

The session has been idle for 3600 seconds and will expire in 3599 seconds.

Answer

The session is using UDP protocol and will expire in 3599 seconds.

Question 8

An administrator configures a FortiGate in transparent mode to be deployed between a router and a switch. After installation, traffic passes through but the administrator cannot access the FortiGate's management IP from the management network. What is the MOST likely reason?

Accepted Answer

The management IP is not in the same subnet as the management network.. In transparent mode, the FortiGate acts as a Layer 2 bridge, and its management IP must belong to the same subnet as the management network to be reachable. If the management IP is on a different subnet, the FortiGate will not respond to management traffic because it does not route between subnets in transparent mode; it only forwards traffic at Layer 2.

Answer

Transparent mode does not support management access; only NAT/Route mode does.

Answer

The FortiGate's firewall policy blocks management traffic even in transparent mode.

Answer

The administrator must configure a management VLAN interface to access the FortiGate.

Question 9

A FortiGate administrator needs to upgrade the firmware from FortiOS 6.4 to 7.0. The administrator downloads the upgrade image but when uploading via the GUI, the FortiGate reboots and comes back with the same firmware version. What is the most likely cause?

Accepted Answer

The administrator uploaded the wrong image (e.g., for a different FortiGate model).. Uploading a firmware image intended for a different FortiGate model will cause the upgrade to fail silently. The FortiGate validates the image against its hardware platform; if the image does not match, the device rejects it and reboots with the existing firmware. This is a common issue when administrators accidentally download the image for a different series (e.g., FortiGate 100F vs. 200F).

Answer

The firmware image was corrupted during download.

Answer

The FortiGate does not support firmware upgrade via GUI; CLI must be used.

Answer

The administrator must first upgrade to an intermediate version before 7.0.

Question 10

An administrator wants to ensure that traffic to a specific web server always exits through a particular ISP link, regardless of route changes. Which feature should be configured?

Accepted Answer

Policy-based routing (PBR). Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.

Answer

Equal-cost multi-path (ECMP) routing

Answer

Static route with higher distance

Answer

SD-WAN with load balancing

Question 11

A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?

Accepted Answer

The HA heartbeat interface is not configured or is down.. In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Answer

The passive unit has a different firmware version.

Answer

The HA mode is set to active-active instead of active-passive.

Answer

The administrator must manually trigger a sync from the active unit.

Question 12

A FortiGate administrator configures SNMPv2c on the FortiGate to send traps to a monitoring server. However, no traps are received. The monitoring server can ping the FortiGate. What is the MOST likely cause?

Accepted Answer

The SNMP community string does not match between FortiGate and server.. SNMPv2c uses community strings as a form of authentication. If the community string configured on the FortiGate does not match the one configured on the monitoring server, the server will reject the trap. Since the server can ping the FortiGate, network connectivity is fine, and the issue is most likely an authentication mismatch.

Answer

SNMPv2c is not supported on FortiGate; only v3 is supported.

Answer

The FortiGate's firewall policy blocks SNMP traffic from the monitoring server.

Answer

The monitoring server's IP is not in the SNMP trap receiver list on FortiGate.

Question 13

An administrator configures a FortiGate to use NTP for time synchronization. After configuration, the FortiGate still shows the wrong time. Which command should the administrator run to verify NTP status?

Accepted Answer

diagnose sys ntp status. 'diagnose sys ntp status' is the FortiGate CLI command that provides detailed NTP synchronization status, including whether the FortiGate is synchronized to an NTP server, the stratum level, and the last sync time. This command is specifically designed for troubleshooting NTP issues, unlike the other options which either show configuration or are invalid.

Answer

show system ntp

Answer

execute ntp status

Answer

diagnose sys time status

Question 14

An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)

Accepted Answer

Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).. FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Answer

Enable SNMP on the FortiGate to allow FortiManager to monitor.

Answer

Configure a VPN tunnel between FortiGate and FortiManager.

Answer

Set the FortiGate's operation mode to transparent.

Question 15

An administrator is configuring a loopback interface on a FortiGate for management purposes. Which three statements are true about loopback interfaces? (Choose three.)

Accepted Answer

Multiple loopback interfaces can be created.. FortiGate allows the creation of multiple loopback interfaces (up to 16, depending on the model) for various purposes such as management, routing, or VPN termination. Each loopback interface is a virtual interface that does not depend on any physical port, providing flexibility in network design.

Answer

Loopback interfaces support VLAN tagging.

Answer

A loopback interface requires a physical port to be associated.