NSE4 System and Network Administration Practice Test 9 — 15 Questions

Question 1

You run the following CLI command on a FortiGate:
diagnose sys session filter dport 443
diagnose sys session list
And you see the output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that was just established and will expire in about 1 hour. The command `diagnose sys session filter dport 443` filters sessions to destination port 443, and `diagnose sys session list` displays matching sessions. The output shows `proto=6`, which is the protocol number for TCP, and `expire=3599` seconds, indicating the session will expire in about 1 hour (3600 seconds total). The `proto_state=01` corresponds to TCP state ESTABLISHED, meaning the session is active and just established, not closing. Therefore, option C is correct.

Answer

The session is a UDP session to port 443

Answer

The session is in a CLOSE state

Answer

The session has been active for 1 hour and has 1 second remaining before expiry

Question 2

A FortiGate administrator needs to allow remote management of a FortiGate from the internet. Which administrative access protocols should be enabled on the WAN interface? (Choose the best single answer.)

Accepted Answer

HTTPS and SSH. HTTPS (port 443) and SSH (port 22) are the only secure administrative access protocols that provide encrypted communication for remote management over the internet. HTTP and Telnet transmit credentials and data in plaintext, making them unsuitable for WAN-facing interfaces. FortiGate best practices mandate disabling all insecure protocols on external interfaces and enabling only HTTPS and SSH for administrative access.

Answer

Ping and SNMP

Answer

HTTP and Telnet

Answer

FTP and TFTP

Question 3

An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?

Accepted Answer

The policy route's incoming interface is incorrectly configured. Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.

Answer

The static default route has a lower administrative distance than the policy route

Answer

The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM

Answer

The policy route has a lower priority than the static default route

Question 4

A FortiGate administrator is upgrading firmware from version 6.0 to 7.0. The upgrade path requires multiple steps. Which of the following is the recommended method to ensure a successful upgrade?

Accepted Answer

Upgrade to 6.2, then to 6.4, then to 7.0, following the official upgrade path. FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

Answer

Perform a factory reset after upgrading to 7.0

Answer

Use the 'execute upgrade-version' command to automatically determine the path

Answer

Upload and install the 7.0 firmware directly, then restore configuration from backup

Question 5

A FortiGate is configured with an aggregate interface (link aggregation group) consisting of two physical ports. The administrator notices that traffic is not being distributed evenly across the two links. Which configuration setting should be verified to improve load balancing?

Accepted Answer

Verify the load-balancing algorithm for the aggregate interface. The aggregate interface uses a load-balancing algorithm to distribute traffic across member links. If traffic is uneven, the algorithm (e.g., source-destination IP, source-destination MAC, or layer 4 port) may not match the traffic pattern, causing hash polarization. Verifying and adjusting this algorithm is the correct step to improve distribution.

Answer

Check the LACP mode (active vs passive)

Answer

Increase the MTU on the aggregate interface

Answer

Ensure the physical ports are in the same VDOM

Question 6

An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?

Accepted Answer

execute backup config tftp . The correct command is 'execute backup config tftp ' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.

Answer

diagnose debug config-error-log read

Answer

show full-configuration

Answer

execute restore config tftp

Question 7

A FortiGate administrator wants to integrate the FortiGate with a FortiAnalyzer for centralized logging. Which configuration step is required on the FortiGate?

Accepted Answer

Enable 'Send Logs to FortiAnalyzer' under Log Settings and specify the FortiAnalyzer IP. Option C is correct because FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

Answer

Create a firewall policy allowing traffic from FortiAnalyzer to the FortiGate

Answer

Configure a syslog server pointing to the FortiAnalyzer IP

Answer

Configure an SNMP community on the FortiAnalyzer

Question 8

An administrator configures a VLAN interface on a FortiGate's physical port with the IP 192.168.10.1/24. The VLAN ID is 10. The administrator connects a switch port configured as an access port (untagged) in VLAN 10. The devices on the switch cannot ping the FortiGate's VLAN interface. What is the most likely cause?

Accepted Answer

The switch port should be configured as a trunk port allowing VLAN 10. The switch port is configured as an access port, which sends frames untagged. However, the FortiGate's VLAN interface expects to receive 802.1Q-tagged frames because the VLAN is defined as a subinterface on the physical port. For the FortiGate to process traffic for VLAN 10, the switch port must be configured as a trunk (or tagged) port that sends frames with the VLAN 10 tag. An access port strips the tag, so the FortiGate never sees the VLAN 10 traffic.

Answer

The FortiGate's physical port is not set to the same VLAN ID

Answer

The FortiGate's administrative access is not enabled on the VLAN interface

Answer

The FortiGate's VLAN interface is not assigned to any VDOM

Question 9

A FortiGate administrator needs to ensure that all DNS queries from internal clients are forwarded to a specific DNS server for security filtering. Which configuration should be applied?

Accepted Answer

Enable DNS forwarding under Network > DNS and set the system DNS to the desired server. Option C is correct because DNS forwarding on FortiGate allows the device to act as a DNS relay, intercepting DNS queries from internal clients and forwarding them to a specified DNS server for security filtering. This is configured under Network > DNS by setting the system DNS to the desired server, which ensures all DNS traffic is redirected without requiring policy routing or firewall rule changes.

Answer

Use policy routing to redirect DNS traffic to the server

Answer

Create a firewall policy to allow DNS traffic to the external server only

Answer

Configure a DNS database on the FortiGate

Question 10

A FortiGate is configured in an HA cluster with two units. The cluster is working, but the administrator wants to ensure that configuration changes made on the primary unit are automatically synchronized to the secondary unit. Which two conditions must be met? (Choose TWO.)

Accepted Answer

The HA configuration must be properly set with a valid group ID and password. Option A is correct because the HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

Answer

Both units must have the same firmware version and license

Answer

The HA cluster must be configured with a virtual MAC address

Answer

VDOM mode must be enabled on both units

Question 11

A network administrator is configuring SNMP on a FortiGate for monitoring. Which three pieces of information are required to complete the SNMPv2c configuration? (Choose THREE.)

Accepted Answer

SNMP manager IP address (allowed hosts). SNMPv2c uses community-based security, so the SNMP community string (Option D) is required for authentication. The SNMP manager IP address (Option B) is needed to define which hosts are allowed to query the FortiGate. The SNMP interface (Option E) specifies which network interface will listen for and respond to SNMP queries. These three pieces are mandatory for SNMPv2c configuration on a FortiGate.

Answer

SNMPv3 authentication protocol (MD5/SHA)

Answer

SNMP trap receiver IP and community

Question 12

An administrator wants to use FortiManager to manage multiple FortiGates. Which three steps must be performed to establish communication between a FortiGate and FortiManager? (Choose THREE.)

Accepted Answer

Ensure network connectivity between the FortiGate and FortiManager. Option B is correct because FortiManager communicates with managed FortiGates over TCP/541 (FGFM protocol). Without IP-level connectivity between the two devices, the registration and management tunnel cannot be established. This is a prerequisite before any configuration steps can succeed.

Answer

Place the FortiGate in transparent mode

Answer

Configure the FortiGate's management interface with an IP address

Question 13

A network administrator is configuring a FortiGate for the first time and needs to enable administrative access via HTTPS from the internal network. Which configuration step is required?

Accepted Answer

Set the administrative access to HTTPS on the internal interface. Option A is correct because administrative access to a FortiGate interface is controlled per-interface under the interface configuration. By default, HTTPS access is disabled on all interfaces. To enable administrative HTTPS access from the internal network, you must set the administrative access to HTTPS on the specific internal interface. This allows the FortiGate to listen for HTTPS management traffic on that interface's IP address.

Answer

Enable HTTPS on the system global settings

Answer

Create a firewall policy allowing inbound HTTPS from internal to the FortiGate

Answer

Configure a static route for the management subnet

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP connection to port 443 that has been active for 1 hour. Option D is correct because the output shows `proto=6`, which is the protocol number for TCP, and `dport=443` indicates the destination port is HTTPS. The `duration=3600` field means the session has been active for 3600 seconds (1 hour), and `expire=3599` shows the remaining lifetime in seconds. This confirms an active TCP session to port 443 that has been established for one hour.

Answer

The session is blocked by a firewall policy

Answer

The session is a UDP connection to port 443

Answer

The session is experiencing high latency

Question 15

A FortiGate configured in NAT/Route mode is connected to the internet via port1 with an IP 10.0.0.1/24. The internal network uses 192.168.1.0/24. Users can browse the internet but cannot reach a public server at 203.0.113.5. A static default route exists. What is the most likely cause?

Accepted Answer

The firewall policy for outbound traffic does not have NAT enabled. Option C is correct because in NAT/Route mode, outbound traffic from a private IP (192.168.1.0/24) to a public internet destination requires source NAT (masquerading) to translate the private source IP to the interface IP (10.0.0.1). Without NAT enabled on the firewall policy, the FortiGate forwards the packet with the original private source IP, which is not routable on the public internet, so the return traffic cannot reach the internal host. The static default route exists and users can browse other sites, indicating routing is functional, but the specific public server is unreachable due to missing NAT.

Answer

The static default route points to the wrong gateway

Answer

The public server is down

Answer

The DNS server is not configured