NSE4 Timed Practice Test 4 — 10 Questions

Question 1

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Question 2

Drag and drop the steps to configure SSL VPN on FortiGate into the correct order.

Question 3

Match each Fortinet security feature to its primary function.

Question 4

Match each FortiGate routing concept to its definition.

Question 5

Match each FortiGate VPN type to its characteristic.

Question 6

Match each FortiGate CLI command to its function.

Question 7

An administrator runs 'diagnose sniffer packet any "host 10.0.1.100" 4' and sees packets being sent but no response. The FortiGate has a static route for 10.0.1.0/24 via 192.168.1.1. The administrator checks the routing table and sees the route is present. What is the most likely cause of no response?

Accepted Answer

The outgoing interface in the static route is incorrect or down.. Option B is correct because even if the route exists, the outgoing interface might be incorrectly configured. The sniffer shows packets leaving the FortiGate but the destination might not be reachable via that interface. Option A is incorrect because a missing route would show 'no matching route' in debug. Options C and D are less likely given the symptom.

Answer

The FortiGate has a policy route overriding the static route.

Answer

The destination host has a firewall blocking ICMP.

Answer

The static route has a higher administrative distance than a dynamic route.

Question 8

An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. Which two configurations are required? (Choose two.)

Accepted Answer

Configure FortiAnalyzer IP under config system central-management. Option A is correct because the FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.

Answer

Enable log transfer under config log fortianalyzer setting

Answer

Configure a firewall policy to allow logs to leave

Answer

Create a log filter to send all logs

Question 9

A FortiGate administrator configures SNMPv2c on the FortiGate to send traps to a monitoring server. However, no traps are received. The monitoring server can ping the FortiGate. What is the MOST likely cause?

Accepted Answer

The SNMP community string does not match between FortiGate and server.. SNMPv2c uses community strings as a form of authentication. If the community string configured on the FortiGate does not match the one configured on the monitoring server, the server will reject the trap. Since the server can ping the FortiGate, network connectivity is fine, and the issue is most likely an authentication mismatch.

Answer

SNMPv2c is not supported on FortiGate; only v3 is supported.

Answer

The FortiGate's firewall policy blocks SNMP traffic from the monitoring server.

Answer

The monitoring server's IP is not in the SNMP trap receiver list on FortiGate.

Question 10

An administrator creates a firewall policy to allow internal users to access the internet. The source interface is 'internal', destination interface is 'wan1', and NAT is enabled. Users complain that they cannot access external resources. The administrator verifies that the default route points to the ISP gateway. What is the most likely missing configuration?

Accepted Answer

The policy action is set to DENY. The most likely missing configuration is that the firewall policy action is set to DENY. Even with correct NAT, routing, and DNS settings, if the policy action is DENY, traffic from the internal interface to the wan1 interface will be dropped. The administrator must ensure the policy action is ACCEPT to permit outbound traffic.

Answer

The DNS server is not configured on the FortiGate

Answer

The FortiGate is in transparent mode

Answer

The session helper for FTP is disabled