Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 226–300

A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

Application control uses application signatures to identify traffic. If the signatures are not up to date, new versions of BitTorrent may not be recognized. Also, if the traffic is encrypted and uses non-standard ports, application control may not detect it if the signatures are not comprehensive.

Option A is correct because the HA group ID and password are essential for the cluster to identify and authenticate members. Without a matching group ID and password, the secondary unit will not accept configuration synchronization from the primary, as these parameters ensure that only authorized units participate in the cluster and receive configuration updates.

SSL VPN web mode allows users to access web-based internal resources through a web portal without any client installation. Tunnel mode requires installation of FortiClient.

When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

The 'no acceptable proposal' error in Phase 1 indicates that the local and remote peers cannot agree on a set of parameters. The encryption algorithm and Diffie-Hellman group are common mismatched parameters.

The session state '01' indicates TCP SYN_SENT, meaning the session is still in the handshake phase. The duration is 3600 seconds, which is unusually long for a TCP handshake, suggesting the session is stuck or the server is not responding.

Option B is correct. Safe search enforces content filtering on supported search engines like Google, Bing, and YouTube to block explicit results.

Option A is correct because a newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

When deep SSL inspection is enabled, the FortiGate acts as a man-in-the-middle by decrypting HTTPS traffic using a local CA certificate. For clients to trust the decrypted connections, the FortiGate's CA certificate must be installed in the Trusted Root Certification Authorities store on each client machine. If it is missing, the browser will display a certificate trust error and may block the site, causing the reported loading failures.

Session synchronization (session sync) replicates active sessions to the standby unit so that sessions survive a failover.

Transparent mode (Option B) is correct because in this mode the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing any NAT or routing. The device is invisible to the network, and all interfaces share the same IP subnet, allowing it to inspect and filter traffic at the application layer while remaining transparent to connected devices.

Using a separate firewall policy with a different web filter profile allows granular control for specific user groups. URL filter exemption would apply to all users using that profile, not just the specific group.

The 'no matching policy' message indicates that the traffic did not match any firewall policy, likely because there is no policy allowing the traffic from that source to the destination.

Captive portal requires that the firewall policy has authentication enabled or the captive portal feature enabled under the policy's security features. A common issue is that the policy does not have 'Enable Captive Portal' checked.

The 'diagnose sniffer packet' command is used to capture packets in FortiGate CLI.

Option D is correct because 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

IKEv2 requires a valid proposal match for Phase 2. If the Phase 2 parameters (encryption, authentication, etc.) do not match between the peer and the FortiGate, Phase 2 fails. Also, with IKEv2, the tunnel mode and proxy IDs must be correctly configured.

SSL VPN requires user group, portal, settings, firewall policy, and enabling the service.

In FortiGate firewall policies, the first matching policy is applied to traffic. The Deny-All policy is placed above the Allow-HTTP policy, so traffic from 10.0.0.0/8 to the internet on HTTP matches the Deny-All policy first and is denied before reaching the Allow-HTTP policy. This is a classic policy ordering issue.

In proxy-based inspection, the FortiGate acts as a proxy for the protocol. If SMTP inspection is not enabled in the proxy options, the traffic bypasses scanning.

Option C is correct because to allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.

The session is a TCP (proto=6) session, state 01 means TCP SYN sent, duration 3600 seconds indicates it has been up for 1 hour, expire 3599 means it will expire in about 3599 seconds (almost 1 hour from now). Option C is correct.

Option C is correct. In HA, the management interface IP must be configured on the HA interface or as a dedicated management interface. Setting 'set management-ip' on the HA interface ensures the management IP is always on the active unit.

Application Control is the correct feature because it is specifically designed to identify and block peer-to-peer (P2P) file-sharing applications by inspecting traffic patterns and signatures, regardless of the port or protocol used. Unlike port-based blocking, Application Control uses deep packet inspection (DPI) to recognize P2P protocols such as BitTorrent, eDonkey, and Gnutella, even when they attempt to evade detection by using non-standard ports or encryption.

Option C is correct because FortiGate integrates natively with FortiAnalyzer via the 'Send Logs to FortiAnalyzer' setting under Log Settings. This uses FortiGate's proprietary logging protocol (not syslog) to securely forward logs to the FortiAnalyzer IP, enabling centralized log management and analysis without additional firewall policies for inbound traffic.

When an IPS sensor with a 'block' action logs 'pass' for matching traffic, it indicates that another security profile is overriding the IPS action. In FortiOS, if an application control profile is set to 'allow' for the application, it can bypass the IPS block because application control processing occurs before IPS inspection. The traffic is permitted by the application control profile, so the IPS engine does not enforce the block action, resulting in a 'pass' log entry.

ZTNA requires a ZTNA rule (policy) that defines access criteria and a proxy policy that intercepts and forwards traffic to the internal application.

FortiGate severity levels: Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notification=5, Information=6, Debug=7.

To block by FQDN, you create an address object with the FQDN, then use it in a firewall policy with action DENY.

Dial-up VPNs typically use x.509 certificates for device authentication, but for individual user identity, user-based authentication (like LDAP or RADIUS) is common. However, the question asks for a method that provides individual identities; using a pre-shared key per user is impractical. Certificate authentication is scalable and provides strong identity.

A loopback interface on a FortiGate is a virtual interface that is always up, independent of physical link states. It provides a stable and reachable IP address for management access (e.g., HTTPS, SSH) and for routing protocols like OSPF or BGP to use as the router ID or source interface, ensuring consistent connectivity even if physical interfaces fail.

FortiGate evaluates policies from top to bottom. The new policy must be placed above the broader policy to be matched first. By default, new policies are added at the bottom.

Option D is correct. The admin should verify that DNS traffic (port 53) is matching the firewall policy with the DNS filter applied. If DNS queries bypass the policy (e.g., they are allowed by a different policy), the DNS filter will not be applied.

Option C is correct because the `config system ntp` command enters the NTP configuration context in FortiOS, where you can specify NTP servers, authentication, and synchronization settings. This is the standard CLI path for configuring NTP on FortiGate devices, as opposed to other commands that only display status or set the date manually.

The LDAP server must be configured with the correct bind credentials and search filter to retrieve group memberships. The 'cn' or 'member' attribute mapping is also critical.

Split tunneling allows internet-bound traffic to bypass the VPN. If users cannot reach the internet, it could be because the split tunneling exclusion list includes internet destinations, or the DNS resolution is not working. However, the most common cause is that the firewall policy for internet traffic is missing or blocking.

By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.

In active-active HA, asymmetric routing can cause session state issues because each unit may see only one direction of traffic. Without session synchronization and strict session pickup, the unit receiving the response may not have the session and drops it.

The principle of least privilege dictates blocking all first (implicit deny is last, so explicit deny needed) then allowing only required traffic. Option A does that.

When using IP pool with overload (PAT), the FortiGate will perform port translation. The source port in the session list is the translated port (the port number after NAT). The original source port (from the internal host) is not shown in the session list; the output shows the post-NAT source port.

Option C is correct because FortiGate requires the 'FortiManager' feature to be explicitly enabled on the management interface to allow FortiManager to establish a connection. Option D is correct because the FortiManager IP address must be set under 'config system central-management' to define the central management server. Without these two steps, FortiManager cannot discover or manage the FortiGate.

Setting Phase 2 selectors to 0.0.0.0/0 allows the hub to accept any subnet from the spokes, simplifying configuration when spokes have different subnets. However, traffic between spokes must route through the hub.

Option A is correct because creating a service group allows you to combine two separate service objects (one for UDP 5060 and one for UDP 10000-20000) into a single logical group, which can then be applied in one firewall policy. This is the most efficient method as it avoids duplicating policies or using an overly broad port range, and it leverages FortiGate's service group feature for clean, manageable rule sets.

A realm allows splitting the SSL VPN portal into multiple virtual portals, each with different authentication settings, landing pages, and access rights. This is useful when serving different user groups (e.g., employees vs. partners) on the same FortiGate.

Option C is correct because the phase2 configuration in an IPsec VPN must explicitly define the local and remote subnets (proxy IDs) that the tunnel is meant to protect. Without these subnets, the IPsec security associations (SAs) cannot be established for the actual traffic, even if the tunnel status shows as up (phase1 is complete). The tunnel status only indicates that IKE phase1 negotiation succeeded, but without phase2 proxy IDs, no traffic will be encrypted or routed through the tunnel, causing connectivity failures.

The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

A dial-up server must have a Phase 1 configuration that allows multiple peers (mode-cfg or aggressive mode) and a Phase 2 that uses 0.0.0.0/0 or dynamic selectors. Additionally, an IP pool is often used to assign addresses.

Logs are sent to FortiAnalyzer by configuring the Log Settings > Log Forwarding or the Log & Report > Log Setting to send logs to FortiAnalyzer.

In FortiGate, when both Central SNAT and policy-based NAT (configured within a firewall policy) are present, Central SNAT takes precedence. This is because Central SNAT is evaluated before policy-based NAT in the NAT processing order, and once a match is found in Central SNAT, the system applies it and does not proceed to policy-based NAT. The specific server's traffic (10.0.1.100) would still be subject to the Central SNAT rule unless a more specific Central SNAT rule is created for that IP.

Option A is correct because if the interface is down or has a link issue, the FortiGate cannot send or receive any traffic, resulting in no sessions being created even if the policy allows traffic. Verifying interface status and link state is a fundamental first step in troubleshooting connectivity issues, as it ensures the physical or logical layer is operational before checking higher-layer configurations.

The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table corresponds to the TCP state `SYN_SENT` (the session has sent a SYN and is awaiting a SYN-ACK). The `duration=3600` and `expire=3599` indicate the session has been alive for 3600 seconds and will expire in 3599 seconds, but the state itself is not established or closing. Option A is correct because `proto_state=01` specifically maps to the TCP SYN_SENT state in FortiOS session diagnostics.

In an HA active-passive cluster, the 'sync status' indicates whether configuration and session data are synchronized between the primary and secondary units. When the passive unit has a different firmware version, the FortiGate cannot synchronize its configuration or sessions because the data structures and features may differ between versions, leading to an 'out of sync' status. This is a common prerequisite: both units must run the exact same firmware image for HA synchronization to function.

Option D is correct. 'execute log fortianalyzer test' sends a test log to FortiAnalyzer to verify connectivity and configuration.

Option C is correct because FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

The issue could be due to policy order, category not being blocked for that specific user, or SSL inspection exemptions.

Option B is correct: Flow-based inspection uses less resources and may not perform full file reassembly or unpacking that proxy-based does, allowing some viruses to evade detection.

Split tunneling allows the remote client to route only traffic destined for the corporate network through the VPN tunnel, while Internet-bound traffic goes directly to the Internet. This reduces bandwidth load on the VPN and improves performance.

By default, FortiGate does not allow hairpin NAT (internal users accessing the VIP from inside). A policy with source NAT and the VIP as destination is required, and often NAT needs to be disabled on that policy to avoid double NAT. The common solution is to add a policy from internal to internal (or use NAT with source translation) but the core issue is that traffic from internal to VIP is not handled without a specific policy.

An aggregate interface (also known as a Link Aggregation Group or LAG) combines multiple physical interfaces into a single logical link, increasing bandwidth and providing redundancy. This is the correct choice because it directly supports the administrator's goal of aggregating port1 and port2 on a FortiGate, using the IEEE 802.3ad standard (LACP) or static aggregation.

ZTNA tags are used to identify devices and users based on compliance and trust level, allowing dynamic access control policies beyond traditional IP addresses.

A geography object is specifically designed to match traffic based on geographic location (country, continent, or region) using the GeoIP database integrated into FortiOS. When a firewall policy needs to allow or deny traffic to or from a specific country like France, a geography object is the correct address object type because it dynamically resolves IP ranges assigned to that country by IANA/RIRs.

Option B is correct because FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.

Tunnel mode creates a virtual interface on the client that provides full network access, similar to an IPsec VPN. Web mode only provides access to specific web applications through a browser portal.

ERR_AUTH_FAIL indicates authentication failure despite correct credentials. The group membership is likely the issue; the user may not be a member of the required group, or the group filter is misconfigured.

To block HTTP (port 80) while allowing HTTPS (port 443), no SSL inspection is needed because the firewall can distinguish traffic by port number alone. SSL inspection is only required when you need to examine the encrypted payload of HTTPS traffic, not to permit or deny it based on the protocol. Therefore, 'No inspection' is correct for this access control requirement.

Option C is correct. Anomaly signatures are dynamic; they only appear in the anomaly list when traffic triggers them. Empty output means no thresholds have been exceeded.

UDP is stateless and not synchronized by default in active-passive HA unless session synchronization is configured. TCP sessions are synchronized by default.