NSE4 System and Network Administration Practice Test 9 — 15 Questions

Question 1

An administrator needs to configure a loopback interface on a FortiGate for management purposes. Which of the following is true regarding loopback interfaces?

Accepted Answer

Loopback interfaces are virtual and can be used as source IP for management traffic.. Loopback interfaces are virtual interfaces that are always up and do not depend on the physical link state. They can be assigned an IP address and used as the source IP for management traffic (e.g., SNMP, syslog, NTP, or administrative access), ensuring consistent reachability even if physical interfaces fail. This makes option A correct.

Answer

Loopback interfaces require a physical port to be associated.

Answer

Loopback interfaces cannot be used in firewall policies.

Answer

Loopback interfaces are only available in transparent mode.

Question 2

An administrator wants to configure SNMPv3 on a FortiGate for secure monitoring. Which configuration is required?

Accepted Answer

Create an SNMPv3 user with authentication and privacy protocols.. SNMPv3 requires a user-based security model (USM) with authentication (e.g., SHA) and privacy (e.g., AES) protocols to provide integrity, authentication, and encryption. Without these, SNMPv3 cannot secure monitoring traffic, making option A the mandatory configuration.

Answer

Enable SNMP agent on the WAN interface only.

Answer

Configure an access control list for SNMP.

Answer

Set SNMP community string to 'public' and enable SNMPv1/v2c.

Question 3

A FortiGate administrator needs to backup the configuration to a remote TFTP server. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The 'execute backup config tftp' command is the proper CLI syntax in FortiOS for backing up the current configuration to a remote TFTP server. This command triggers an immediate backup operation, and the filename and TFTP server IP are required parameters to specify the destination.

Answer

copy config tftp

Answer

execute restore config tftp

Answer

backup configuration to tftp <tftp_server_ip>

Question 4

A network administrator has two FortiGate units that need to be configured as an HA cluster. Which TWO of the following are prerequisites for HA formation?

Accepted Answer

Both units must have the same FortiOS firmware version.. FortiGate HA clusters require all members to run the exact same FortiOS firmware version to ensure protocol compatibility and configuration synchronization. Mismatched firmware versions can cause cluster instability, failover failures, or split-brain scenarios, as the HA heartbeat protocol relies on consistent state machine behavior across units.

Answer

Both units must have the same hostname.

Answer

Both units must be in NAT/Route mode.

Answer

The HA priority must be set to 0 on both units.

Question 5

A FortiGate administrator needs to configure a VLAN interface and an aggregate interface. Which THREE statements are correct regarding these interface types?

Accepted Answer

Aggregate interfaces require at least one physical member to be up.. An aggregate interface (LAG) requires at least one physical member port to be administratively and operationally up for the aggregate itself to be considered up. If all member ports are down, the aggregate interface goes down, which is a fundamental behavior of link aggregation groups (LAGs) per IEEE 802.3ad.

Answer

Aggregate interfaces are only supported in NAT/Route mode.

Answer

VLAN interfaces cannot be used in transparent mode.

Question 6

An administrator is troubleshooting why traffic from a specific source IP is not being matched by a policy route. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify the source address object in the policy route matches the traffic's source IP.. The most fundamental step in troubleshooting a policy route mismatch is to verify that the source address object defined in the policy route exactly matches the source IP of the traffic. If the object is misconfigured (e.g., wrong subnet mask, incorrect IP range, or a typo), the traffic will never hit the policy route, regardless of other settings.

Answer

Disable all firewall policies to test routing.

Answer

Change the administrative distance of the default route to 0.

Question 7

An administrator is configuring a new FortiGate and wants to allow management access from the internal network via HTTPS. The internal interface is port2 with IP 192.168.1.1/24. Which CLI command correctly enables HTTPS administrative access on port2?

Accepted Answer

config system interface
 edit port2
 set allowaccess https
 end. The `config system interface` command is the proper context to set the `allowaccess` parameter, which controls the administrative protocols (such as HTTPS) permitted on a specific FortiGate interface. By editing port2 and setting `allowaccess https`, the administrator enables HTTPS management access on that interface, allowing internal users to reach the FortiGate's web GUI via 192.168.1.1.

Answer

config firewall policy
 edit 1
 set allowaccess https
 end

Answer

config system admin
 edit admin
 set https enable
 end

Answer

config system global
 set admin-https enable
 end

Question 8

A FortiGate is deployed in NAT/Route mode. The administrator wants to create a policy that allows internal users to access the internet and also translates their private IP addresses to the public IP of the FortiGate's WAN interface. Which policy configuration is required?

Accepted Answer

Enable NAT on the firewall policy. In NAT/Route mode, enabling NAT on the firewall policy performs source NAT (SNAT) by default, translating the private source IP addresses of internal users to the public IP address of the FortiGate's WAN interface. This is the standard method for allowing internal users to access the internet while hiding their private addresses behind a single public IP.

Answer

Configure a virtual IP (VIP) for the WAN interface

Answer

Set the policy action to ACCEPT and enable SNAT in the policy advanced options

Answer

Add a static route with NAT enabled

Question 9

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in established state and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED state per Fortinet's session state encoding), `duration=3600` seconds (1 hour), and `expire=3599` seconds (nearly full lifetime remaining). This indicates the session is actively established and has been ongoing for one hour, matching the description of an established state session.

Answer

The session is in FIN_WAIT state

Answer

The session is in TIME_WAIT state and will close soon

Answer

The session is in SYN_SENT state waiting for a SYN-ACK

Question 10

A FortiGate administrator needs to configure a policy route to send all traffic destined to 10.10.10.0/24 out through interface port3 instead of the default route. Which configuration steps are necessary?

Accepted Answer

Configure a policy route under 'config router policy' with destination 10.10.10.0/24 and output interface port3. Policy routes override the routing table for specific traffic based on criteria like source, destination, or protocol. Option D correctly configures a policy route under 'config router policy' to match destination 10.10.10.0/24 and set the output interface to port3, ensuring that traffic is forwarded out port3 regardless of the default route.

Answer

Add a firewall policy with source interface any, destination 10.10.10.0/24, and set the egress interface to port3

Answer

Create a static route for 10.10.10.0/24 with a lower distance pointing to port3

Answer

Set the default gateway to port3 and remove the existing default route

Question 11

An administrator is troubleshooting a loss of connectivity between two sites connected via a VPN tunnel. The FortiGate logs show 'Tunnel: phase 1 negotiation failed'. Which two parameters MUST match on both peers for phase 1 to succeed? (Select two. Not all options are used.)

Accepted Answer

Pre-shared key. This is a multi-select question requiring two correct answers. For IKE phase 1 to succeed, both peers must match on the pre-shared key (PSK) for authentication and the IKE version (v1 or v2) for the protocol negotiation. A mismatch in either the PSK or the IKE version results in a 'phase 1 negotiation failed' error. The IPsec proposal is negotiated in phase 2, not phase 1.

Answer

IPsec proposal (encryption and authentication)

Answer

Local ID

Answer

Local and remote IP addresses

Question 12

A FortiGate administrator wants to ensure that all firewall policies are backed up before performing a firmware upgrade. Which backup method preserves the configuration in a format that can be restored to the same or different FortiGate model?

Accepted Answer

Backup the configuration via CLI using 'execute backup config tftp'. 'execute backup config tftp' saves the FortiGate configuration in a plain-text, human-readable format that can be restored to the same or a different FortiGate model. This command backs up only the configuration (not firmware or logs) and is model-agnostic, allowing restoration across different hardware platforms as long as the firmware version is compatible.

Answer

Use 'execute backup full-config tftp'

Answer

Copy the configuration from the system config script

Answer

Save the running config from the GUI Dashboard

Question 13

An administrator needs to forward logs from a FortiGate to a FortiAnalyzer for centralized logging. The FortiAnalyzer IP is 10.10.10.10. Which configuration is required on the FortiGate?

Accepted Answer

config log fortianalyzer setting
 set status enable
 set server 10.10.10.10
 end. The FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Answer

config system central-management
 set type fortianalyzer
 set ip 10.10.10.10
 end

Answer

config log setting
 set fortianalyzer ip 10.10.10.10
 end

Answer

config log syslogd setting
 set server 10.10.10.10
 end

Question 14

An administrator is configuring ECMP (Equal-Cost Multi-Path) on a FortiGate. Which TWO conditions are required for ECMP to load balance traffic across multiple routes?

Accepted Answer

Routes must have the same priority setting. ECMP requires that multiple routes have the same priority (also known as 'distance' in some contexts) to be considered equal-cost. In FortiGate, priority is a metric that determines route preference; only routes with identical priority can be used simultaneously for load balancing. Option C is also correct because administrative distance must be the same for routes to be considered equal; if administrative distances differ, the route with the lower distance is preferred, and ECMP will not apply.

Answer

Routes must use different next-hop IP addresses

Answer

Routes must be static routes only

Answer

Routes must be through different interfaces

Question 15

An administrator is planning a firmware upgrade from FortiOS 6.0 to 7.2. Which THREE steps should be performed before starting the upgrade process?

Accepted Answer

Read the release notes for the target firmware version. Reading the release notes for the target firmware version (FortiOS 7.2) is essential because they document critical upgrade-specific information, such as deprecated features, changed default behaviors, known issues, and hardware compatibility requirements. Skipping this step can lead to unexpected service disruptions or feature loss after the upgrade, as the release notes often include mandatory pre-upgrade actions like disabling certain features or adjusting configurations.

Answer

Remove all static routes to avoid routing issues

Answer

Disable all antivirus and IPS sensors