Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 976–1000

SD-WAN rules are evaluated in order of priority, meaning the rule with the highest priority (lowest number) is matched first. This sequential evaluation ensures deterministic traffic steering based on the most specific match criteria defined by the administrator.

Application Control requires a security profile and a firewall policy that references it.

Phase 2 parameters must match exactly. If there is a mismatch in encryption, authentication, or PFS settings, Phase 2 will fail. Option A is the most common cause.

The implicit deny rule at the bottom of the firewall policy list cannot be modified to enable logging. To log traffic denied by the implicit deny, you must create an explicit firewall policy with action DENY and logging enabled, placed above the implicit deny rule. This explicit deny policy will match traffic that would otherwise hit the implicit deny, and because it is an explicit policy, logging can be enabled on it.

Route-based VPN uses a virtual IPsec interface, allowing dynamic routing protocols to be used. This simplifies configuration and management of complex topologies, whereas policy-based VPN requires static policies for each subnet pair.

The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Geography-based address objects allow matching traffic based on the source IP's country. Option B is correct.

Options A, B, and C are correct. Checking the spam filter logs, adding the domain to the allowlist, and verifying the FortiGuard reputation can all help resolve false positives.

In FortiGate HA, session synchronization relies on NPU offloaded sessions being re-synced. If the NPU offloading was enabled on the primary, sessions might not be fully synced to the backup. Disabling NPU offloading on the primary ensures all sessions are handled by the CPU and thus properly synced.

Schedule objects define time-based conditions. A recurring schedule can be set for weekdays and specific hours.

VIPs with the same external IP but different ports should work. However, if no policy allows HTTPS traffic to the VIP, it will be dropped. Alternatively, the VIP configuration might be incomplete.

FSSO (Fortinet Single Sign-On) captures AD logon events and maps user IP addresses to user identities, allowing transparent authentication without repeated logins.

The command shows the IKE gateway is up (Phase1 complete) but no Phase2 selectors, meaning Phase2 has not been established or has failed. Option A is correct because mismatched Phase2 parameters (e.g., encryption, hash, or proxy IDs) are the most common cause of Phase2 failure.

Option A is correct because the FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.

The remote gateway IP must be set to 0.0.0.0 to accept connections from any IP address, which is typical for dial-up VPN.

In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.

Option C is correct because the engineer requires a deterministic routing policy where VoIP traffic always uses the MPLS link unless it fails. The 'manual' (or 'prefer') strategy in SD-WAN rules allows you to explicitly set a preferred member (MPLS) and designate the other link (Internet) as a backup, ensuring failover only when the preferred link is unavailable. This matches the requirement of routing all VoIP traffic over MPLS unless it is unavailable, without relying on SLA performance metrics.

Option A is correct because FSSO (Fortinet Single Sign-On) relies on the FortiGate communicating with the domain controller to retrieve user login events via NetAPI or WMI. Without this communication, the FortiGate cannot map user identities to IP addresses, which is essential for FSSO-based authentication in firewall policies.

Option A is correct because SMTP traffic from the internal network to an external mail server requires source NAT (masquerading) to translate private source IPs to the FortiGate's external interface IP. This ensures return traffic is routed back correctly. The default SMTP service uses TCP port 25, and enabling NAT on the policy is the standard configuration for outbound traffic to the internet.

By default, when using NAT (including VIP), FortiGate performs source NAT (SNAT) for the traffic destined to the VIP unless specifically configured otherwise. To preserve the original source IP, the admin must disable NAT on the policy or use a policy with NAT disabled.

Policy-based routing (PBR) in FortiGate allows you to override the default routing table lookup by forwarding traffic based on criteria such as source IP address, destination IP address, protocol, or even application. This is configured under the 'policy route' feature and is evaluated before the routing table, enabling granular control over traffic paths that static or dynamic routes cannot provide.

The correct answer is C because security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.

FortiGate uses the FortiGate Cluster Protocol (FGCP) to synchronize session tables, configuration, and state information between HA cluster members. FGCP is a proprietary protocol that ensures seamless failover by replicating session data in real time, allowing the backup unit to take over active sessions without interruption.