NSE4 System and Network Administration — Timed 10 Questions

Question 1

A company wants to ensure that administrative access to FortiGate is only allowed from the internal trusted network (192.168.1.0/24) and that all other access attempts are blocked. Which CLI command should the administrator configure first?

Accepted Answer

config system admin; edit admin; set trusthost 192.168.1.0 255.255.255.0; end. Option A is correct because the `config system admin` command with `set trusthost` restricts administrative login attempts to only the specified source IP address or subnet. By setting `trusthost 192.168.1.0 255.255.255.0`, the FortiGate will only allow admin access from the 192.168.1.0/24 network, blocking all other sources. This is the foundational step to enforce source-based access control for administrative interfaces.

Answer

config system interface; edit port1; set allowaccess ping https ssh; end

Answer

config system global; set admin-http-redirect enable; end

Answer

set admin-sport 443

Question 2

A FortiGate administrator is troubleshooting a high CPU usage issue. The 'get system performance status' command shows that the CPU usage is consistently above 80% with no traffic. Which of the following is the most likely cause?

Accepted Answer

A process such as the IPS engine is stuck in an infinite loop.. When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.

Answer

An interface is in error-disable state causing CPU interrupts.

Answer

The firewall policy is misconfigured, causing packet drops.

Answer

A DDoS attack is overwhelming the CPU.

Question 3

An administrator needs to back up the FortiGate configuration to a TFTP server at 10.0.0.10. Which command should be used?

Accepted Answer

execute backup config tftp mybackup.conf 10.0.0.10. The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp

'. This is a standard FortiOS CLI command that uses TFTP (Trivial File Transfer Protocol) to transfer the configuration file to the specified server at 10.0.0.10. Option B matches this syntax exactly.

Answer

tftp -p -l mybackup.conf 10.0.0.10

Answer

execute backup config ftp mybackup.conf 10.0.0.10

Answer

copy config tftp://10.0.0.10/mybackup.conf

Question 4

Refer to the exhibit. An administrator wants to enable SNMP access on the wan1 interface. Which of the following is the most efficient method?

Accepted Answer

Execute 'config system interface' and edit wan1, then set allowaccess ping https ssh snmp.. Option A is correct because the 'allowaccess' parameter under 'config system interface' controls which management protocols (ping, https, ssh, snmp, etc.) are permitted on a given interface. By adding 'snmp' to the allowaccess list for wan1, the administrator enables SNMP access on that interface without changing its role or type.

Answer

Change the interface type to 'management' to allow SNMP.

Answer

Execute 'config system interface' and edit wan1, then set snmp-index 1.

Answer

Configure an SNMP community under 'config system snmp community'.

Question 5

Which TWO of the following are valid methods to upgrade the FortiGate firmware? (Choose two.)

Accepted Answer

Use the GUI under System > Firmware.. Option A is correct because the FortiGate GUI provides a dedicated interface under System > Firmware to upload and install firmware images, which is a standard and supported upgrade method. This method allows administrators to select a local or remote firmware file and apply it with minimal disruption when proper procedures are followed.

Answer

Use the command 'execute backup config tftp'.

Answer

Use the command 'execute reboot'.

Answer

Use the command 'execute restore config tftp'.

Question 6

An administrator is troubleshooting a FortiGate that is not passing traffic. The policy allows traffic, but the session table shows no sessions. Which THREE steps should the administrator take to diagnose the issue? (Choose three.)

Accepted Answer

Verify the interface status and link state.. Option A is correct because if the interface is down or has a link issue, the FortiGate cannot send or receive any traffic, resulting in no sessions being created even if the policy allows traffic. Verifying interface status and link state is a fundamental first step in troubleshooting connectivity issues, as it ensures the physical or logical layer is operational before checking higher-layer configurations.

Answer

Run 'diagnose npu np6 show' to check offloading.

Answer

Disable the firewall policy and check if traffic flows.

Question 7

A FortiGate is configured with two ISPs (WAN1 and WAN2) and uses SD-WAN for load balancing. The administrator notices that traffic to a critical SaaS application is being sent over the slower link. What should the administrator do to ensure this traffic uses the faster link?

Accepted Answer

Create an SD-WAN rule to match the SaaS application's destination and set preferred member to the faster link.. Option A is correct because SD-WAN rules allow you to define traffic steering policies based on application or destination, and setting a preferred member explicitly directs matching traffic to the faster link. This overrides the default load-balancing algorithm, ensuring critical SaaS traffic uses the optimal path without affecting other traffic.

Answer

Remove the slower link from the SD-WAN interface.

Answer

Increase the bandwidth on the slower link.

Answer

Configure policy-based routing for the SaaS application.

Question 8

What is the default administrative account on a FortiGate?

Accepted Answer

admin. The default administrative account on a FortiGate is 'admin'. This account is created automatically during the initial boot process and has full super-admin privileges, allowing complete access to the device's configuration and management interfaces. It is the only default account with administrative rights, and its password must be set during initial setup.

Answer

master

Answer

root

Answer

guest

Question 9

An administrator needs to configure a FortiGate to send logs to two different syslog servers for redundancy. Which configuration method should be used?

Accepted Answer

Under 'config log syslogd setting', set 'status enable' and then add multiple servers using 'set server '.. Option A is correct because FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Answer

Configure two separate log settings for each server.

Answer

Configure one syslog server and use a load balancer.

Answer

Use a FortiAnalyzer to forward logs to syslog servers.

Question 10

Refer to the exhibit. The administrator notices that traffic from internal to wan1 is being logged, but the logs do not show the original source IP. What is the most likely reason?

Accepted Answer

NAT is enabled, so the source IP is replaced with the public IP.. When NAT is enabled on a FortiGate policy, the source IP of internal traffic is translated to the public IP of the FortiGate's WAN interface before the packet is logged. Since logging occurs after NAT processing, the log entries will show the translated (public) IP instead of the original internal source IP. This is the most likely reason the administrator sees logs without the original source IP.

Answer

The schedule is set to 'always', causing no time-based logging.

Answer

Logging is set to 'all' but only 'utma' events are logged.

Answer

The policy action is 'accept' without authentication.