Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 751–825

Option A is correct because each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

FQDN address objects allow matching traffic based on fully qualified domain names, which are resolved to IP addresses dynamically.

Rate-based detection monitors the rate of events (e.g., connections per second) and triggers when a threshold is exceeded. Anomaly detection looks for deviations from a baseline, not specifically thresholds.

FSSO collects user login information from Active Directory to dynamically associate IP addresses with usernames, enabling user-aware firewall policies without requiring explicit user authentication on the FortiGate.

Option B is correct because HTTPS uses TLS encryption. Without SSL deep inspection enabled on the policy, FortiGate cannot decrypt and inspect the content of HTTPS traffic. The antivirus profile will only scan unencrypted traffic or traffic where deep inspection has decrypted it first.

Option B is correct because the requirement is to map specific source subnets to different public IP addresses. In FortiGate, this is achieved by creating separate firewall policies for each subnet, each with its own IP pool configured for source NAT. A single Central SNAT rule with one IP pool cannot differentiate between subnets to assign different public IPs.

Web mode provides clientless access only to bookmarked web applications. To access other internal resources, tunnel mode (with a virtual adapter) is required.

Polling issues (A), logon event not sent (B), and stale IP mapping (C) are common causes. Option D is about FortiToken, which is not relevant to FSSO. Option E is for captive portal, not FSSO.

Option A is correct because the 'allowaccess' parameter under 'config system interface' controls which management protocols (ping, https, ssh, snmp, etc.) are permitted on a given interface. By adding 'snmp' to the allowaccess list for wan1, the administrator enables SNMP access on that interface without changing its role or type.

Option B is correct. Load balancing in HA is achieved by enabling 'load-balance-schedule' on the HA interface. This allows distributing new sessions across cluster units while retaining active-passive failover behavior.

When a FortiGate has multiple default routes, it uses the route with the lowest distance (administrative distance) as the primary route. If the gateway for the primary route (203.0.113.1 on port1) is unreachable, the FortiGate will not be able to reach 8.8.8.8, even if a secondary default route exists. The ping fails because the device cannot ARP for the gateway or the next-hop is down, causing the route to be inactive.

In dial-up VPN, the Phase 2 selector on the FortiGate must be set to 0.0.0.0/0 to accept traffic from any remote IP, or the specific remote subnet must match the user's assigned IP pool. If the remote network is set to anything other than 0.0.0.0/0, it may mismatch the client's proposal.

TCP sessions require session synchronization to survive failover. If session sync is not configured or not functioning, sessions are lost.

DLP can inspect traffic content for patterns like credit card numbers and block or log the transmission. Antivirus handles malware, application control identifies apps, and web filter blocks URLs.

NAT/Route mode (option B) is correct because it configures the FortiGate as a Layer 3 device with distinct interfaces in different subnets, enabling it to perform routing (forwarding packets based on routing table entries) and Network Address Translation (NAT) to translate private IP addresses to public IP addresses. This mode is the default and most common operational mode for perimeter firewalls, allowing policy-based routing and NAT rules to be applied between zones.

Option D is correct because automatic IPS signature updates require the FortiGuard service to be enabled and a signature update schedule to be configured. Without a schedule, updates occur only manually; without the service enabled, the FortiGate cannot connect to FortiGuard distribution servers to retrieve new signatures.

Traffic may bypass the IP pool if a higher-priority policy matches first (policy ordering) or if the IP pool is incorrectly configured (e.g., the pool's source filter does not include the internal host).

FortiToken two-factor authentication is enforced by enabling 'fortitoken' in the user group settings. The group must be added to the SSL VPN firewall policy.

The correct command to configure NTP on a FortiGate is `config system ntp`, which enters the NTP configuration context where you can set the NTP server addresses, authentication, and sync interval. This is the top-level command for NTP settings in the FortiOS CLI, as documented in the FortiGate Administration Guide.

Option A is correct because it uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.

Static routes on FortiGate are configured in the router static configuration context, requiring a sequence number, destination, device, and gateway.

Option C is correct because in FortiGate, IPS inspection is applied via a security profile group that includes the IPS profile, which is then attached to a firewall policy. The firewall policy itself does not have a direct 'enable IPS' toggle; instead, IPS profiles are part of the security profiles that must be explicitly assigned to the policy to inspect traffic.

Option A is correct because SQL injection attacks are identified by specific IPS signatures, and adding 'SQL.Injection' to an IPS sensor with the action set to 'block' directly instructs FortiGate to detect and block those attacks. Option E is correct because an IPS sensor must be enabled within a firewall policy to apply its inspection to the traffic passing through that policy, ensuring the profile is active on inbound traffic to the web server.

Policy 1 matches because the source IP 10.0.1.5 falls within the 10.0.0.0/8 range, the destination IP 172.16.0.1 is not explicitly matched by policy 2's destination of 172.16.0.0/12 (since 172.16.0.1 is the network address itself and is included, but policy 2 is a deny and is evaluated before policy 3; however, policy 1 is evaluated first due to its lower ID, and since it matches both source and destination with action accept, the traffic is permitted by policy 1 before reaching policy 2). In FortiGate, policies are evaluated sequentially by ID, and the first match is applied.

FortiGuard category-based filtering (C) is correct because it leverages FortiGuard's cloud-based web rating database to categorize URLs and block access to known malicious sites, such as those hosting malware or phishing. Web rating override (D) is correct because it allows administrators to manually override the FortiGuard rating for specific URLs, enabling them to block a site that may not yet be categorized as malicious by FortiGuard. Both features directly control access to malicious websites based on URL reputation.

FortiGuard Web Filtering provides URL categorization and filtering capabilities.

FTP inspection requires an explicit proxy policy for FTP or enabling FTP inspection in the security profile. The simplest is to create a policy allowing FTP and apply an antivirus profile.

Option A is correct because the 'SSL Exempt Domains' list in the SSL/SSH inspection profile allows you to specify domain names (e.g., *.example.com) that will bypass SSL inspection entirely. When FortiGate matches the SNI field in the ClientHello or the certificate CN/SAN against this list, it skips decryption and passes the traffic through without inspection, reducing overhead for trusted or non-critical domains.

The simplest and most secure approach is to add the HTTPS service to the existing policy, as it is a common web protocol.

To apply traffic shaping, you need a traffic shaper (defining bandwidth limits), an application control profile to identify YouTube traffic, and a firewall policy that applies both the shaper and the profile.

Using a single Phase 2 with 0.0.0.0/0 as local/remote subnet allows the hub to accept all traffic without needing per-spoke Phase 2 selectors. But security-conscious admins often use specific selectors. The question asks for simplification; dynamic routing (BGP) is even better.

The error 'no proposal chosen' indicates that the local and remote IKE peers have no common Phase1 proposal. This can be caused by mismatched encryption, authentication, or Diffie-Hellman group. Lifetime mismatch usually results in a different error.

Option C is correct because ECMP (Equal-Cost Multi-Path) routing allows a FortiGate to load-balance outbound traffic across multiple interfaces when static routes have the same distance (administrative distance) and destination. By configuring two static routes with equal distance (e.g., 10) to 0.0.0.0/0 via port1 and port2, the FortiGate automatically distributes sessions across both links using a hash-based algorithm (e.g., source-destination IP), achieving the desired load balancing without dynamic routing protocols.

Option C is correct because if the FortiGate cannot reach the FortiGuard servers, web filtering will fail open by default, allowing all web traffic. The administrator should verify FortiGuard connectivity.

The correct answer is B because the Application Control profile is configured to allow only 'Business' and 'General-Interest' categories. If the CRM application is not categorized in FortiGuard's Application Control database, or if it falls under a different category (e.g., 'Uncategorized' or 'Unknown'), the FortiGate will block the traffic by default. This explains why some users can access the CRM (if they are using a different path or the application is categorized differently) while others cannot, as the FortiGate enforces the profile based on the application signature match.

Option D is correct because enabling only relevant signatures based on the network environment reduces false positives and unnecessary processing overhead, ensuring that IPS resources are focused on threats that actually apply to the traffic traversing the FortiGate. Option E is correct because flow-based inspection uses a single-pass, pattern-matching engine that offers higher throughput and lower latency compared to proxy-based inspection, making it ideal for high-throughput environments.

Even if authentication succeeds, SSL VPN tunnel mode requires a firewall policy to allow traffic from the SSL VPN interface to internal networks. Without it, traffic is dropped.

Option C is correct because FortiGate HA requires all cluster members to run the same firmware version to ensure configuration compatibility and consistent behavior. Mismatched firmware can lead to synchronization failures or unpredictable failover events, as the HA heartbeat and session synchronization protocols depend on identical code bases.

Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.

The correct answer is A because the upgrade replaced the 'weight' keyword with 'distance' in static routes, indicating a shift from a weighted ECMP algorithm (where routes with lower weight were preferred) to a hash-based algorithm (using source IP by default). This change aligns with FortiOS moving to a more deterministic ECMP load-balancing method, where the 'distance' parameter now influences route selection but ECMP hashing distributes traffic across equal-cost paths based on packet attributes.

The FSSO Collector Agent (or the FortiGate itself with embedded agent) polls AD for logon events.

Option A is correct. Application control requires deep inspection to identify applications in encrypted traffic.

Option B is correct. Application control can identify and block specific applications based on signatures, including social media apps.

Option A is correct because the command 'config system log-fortianalyzer set status enable set server <ip>' directly configures FortiGate to send logs to a specific FortiAnalyzer server. Option B is correct because enabling logging to FortiAnalyzer under the log settings activates the log forwarding mechanism, which is a necessary step to ensure logs are actually transmitted after the server IP is configured.

Option B is correct because SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.

To authenticate users against an LDAP server, the administrator must create an LDAP server object and then create a user group that references that LDAP server. The group membership is typically based on LDAP group membership.

Option B is correct because a deny policy with source 'Guest' VLAN (192.168.100.0/24), destination 'Internal network' (10.0.0.0/8), and service 'ALL' will block all traffic from the Guest VLAN to the internal network. Option C is correct because an explicit accept policy for DNS (UDP 53) to the internal DNS server (10.0.0.10) must be placed before the deny policy, as FortiGate firewall policies are evaluated in order from top to bottom, and the first matching policy determines the action.

Routing methods used in FortiGate.

Option C is correct. The email filter profile is designed to scan email traffic for spam and can apply actions like tag, discard, or quarantine.

Verifying hardware compatibility with the target firmware is essential because FortiGate models have specific hardware limitations (e.g., CPU, RAM, storage) that may not support newer FortiOS versions. For example, older models like the FortiGate 100D cannot upgrade beyond FortiOS 6.0, and attempting to install 7.2 could result in a failed boot or bricked device. This step ensures the hardware meets the minimum requirements for the target firmware.

The firewall policy needs to identify the source (VPN users) and destination (web server). Address objects for the VPN subnet and the web server IP are required.

Web mode provides clientless access via a web browser, supporting HTTP/HTTPS, but does not support native protocols like SMB (port 445). To access SMB shares, users need tunnel mode with a VPN client that can route all traffic.

FSSO polling requires the FortiGate to monitor domain controller logs. If polling is not working, users won't be detected and will be prompted.

Logging to disk requires the disk to be operational; if it's full or faulty, logs may not be written.

Using certificate-based authentication (IKE with certificates) replaces the static PSK with dynamic per-device certificates. This provides stronger authentication and allows revocation of compromised certificates without affecting other clients. PSK is shared, so if compromised, all clients are vulnerable.

Fixed Port Range NAT (also known as NAT with fixed port range) creates a deterministic mapping between an internal host's source IP and port and a specific public IP and port range from the pool. This ensures that the same internal host always receives the same public IP and a dedicated port range (10000-20000 in this case), which is essential for protocols that require consistent source addressing, such as SIP or H.323. The FortiGate does not round-robin, randomly assign, or sequentially assign ports; it uses a hash of the original source IP to select the fixed public IP and port range.

Firewall policies require defining interfaces, source/destination addresses, and services before enabling.

The message indicates the packet was denied by a firewall policy, meaning there is no matching policy or the matching policy has action DENY.

Antivirus can block file types by signature (e.g., exe), and application control can block file transfer applications or protocols. Additionally, web filter can block specific file extensions, but the most straightforward combination is antivirus and file filter within antivirus.

Option A is correct. The exemption list allows certain domains to bypass deep inspection, preserving trust.

The policy explicitly allows HTTPS traffic to 10.0.1.10, but the application control profile 'Block_Social_Media' is applied. This profile blocks Facebook and Twitter, which are web-based applications. If the web server's login page is served over HTTPS and is incorrectly classified by the FortiGate as a social media application (e.g., due to shared CDN or similar traffic patterns), the application control profile will block it, preventing user access despite the firewall policy allowing the service.

Pinging the heartbeat interface IP checks connectivity; enabling debug HA heartbeat provides detailed heartbeat status.

Option D is correct. IKE mode (main vs aggressive) must match between peers. If one side uses main mode and the other aggressive mode, Phase 1 will fail with 'no proposal chosen' because the IKE exchange format differs.

Option A is correct because disabling the SIP ALG on the firewall policy stops the FortiGate from inspecting and modifying SIP traffic at the application layer. This is a common troubleshooting step when the SIP ALG interferes with VoIP traffic, as it can alter SIP headers or signaling in ways that break compatibility with certain VoIP providers or endpoints.

FortiClient is required on the client device to collect endpoint posture information (e.g., antivirus status, OS patches) and enforce ZTNA rules. The FortiGate uses FortiClient telemetry to make access decisions.

Option D is correct because Facebook uses HTTPS. Without SSL deep inspection, FortiGate cannot see the application layer inside the encrypted tunnel, so application control cannot block Facebook.

Option A is correct because the firewall policy must match traffic originating from the internal network (source: internal) destined for the Internet via the WAN interface (destination: port1), and the service must be restricted to HTTP/HTTPS to allow web traffic only. The action ACCEPT permits the traffic. This aligns with the standard stateful inspection flow where source and destination interfaces are defined based on traffic direction.

Policy-based routing (PBR) allows you to override the routing table by applying a route map to match traffic (e.g., source/destination IP, port) and explicitly set the next-hop interface or ISP link. This ensures traffic to the specific web server always exits through the designated ISP, regardless of dynamic route changes or the routing table's default behavior.