Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 151–225

ZTNA uses an EMS (Endpoint Management Server) to collect endpoint posture information. The FortiGate queries the EMS for the client's compliance status before granting access.

Option A is correct because the `config system admin` command with `set trusthost` restricts administrative login attempts to only the specified source IP address or subnet. By setting `trusthost 192.168.1.0 255.255.255.0`, the FortiGate will only allow admin access from the 192.168.1.0/24 network, blocking all other sources. This is the foundational step to enforce source-based access control for administrative interfaces.

HA requires at least one heartbeat interface configured on both units. Without it, they cannot communicate.

Option A is correct because web filtering profiles and application control profiles operate independently at different layers of the FortiGate security fabric. Web filtering inspects HTTP/HTTPS traffic against URL categories and ratings, while application control identifies and controls application-level traffic (e.g., Facebook, Skype) using deep packet inspection. They can be applied together in a single security policy to provide layered protection without conflict.

Option D is correct. 'diagnose sys top' provides a real-time top-like view of processes and their CPU/memory usage, helpful for identifying resource hogs.

Option A is correct because when the SSL/SSH profile has 'untrusted-caname' set to 'Fortinet_CA_SSL' (an untrusted CA), the FortiGate cannot re-sign certificates from untrusted servers with a trusted CA. This causes HTTPS websites to fail as the client receives an untrusted certificate warning or connection error. Setting 'untrusted-caname' to a trusted CA certificate ensures that even untrusted server certificates are re-signed with a certificate the client trusts.

Application control relies on inspecting the content of traffic to identify applications. When traffic is encrypted with HTTPS, the firewall cannot inspect the payload without decrypting it first. Therefore, SSL inspection must be configured and applied to the firewall policy to allow the FortiGate to decrypt the traffic and match it against application control signatures.

The correct answer is D, FQDN object. FortiGate FQDN objects resolve domain names to IP addresses dynamically, allowing the firewall to update the destination IP automatically when the server's IP changes. This is ideal for scenarios where the external server uses a fully qualified domain name and its IP address is not static.

In hub-and-spoke, the hub needs Phase 2 selectors that cover the spoke subnets, and the spokes need static routes pointing to the hub for other spoke subnets. Additionally, enabling 'add-route' on the hub can help, but the key is proper Phase 2 configuration.

Option A is correct because the FortiGate GUI provides a dedicated interface under System > Firmware to upload and install firmware images, which is a standard and supported upgrade method. This method allows administrators to select a local or remote firmware file and apply it with minimal disruption when proper procedures are followed.

The IP pool overload mode uses dynamic port allocation, which can break applications needing a consistent port range. The 'Fixed Port Range' option in the IP pool configuration assigns a fixed port range to each session, preserving the original source port or a fixed range. Option A is correct.

The 'connection refused' error indicates that the FortiGate is attempting to establish a TCP connection to the FortiAnalyzer, but the FortiAnalyzer is actively rejecting the connection attempt. This is most commonly caused by a firewall (either on the network path or on the FortiAnalyzer itself) blocking the required ports, such as TCP 514 (syslog) or TCP 443/8443 (FortiGate-FortiAnalyzer protocol). Without proper port access, the TCP handshake fails, resulting in a connection refused message.

When a FortiGate HA cluster fails over, the new primary unit assumes the configuration synchronized from the original primary. However, if a policy route references a specific interface (e.g., port1 or a VLAN subinterface) that is physically present on the failed unit but not on the new primary (or has a different name/index), the policy route will fail because the kernel cannot resolve the egress interface. FortiGate HA synchronizes the configuration, but interface mappings must match across cluster members for policy routes to work after failover.

Application control requires the firewall policy to be set to 'proxy-based inspection' for HTTPS traffic. Even with deep inspection enabled, if the policy is flow-based, application control may not inspect HTTPS traffic correctly.

An FQDN address object resolves the domain name to IP addresses dynamically. This allows the policy to adapt to IP changes, unlike a subnet object.

LDAP is the correct protocol for authenticating against an LDAP server. Local is for local users, RADIUS for RADIUS servers, and FSSO for SSO with Active Directory.

Options A and C are correct. A DNS filter profile must be created with categories, and the firewall policy for DNS traffic must reference that profile.

PBR requires the rule to be enabled, the gateway to be reachable, and the rule's priority to be higher (lower number) than other routes. Also, the PBR must be applied to the correct incoming interface. If the interface is wrong, or the gateway is unreachable, or the rule is disabled, PBR will not work.

The most likely cause is that the FortiGate does not have a route to the FortiAnalyzer. Even with the correct IP and logging enabled, the FortiGate must be able to reach the FortiAnalyzer over the network; without a valid route, the TCP connection (typically on port 514 for syslog or port 443/541 for FortiGate-FortiAnalyzer protocol) will fail, resulting in a 'disconnected' status.

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. Interfaces do not require IP addresses for data forwarding; they only need IP addresses for management access (e.g., HTTPS, SSH, or SNMP). This makes option D correct.

Option C is correct: The session has been active for 3600 seconds and will expire in 3599 seconds (almost fresh start). 'proto_state=01' indicates TCP three-way handshake completion.

Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.

The DN is used to bind to the LDAP server for user authentication and to search for users. It identifies the user object that FortiGate uses to authenticate.

When Phase 1 parameters are identical and the VPN is down, the most common cause is a mismatch in Phase 2 selectors (local and remote subnets). Phase 2 uses these selectors to negotiate the IPsec security associations (SAs); if they do not match exactly on both sides, the IKEv1/v2 Quick Mode or Child SA exchange will fail, leaving the tunnel in a 'down' state even though Phase 1 (IKE SA) may be up.

For deep inspection, the FortiGate's CA certificate must be installed and trusted on client devices. Otherwise, browsers will show a warning that the connection is not private because the certificate is issued by an untrusted authority.

With split tunneling enabled, the FortiGate SSL VPN portal connection succeeds, but the client's routing table does not automatically include routes for the internal network. Without those routes, traffic to internal resources is sent to the default gateway instead of through the VPN tunnel, causing access failure. This is the most likely cause because the user can authenticate and establish the tunnel but cannot reach internal subnets.

proto_state=01 means TCP SYN_SENT state, meaning the three-way handshake is incomplete. The session is still establishing.

If the tunnel is up but no traffic passes, it could be due to routing misconfiguration, such as missing static routes for the remote subnet pointing to the VPN tunnel interface.

FortiGate uses the 'Log Device' or 'FortiAnalyzer' configuration to send logs to an external FortiAnalyzer.

Option B is correct because the output shows a TCP session (proto=6) with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 3600 seconds and will be removed in 3599 seconds if no further traffic is seen. This indicates a long-lived session, typical for persistent connections like HTTPS, where the session timer resets with each packet.

Option B is correct. Fortinet Single Sign-On (FSSO) captures AD login events (via polling or agent) and maps them to users on the FortiGate, enabling transparent authentication for firewall policies.

DLP scanning of HTTPS traffic requires SSL deep inspection to decrypt the traffic. Additionally, the firewall policy must have deep inspection enabled and the DLP profile must be applied. The inspection mode (flow vs proxy) may affect performance but both can work.

Option A is correct. The 'diagnose sniffer packet' command is used to capture packets in real time on FortiGate interfaces.

These are core UTM features of FortiGate.

Phase 1 establishes the secure channel; key parameters include remote gateway, PSK, IKE version, and encryption.

The correct answer is D because the FortiGate uses administrative distance as the primary metric for route selection when multiple static routes exist to the same destination. A lower administrative distance (10) is preferred over a higher one (15), regardless of the order in which the routes were added. Priority (0 in both cases) is a tie-breaker only when distances are equal, so it does not affect this decision.

To achieve this, the admin must configure a central SNAT rule for the subnet with overload, and a separate central SNAT rule (or fixed port range) for the server using fixed port range. Alternatively, the server could have a policy-based NAT with fixed port range, but central SNAT is specified. The question implies using central SNAT for both.

Option D is correct. The session state '01' indicates a TCP session in the SYN_SENT state, meaning the session is still in the process of being established. The short duration and expire time suggest it is a new session.

In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.

In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.

Policy routing allows you to override the routing table for specific traffic based on criteria such as source IP. By creating a policy route that matches the specific source IP and sets the next-hop gateway to ISP1, you ensure that traffic from that source always uses ISP1, while all other traffic continues to be load-balanced across both equal-cost default routes. This is the most direct and flexible method for source-based path selection without altering the global routing behavior.

DPD failures indicate the remote peer is not responding. Common causes: network congestion, a firewall blocking IKE packets, or the remote peer going down.

In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.

PBR uses policy routes that define a source and destination, and a gateway/interface. A policy route is created, and the traffic must be allowed by a firewall policy (maybe using the same criteria).

If the schedule does not match the current time, the firewall policy is not evaluated for that traffic. The FortiGate continues to check subsequent policies. If no other policy matches, the implicit deny rule blocks the traffic.

Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).

When using VIP, the security policy destination should reference the VIP object, not the real server IP. The VIP handles the translation of destination IP and port.

The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

An inter-VDOM link policy (or simply a policy between VDOMs) must be configured, often using a physical or logical inter-VDOM link. Option D correctly identifies the need for an inter-VDOM policy.

The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

The debug shows Phase 1 negotiation failing due to timeout. This typically indicates that the remote peer is not responding. The most common reason is that the remote firewall is not reachable due to a firewall rule blocking UDP 500 or 4500, or the remote peer is not configured.

The IP Pool is configured with type 'Overload' (Port Address Translation), which maps multiple internal hosts to a single public IP by using unique source ports. With a single public IP (203.0.10.10), the maximum number of concurrent sessions is limited by the available source ports (approximately 65,535 per IP, minus reserved ports). Once all source ports are consumed, new outbound sessions cannot be established, causing users to lose access to external websites.

Central SNAT takes precedence over policy-based NAT when both are configured. The Central SNAT rule might be incorrect or missing, causing unexpected behavior.

Option B is correct because SSL deep inspection is required to decrypt HTTPS traffic so the firewall can inspect the content of encrypted uploads for sensitive data like credit card numbers. Without decryption, the DLP profile cannot see the payload of encrypted sessions, rendering the DLP sensor ineffective.

Operation mode, firmware version, and HA password (if set) must match. Priority can differ. Hostname is not required to match.

Policy 2 is applied because it matches the destination IP (10.0.2.10) and the schedule 'Weekdays' is active on Wednesday at 2 PM. FortiGate uses a first-match approach only when multiple policies have the same priority; here, Policy 1 does not match the destination, so Policy 2 is the only matching policy. Since the schedule is valid, the action 'accept' is executed.

In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.

In route-based VPNs, routes determine traffic flow. After a reboot, the hub may lose routes to the remote spoke networks unless they are statically configured or learned via dynamic routing. Option B is correct because static routes are needed on the hub to direct inter-spoke traffic through the appropriate tunnel interfaces.

Option B is correct because FortiGate application control policies are evaluated in order, and the first matching rule is applied. If a higher-priority rule (or an implicit allow rule) permits Zoom traffic before the block rule is reached, Zoom will be allowed. The engineer likely placed the block rule after an allow rule or the default implicit allow policy is permitting Zoom traffic.

Option A is correct because the 'diagnose log device status' command specifically checks the connectivity status and last-acknowledged sequence number between the FortiGate and the configured FortiAnalyzer. This command verifies whether the FortiGate can reach the FortiAnalyzer at the logging protocol level (FGFM), which is essential for log transmission, unlike a basic ICMP ping that only tests network-layer reachability.

Option A is correct because the FortiGate acts as a certificate authority (CA) for SSL inspection. If the FortiGate's CA certificate has expired, any server certificate it generates and signs for intercepted HTTPS sessions will be considered invalid by client browsers. Browsers will display a certificate error because the signing CA (the FortiGate) is no longer trusted due to expiration, even if the client has the CA certificate installed.

Option A is correct because FortiGate's syslog configuration allows you to specify multiple syslog servers in a single 'config log syslogd setting' block by using the 'set server' command with a space-separated list of IP addresses. This enables redundant log delivery without requiring separate configuration blocks or external devices. The FortiGate will attempt to send logs to the first server; if it fails, it automatically fails over to the next server in the list.

Even though the administrator installed the CA certificate on the client, the browser uses its own trusted root store, which is separate from the operating system's certificate store. If the CA certificate is not specifically added to the browser's trusted root store (e.g., Chrome uses the system store but Firefox maintains its own), the browser will still flag the certificate as untrusted. This is a common misconfiguration when deploying SSL inspection with FortiGate.

The most common misconfiguration when LDAP authentication fails is an incorrect bind DN or password. The FortiGate uses the bind DN to authenticate to the LDAP server before it can search for users; if these credentials are wrong, the LDAP server rejects the bind request, resulting in an 'authentication failed' log entry. This error occurs even before user credentials are checked, making it a frequent root cause.

To reduce re-authentication prompts, increase the authentication timeout (Option C) so that users remain authenticated longer, and enable single sign-on (SSO) (Option D) so that once authenticated, they are not prompted again for other services.

The commands 'diagnose vpn ike log-filter' filters IKE logs, and 'diagnose debug application ike -1' enables detailed IKE debug output. These are standard for troubleshooting IPsec VPN issues.

To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

The implicit deny policy is a default, hidden policy at the end of the FortiGate policy list that denies all traffic not explicitly allowed by preceding policies. Since the administrator wants to allow only HTTP traffic from internal to the DMZ web server and deny all other traffic, relying on the implicit deny is the correct and recommended security posture. It automatically blocks everything else without requiring manual configuration, ensuring no unintended traffic is permitted.

When deep-inspection is used, the FortiGate decrypts the client-to-server traffic, inspects the content, and then re-encrypts it before forwarding to the client. If the web server uses a cipher suite that the FortiGate does not support for re-encryption (e.g., an obsolete or non-standard cipher), the FortiGate cannot complete the SSL handshake with the client, causing certificate errors or connection failures. This is the most likely reason because the firewall policy is correct and the CA certificate is valid.

The 'get system status' command is the correct way to display the current FortiGate firmware version. This command outputs a comprehensive summary of the system state, including the firmware version (e.g., FortiOS v7.4.0), the system uptime, serial number, and HA status. It is the standard CLI command for verifying the exact build and patch level of the FortiGate.

The 'diagnose sys session list' output showing many sessions in 'proto_state=01' with a short TTL indicates that sessions are failing to establish properly. When the IP pool used for Source NAT (SNAT) exhausts its address range, new outbound connections cannot obtain a translated source IP, causing them to fail intermittently. This matches the symptom of intermittent failures as the pool becomes temporarily depleted.