NSE4 System and Network Administration Practice Question
A FortiGate administrator is planning an upgrade from FortiOS 6.4 to 7.2. Which THREE steps should be performed before the upgrade? (Choose three.)
⚠ Common exam trap
Many exam-takers think removing firewall policies is necessary to avoid compatibility issues during the upgrade, but FortiOS automatically handles policy migration, and deleting them only adds unnecessary risk and downtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify hardware compatibility with the target firmware
Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify hardware compatibility with the target firmware
Why this is correct
Verify hardware compatibility by consulting Fortinet's Hardware Compatibility Guide before upgrading. Some FortiGate models have limited lifecycle support or hardware constraints such as insufficient memory or CPU architecture that prevent running newer FortiOS versions. Attempting an unsupported upgrade on such platforms can fail during installation or cause a device brick, so confirming model support is the first essential pre-flight check.
- ✓
Check the upgrade path and required intermediate versions
Why this is correct
Check the official Fortinet Firmware Upgrade Path tool to identify required intermediate versions for your current FortiOS build. FortiOS does not allow arbitrary direct jumps between major versions because configuration schema and daemon changes can corrupt policies or system objects if intermediate releases are skipped. Staging through the prescribed intermediate versions ensures a supported transition and minimizes the risk of post-upgrade instability.
- ✓
Back up the current configuration
Why this is correct
Back up the current configuration to a safe location using CLI commands like 'execute backup config tftp' or via the GUI under System > Advanced. This snapshot preserves all firewall policies, dynamic objects, and system settings so you can restore the original state if the upgrade fails or if the new firmware introduces configuration incompatibilities. A backup is your primary rollback mechanism and is completely independent of hardware or upgrade path checks, making it an indispensable safety step.
- ✗
Remove all firewall policies
Why it's wrong here
Removing all firewall policies before an upgrade is not a required or recommended step and would cause unnecessary network disruption. FortiOS upgrades preserve existing configuration, including security policies, when performed through a supported upgrade path, so there is no technical need to delete them. Doing so would require manually recreating every rule after the upgrade, greatly increasing operational risk and creating a security window, but it does nothing to improve upgrade success.
- ✗
Enable automatic firmware checks
Why it's wrong here
Enabling automatic firmware checks is not a prerequisite for a planned upgrade step. The 'automatic check' feature simply polls Fortinet's servers for newer firmware versions and modifies the 'System > FortiGuard' dashboard to display upgrade availability; it performs no verification of hardware support, upgrade path, or configuration readiness. In fact, leaving automatic checks enabled during an upgrade window could cause unexpected firmware downloads or banners, interfering with change management, so it is best left disabled until after the manual upgrade.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.