Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 376–450

Fortinet firmware upgrades must follow a supported upgrade path to avoid configuration incompatibility or system instability. The recommended path from 7.0.5 to 7.2.0 is to first upgrade to the latest 7.0.x release (7.0.6) and then to 7.2.0, as direct jumps across major versions (e.g., 7.0.x to 7.2.0) are not supported and may cause upgrade failures or data loss.

Session synchronization must be enabled and properly configured to replicate sessions to the standby unit.

Captive portal is used to authenticate users before allowing network access. It presents a login page to users who are not yet authenticated.

In NAT/Route mode, the FortiGate operates as a Layer 3 router, forwarding traffic between different subnets while also performing Network Address Translation (NAT) when configured. This is the default operational mode for most FortiGate deployments, enabling both routing and NAT capabilities on the same device.

Option C is correct. Proxy-based inspection buffers the entire file for scanning, which can detect threats more accurately but introduces latency. Flow-based inspection scans packets as they pass through without full buffering.

The correct answers are A and B. Create a blocking profile and apply to a policy for general users, then create a higher priority policy that allows the CEO's traffic without the blocking profile.

To leverage FortiSandbox, the antivirus profile must be configured to send files to FortiSandbox, and the inspection mode must be proxy-based for file submission.

BitTorrent traffic is often encrypted, so without SSL inspection, the FortiGate cannot inspect the payload of the encrypted sessions to identify the application. Application Control relies on deep packet inspection (DPI) to match traffic against application signatures; if SSL inspection is not enabled, the FortiGate only sees encrypted packets and cannot detect BitTorrent, allowing the traffic to pass unchecked.

Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to trust them during deep inspection, preventing certificate errors for users. Disabling deep inspection or using certificate inspection would not inspect payloads.

To use RADIUS, the FortiGate must define the RADIUS server with its IP and secret, and then create a user group that references that RADIUS server.

Option A is correct because the firewall policy must explicitly permit the SSH service (TCP port 22) from the WAN to the internal server. Without a policy allowing the traffic, the FortiGate will drop the packets even if the VIP is configured correctly. The policy acts as the security gatekeeper, and the service object for SSH ensures only port 22 traffic is allowed.

Option A is correct. DLP requires proxy-based inspection to buffer and analyze the content. Flow-based inspection does not support DLP.

Policy routes override the routing table for specific traffic based on criteria like source, destination, or protocol. Option D correctly configures a policy route under 'config router policy' to match destination 10.10.10.0/24 and set the output interface to port3, ensuring that traffic is forwarded out port3 regardless of the default route.

The correct command is 'execute backup config scp <server> <filename>' because SCP (Secure Copy Protocol) is the only option listed that provides encrypted file transfer over SSH, which is required for securely backing up the FortiGate configuration to a remote server. FortiGate uses this CLI command to initiate an SCP session to the specified server and save the configuration file with the given filename.

The FortiGate cannot validate the vendor's certificate because its private CA is not in the FortiGate's trusted root store. By importing that CA certificate into the FortiGate's trusted root CA store, the FortiGate will trust the vendor's certificate chain, allowing full SSL inspection to proceed without errors. This resolves the ERR_CERT_AUTHORITY_INVALID error while maintaining security inspection for the domain.

Overload NAT (Port Address Translation) allows many internal IPs to share one public IP by using unique source ports.

Application control profiles identify applications by signature. After identification, traffic shapers can be applied to limit bandwidth.

Session sync ensures that sessions are shared between cluster units so that any unit can handle traffic for a given session.

FortiToken must be assigned to the user, and the user group must require two-factor authentication. The authentication server (LDAP/RADIUS) handles the first factor, FortiToken the second.

ADVPN (Auto-Discovery VPN) allows spokes to dynamically establish direct tunnels between each other, reducing hub load and latency.

The output shows a TCP session (proto=6) with proto_state=01, which in Fortinet's session table indicates the session is in the SYN-SENT state (TCP state 1). This means the initial SYN has been sent but the SYN-ACK has not yet been received, so the TCP three-way handshake is incomplete. The duration and expire values reflect the session's age and remaining lifetime, not its establishment status.

Option B is correct. 'Pass' action in IPS means the traffic is allowed to pass, but an event is logged.

In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

In flow-based inspection, the IPS sensor rules may require that the protocol decoder be enabled or that the traffic matches the rule's target (client, server, default). The output shows 'target default' which might not match the traffic flow.

To block executable file downloads over HTTP and HTTPS while allowing other content, a Web Filtering profile is required to filter based on URL category or content type, and an Antivirus profile is needed to scan and block files (such as .exe) within the HTTP/HTTPS stream. The Antivirus profile can detect and block executable files by file signature or MIME type, while Web Filtering controls access to download sites or file types. Together, they provide layered defense against malicious executable downloads without affecting other web content.

SSL VPN web mode requires user authentication to grant access. The local database or remote authentication server (LDAP, RADIUS) must be used to authenticate users before they can access the web portal.

Option A is correct. For route-based VPN, traffic must be allowed by the policy that has the VPN interface as the destination interface. If the policy's source and destination are reversed (e.g., source internal, destination internal instead of source internal, destination VPN), traffic will be dropped.

In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.

The correct CLI command to upgrade firmware on a FortiGate is 'execute upgrade tftp'. This command triggers the TFTP-based firmware upgrade process, where the FortiGate acts as a TFTP client to download the firmware image from a TFTP server. The 'execute' keyword is used for operational commands in FortiOS, and 'upgrade' is the specific action for firmware updates, with 'tftp' specifying the transfer protocol.

Policy-based routing (PBR) allows you to override the routing table for specific traffic based on criteria such as source IP, destination, or application. By enabling PBR on the firewall policy for server 10.0.1.100 and specifying port2 as the egress interface, the admin ensures that all traffic from that server exits via port2, while the routing table continues to direct all other traffic via port1. This is the correct approach because PBR operates at the policy level, not the routing table level, giving granular control over traffic path selection.

The LDAP connectivity must be verified before any user authentication can work. The diagnose test command is the quickest way to validate the LDAP server connection.

Web mode only provides access to web-based applications through a portal. To allow non-web traffic like ping or RDP, the VPN type must be changed to tunnel mode, which creates a virtual interface and routes all traffic.

Option A is correct: DNS filter blocks malicious domains based on FortiGuard category or custom lists by inspecting DNS queries and responses.

Main mode uses six messages to negotiate IKE Phase 1, providing identity protection and higher security.

Central SNAT rules are only used when the firewall policy has NAT enabled but no specific IP pool configured. If the policy uses Policy-based NAT (i.e., an IP pool is attached), Central SNAT is bypassed. Also, Central SNAT can be overridden by policy-based NAT.

The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

In FortiGate session table, 'expire=0' means the session has expired (or is being cleaned up). 'proto_state=01' often indicates TCP SYN sent state. Sessions with expire=0 are not fully established or are closing.

Perfect Forward Secrecy (PFS) ensures that if an attacker compromises the private key used during IKE phase1, they cannot derive the session keys used in phase2. By requiring a new Diffie-Hellman exchange for each phase2 rekey, PFS isolates the compromise to only the current session, protecting past and future encrypted traffic. This is a critical security best practice for IPsec VPNs on FortiGate.

Traffic logs record information about every session that matches a firewall policy, including source/destination, ports, bytes, and duration. Security logs record IPS, antivirus, web filtering events. Event logs record system events.

A Virtual IP (VIP) is required to map the public IP (203.0.113.5) to the internal server IP (192.168.1.10) for destination NAT. This allows inbound HTTPS traffic to be translated to the private server. Additionally, a firewall policy from WAN to DMZ must reference the VIP as the destination and allow HTTPS to permit the traffic and apply the NAT translation.

protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

URL filter overrides take precedence over FortiGuard categories only if the URL filter action is set appropriately and the override is applied before the FortiGuard check. Additionally, the order of rules matters: URL filter rules are evaluated before FortiGuard categories, but the action must be 'allow' and the override must be enabled.

DLP scanning requires that the traffic be inspected. If the traffic is encrypted and not decrypted, DLP cannot see the content.

Split tunneling routes only specific subnets through the tunnel and other traffic directly. If the routing table is set to route all traffic (0.0.0.0/0) via the SSL VPN interface, split tunneling is effectively disabled.

FTP uses separate control and data connections. FortiGate's FTP ALG (application layer gateway) or session helper is needed to inspect FTP traffic and handle dynamic data ports. Additionally, for VIP, the policy must allow the appropriate services, and the ALG must be enabled.

In HA, the 'override' setting (or 'set override enable') ensures that when the primary recovers, it will preempt the current primary and become active again. Without override, the cluster uses a non-preemptive mode: once a unit becomes primary, it stays primary even if a higher-priority unit comes back online.

The policy only permits HTTP (TCP/80). HTTPS uses TCP/443, which is not allowed unless a separate service is defined.

A loopback interface is a logical interface that is not tied to any physical port, so it remains operational (up/up) as long as the FortiGate itself is running. This makes it ideal for management access, BGP peering, and other services that require a stable IP address independent of physical link failures.

Option C is correct because the output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.

Safe Search enforces the safe search feature of popular search engines (e.g., Google, Bing) to filter explicit content from search results. It does not block search engines or HTTPS.

The traffic shaping policy must be associated with the firewall policy. If the same traffic shaper is applied to both policies, they will get the same markings. The question implies different markings are desired, so the admin likely used the same shaper.

The service object 'HTTP' is defined as TCP/80, but HTTPS uses TCP/443. The web server is likely expecting HTTPS on TCP/443. The policy should allow TCP/443.

SSL inspection is required to decrypt HTTPS; then antivirus and IPS profiles can inspect the decrypted traffic. The firewall policy must include these profiles.

To monitor CPU and memory usage via SNMP, the FortiGate must first have the SNMP agent enabled and an SNMP community configured. The community string acts as a password for SNMPv1/v2c queries, allowing an NMS to poll the device for OIDs like CPU usage (1.3.6.1.4.1.12356.101.4.1.1) and memory usage (1.3.6.1.4.1.12356.101.4.1.4). Without enabling the agent and defining a community, the FortiGate will not respond to SNMP GET requests.

In a one-to-one IP Pool NAT configuration, the mapping is based on the subnet offset. The internal subnet 10.0.1.0/28 has 16 addresses (10.0.1.0–10.0.1.15), and the external pool 203.0.113.16/28 also has 16 addresses (203.0.113.16–203.0.113.31). The host 10.0.1.5 is the 6th usable IP (offset 5 from the network address), so it maps to the 6th IP in the external pool: 203.0.113.16 + 5 = 203.0.113.21.

Option A is correct because a One-to-One IP Pool maps each internal IP to a unique public IP from the range 203.0.113.1-203.0.113.10, preserving the original source port for each session. This meets the requirement to translate all internal IPs while keeping the source port unchanged for specific applications. The pool size (10 IPs) must be sufficient for the number of concurrent internal hosts.

The FSSO collector agent monitors Active Directory for user logon events (via NetAPI or security event logs) and sends this information to the FortiGate, allowing it to map users to IP addresses.

Configuring an NTP server on a FortiGate synchronizes the system clock with a reliable time source, which is essential for accurate logging, certificate validation, and time-based operations. While time-based firewall policies depend on an accurate clock, NTP itself is the mechanism to achieve that accuracy, not the policy feature itself.

Fortinet requires a sequential upgrade path for major version jumps. FortiOS 6.4.10 can upgrade directly to 7.0.0, and then to 7.0.1, because 7.0.0 is the first release in the 7.0 branch. Upgrading directly from 6.4.10 to 7.0.1 is not supported as it skips the required intermediate version.

The debug flow output includes the policy ID that denied the traffic. The administrator can check the policy details using 'show firewall policy <id>' or check the traffic log for the session to see which policy was matched.

Option C is correct because FortiGate uses the Log & Report section to configure FortiAnalyzer settings, specifically under 'Log Settings' or 'Log Forwarding'. This enables the FortiGate to forward logs to a FortiAnalyzer device for centralized logging and reporting, using the FortiGate-FortiAnalyzer protocol (based on syslog over TCP with Fortinet extensions).

Option B is correct because after the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.

The 'session helper' warnings indicate that the firewall is struggling to allocate NAT sessions for the dynamic IP pool. When the IP pool uses a fixed port range, the number of available source ports per IP is limited, leading to port exhaustion under heavy HTTP/HTTPS traffic. This causes intermittent failures and slow loads as new connections are dropped or queued.

In active-passive HA, one unit is primary (active) and the other is standby (passive).

FSSO requires the FortiGate to have an FSSO agent (or collector agent) that can poll the domain controllers for logon events, and the FortiGate must have LDAP configured to resolve usernames to groups, and the polling must be enabled.

Anomaly detection learns normal traffic patterns and triggers when traffic deviates significantly.

Option A is correct. In active-active HA, session synchronization must be set to 'all' or 'group' to sync sessions; the default may only sync specific sessions. The 'session-sync-id' must match on all units.

FortiGate firmware upgrades must follow a validated upgrade path to avoid configuration incompatibilities or boot failures. Version 6.4.9 to 7.0.1 requires an intermediate upgrade to 7.0.0 first, as direct jumps across major versions or skipping required intermediate releases can corrupt the firmware image or render the device unbootable. Fortinet publishes explicit upgrade paths in the release notes, and ignoring them is the most common cause of failed upgrades.

FortiGuard categories classify websites into groups (e.g., Social Networking, Pornography) so administrators can define actions (allow, block, monitor) for each group in the web filter profile.

These products are part of the Fortinet Security Fabric.