Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 526–600

Option D is correct. The 'FortiSandbox Inline Scan' option sends files to FortiSandbox and waits for verdict before allowing or blocking the file.

The hit count of zero indicates the policy is not being matched. Policy order matters; if a policy above this one matches the traffic, this policy will never be used. The administrator should check if a policy above is matching the traffic first.

FortiAnalyzer is the central log management and analysis platform for Fortinet devices. It aggregates logs, generates reports, and provides long-term storage.

Option B is correct because an SSL inspection profile defines how FortiGate handles encrypted traffic, including the inspection mode (e.g., full or certificate-inspection). This profile is a mandatory component for deep inspection, as it specifies whether to decrypt, re-encrypt, or simply examine certificates.

To diagnose SSL VPN connectivity, check the tunnel interface with 'diagnose vpn ssl stat', verify the routing table with 'get router info routing-table', and examine the firewall policies to ensure traffic is allowed. Option A shows VPN stats, Option B shows routing (necessary for tunnel routing), Option D checks policies.

IKEv2 is more robust with built-in NAT traversal and MOBIKE, and reduces latency by using fewer exchanges.

For spoke-to-spoke traffic via hub, the hub needs firewall policies to forward traffic between spokes, static routes for spoke networks, and phase2 selectors covering source/destination pairs (or use a broad selector).

Option C is correct because the trusted host setting under system admin settings restricts administrative access (including SSH) to only the specified source IP or subnet. By setting the trusted host to 10.0.1.0/24 and enabling SSH access, the FortiGate ensures that only SSH connections originating from that management subnet can reach the management interface. This is the standard method for controlling administrative access to the FortiGate's management plane.

Option B is correct. In syslog settings, 'set severity' defines the minimum severity level to send. Setting it to 'error' includes error, critical, alert, and emergency messages.

In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic without routing. To allow HTTP traffic from users to a web server, a Layer 2 firewall policy is required because it filters traffic based on MAC addresses and Layer 2 headers, not IP addresses or routing decisions. This policy type is the only one that works in transparent mode, as it does not involve NAT or routing.

Option B is correct because the `config system interface` command is the proper context to set the `allowaccess` parameter, which controls the administrative protocols (such as HTTPS) permitted on a specific FortiGate interface. By editing port2 and setting `allowaccess https`, the administrator enables HTTPS management access on that interface, allowing internal users to reach the FortiGate's web GUI via 192.168.1.1.

When ECMP is configured with the source-destination IP hash load balancing method, traffic for the same session may be sent over different WAN interfaces if the source or destination IP changes mid-session (e.g., due to NAT or asymmetric routing). This causes packets to arrive out of order or be dropped by stateful inspection, leading to intermittent failures. The FortiGate expects all packets in a session to traverse the same interface for proper state tracking.

Option D is correct. Protocol number 6 is TCP. The session is a TCP session to port 443 (HTTPS).

The most likely cause is that the firewall does not have a route to the 10.0.0.0/8 network. Even though the policy is enabled and correctly positioned, the firewall must have a return route to the source network (10.0.0.0/8) for the web server's response traffic to reach the users. Without this route, the firewall drops the return packets, causing connectivity failure for those specific users.

Option D is correct. Increasing the failover threshold (the number of missed heartbeats before triggering failover) makes the cluster more tolerant to temporary heartbeat loss, reducing false failovers.

Option A is correct because an automation stitch can directly react to local-in policy log events by executing a CLI script that adds the offending source IP to a local banned user list (e.g., via `diagnose user banned-ip add`). This provides automatic, immediate blocking without requiring external devices like FortiAnalyzer, and the 30-minute duration can be set via the ban-time parameter in the script or the local-in policy's block-session-ttl.

If authentication succeeds but traffic fails, likely causes are missing firewall policy or incorrect routing. Check firewall policies for SSL VPN interface and ensure appropriate routes (e.g., enable split tunneling or add static routes).

Troubleshooting follows a logical flow: policy, NAT, routing, packet capture, then logs.

When NAT is enabled on a FortiGate policy, the source IP of internal traffic is translated to the public IP of the FortiGate's WAN interface before the packet is logged. Since logging occurs after NAT processing, the log entries will show the translated (public) IP instead of the original internal source IP. This is the most likely reason the administrator sees logs without the original source IP.

Policy routes in FortiGate are evaluated based on their priority value, where a lower number indicates higher priority. If the policy route has a higher priority value (e.g., 10) than the default route (which is implicitly 0), the default route will be preferred. The administrator must ensure the policy route's priority is lower than the default route's priority to override it.

Option A is correct because a firewall policy must explicitly permit HTTPS traffic (TCP/443) from the internal network to the FortiGate's interface IP to allow GUI access. Option B is correct because HTTPS administrative access must be enabled on the internal interface via the CLI or GUI; without this, the FortiGate will not listen for HTTPS connections on that interface, even if a firewall policy exists.

The FortiGate must have local storage (disk) to store logs locally. It also must have connectivity to FortiCloud servers, and logging to FortiCloud must be enabled. The local disk logging is a separate configuration.

Option A is correct. Web filter override allows users to request access to blocked sites by providing a password. The override must be enabled in the web filter profile and a FortiGate authentication scheme must be set up.

Options B and C are correct. Split tunneling must be enabled to allow direct internet access. Additionally, the routing rules (or destination routes) must specify that only the corporate subnet is routed through the VPN tunnel.

Option B is correct because it uses the proper FortiGate CLI syntax for configuring a static route. The command 'config router static' enters the static route configuration context, and 'set dst' specifies the destination network with a subnet mask (not CIDR notation), while 'set gateway' defines the next-hop IP address. This matches the FortiGate CLI structure for static routes.

Option A is correct. Event logs record system events such as user authentication, admin logins, and configuration changes.

Policy routes (also called PBR) override the routing table for specific traffic matches. Since both default routes have equal distance and priority, the FortiGate uses ECMP or the route with the lowest cost by default. A policy route can match the specific destination IP and force the traffic out port2, bypassing the routing table lookup.

FortiGate supports geography-based address objects that allow or deny traffic based on the source IP's country. These are configured using geography objects.

Option B is correct because FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.

Overload NAT (also known as PAT) allows many internal hosts to share a single public IP by using different source ports.

Transparent mode is the correct answer because in this mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without performing Network Address Translation (NAT) or routing. The device does not have an IP address on its interfaces for forwarding decisions, making it invisible to the network at Layer 3.

Main mode requires the local and remote identifiers to match or be correctly configured. Often the local ID (such as the IP address or FQDN) is mismatched, causing negotiation failure despite other parameters matching.

In IKEv1 aggressive mode, the pre-shared key is transmitted in a hashed form but the identity is sent in clear text during Phase1. This makes it less secure than main mode, which protects the identity.

Option A is correct because FortiGate firewall policies are evaluated sequentially from top to bottom based on their policy ID. Since policy ID 5 (deny for 192.168.0.0/16) appears before policy ID 10 (allow for 192.168.10.0/24), traffic from 192.168.10.0/24 is matched by the broader deny policy first, and the allow policy is never reached. This is a fundamental behavior of FortiGate's policy lookup order.

After authentication, the FortiGate must allow the user's traffic based on the firewall policy. If the policy uses the authenticated user group but the user is not in any group, traffic is blocked. Additionally, the captive portal policy must be separate from the internet access policy.

In transparent mode, the FortiGate forwards SMTP traffic without acting as a proxy unless explicitly configured for SMTP proxy. Email filtering requires proxy-based inspection for SMTP.

Options A and D are correct. Logging of blocked traffic must be enabled in the Web Filter profile (A), and the firewall policy must have logging enabled (D) to capture the logs.

In a route-based VPN, the tunnel interface is part of a zone or has its own security policy. Without a firewall policy allowing traffic from the local subnet to the remote subnet via the tunnel interface, traffic will be dropped.

FortiGate uses first-match logic for firewall policies. The deny-all policy is placed before the allow policy, so all traffic hits the deny policy first and is dropped. The allow policy never gets evaluated.

To support TCP, UDP, and ICMP session failover, the session pickup feature must be enabled. To trigger failover on interface failure, the monitor interface must include port2.

FSSO requires the FortiGate to resolve NetBIOS names to IP addresses. If DNS resolution fails, the FortiGate cannot correlate the user's login event with the IP address.

In active-active HA, traffic is distributed across all cluster units. Session synchronization ensures that if a unit fails, other units have the session information to continue processing without interruption. This maintains transparent failover.

Option C and D are correct. ZTNA rules require a ZTNA gateway (the FortiGate acting as proxy) and a ZTNA application (the internal resource). The rule maps external access to the internal application via the gateway.

Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.

Application control requires that the traffic be visible to the FortiGate. If Skype is allowed to bypass inspection (e.g., because SSL deep inspection is not enabled, or because the application uses a non-standard port not monitored), the rule may not match.

Data Leak Prevention (DLP) is the security profile that inspects outgoing data for sensitive information like credit card numbers, social security numbers, etc., to prevent data leaks.

Option C is correct. 'diagnose sys session list' displays the current session table, showing all active sessions.

Option A checks the SSL VPN session, and option D checks routing for the tunnel interface. Option B is for IPsec, option C is for DNS, and option E is for general routing but not specific to SSL VPN.

Option B is correct. Proxy-based inspection buffers the file and can hold the connection until FortiSandbox returns a verdict. Flow-based does not support this hold-and-wait mechanism.

Options B, C, and E are correct. An email filter profile for spam detection (B), a firewall policy that applies the email filter to SMTP traffic (C), and FortiGuard spam filtering enabled (E) are all required.

Option A is correct because FortiGate HA clusters require all members to run the exact same FortiOS firmware version to ensure protocol compatibility and configuration synchronization. Mismatched firmware versions can cause cluster instability, failover failures, or split-brain scenarios, as the HA heartbeat protocol relies on consistent state machine behavior across units.

Possible causes: The policy may not have the IP Pool selected in the NAT settings; the policy order might be incorrect if another policy matches first; the IP Pool might be assigned to the wrong interface or contain a different IP range; or the traffic might be matching a different policy that doesn't use NAT. Central SNAT rules could also override, but the question specifies policy-based NAT.

Option A is correct because FortiGate allows the creation of multiple loopback interfaces (up to 16, depending on the model) for various purposes such as management, routing, or VPN termination. Each loopback interface is a virtual interface that does not depend on any physical port, providing flexibility in network design.

To isolate traffic issues, check firewall policies that apply to the tunnel interface and verify Phase 2 selectors match the traffic. The routing table is also relevant but diagnostics focus on VPN specifics.

Aggressive mode allows the initiator to send its identity and proposed parameters in the first packet, which is needed when the responder does not know the initiator's IP address (e.g., dial-up VPN). Main mode requires the responder to know the initiator IP beforehand.

Option C is correct because the first step in troubleshooting a non-functional IPS sensor is to verify that the IPS engine is running and that the IPS signatures are up to date. If the engine is stopped or signatures are outdated, the sensor cannot detect known malicious traffic regardless of other configurations. This foundational check ensures the detection mechanism itself is operational before investigating policy or mode settings.

To avoid certificate warnings, the FortiGate's CA certificate must be trusted by all clients. Deploying the CA certificate via Group Policy ensures that all domain-joined machines trust certificates signed by the FortiGate.

The most likely cause is that the web filter profile applied in the same firewall policy is configured to block financial websites. Even though the SSL inspection profile exempts financial sites from deep inspection, the web filter profile operates independently and can block traffic based on URL category. Since the web filter is evaluated after SSL inspection, it will block the decrypted or even non-decrypted traffic to financial sites if the category is set to block, overriding the SSL inspection exemption.

The 'execute backup config' command is the correct method to back up the full FortiGate configuration, including all settings and objects, to a TFTP or FTP server. This command exports the entire running configuration in a text format that can be restored later. It is the standard CLI command for a complete configuration backup.

The implicit deny policy is a built-in policy at the end of the policy list that denies all traffic not matching any explicit policy. It cannot be removed or modified.

The correct command to back up a FortiGate configuration to a TFTP server is 'execute backup config tftp <filename> <server-ip>'. This is a standard FortiOS CLI command that uses TFTP (Trivial File Transfer Protocol) to transfer the configuration file to the specified server at 10.0.0.10. Option B matches this syntax exactly.

When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.

FortiGate's Web Filtering feature uses URL rating and category databases (e.g., FortiGuard) to block access to entire categories like 'Social Media' or 'Gambling' based on the destination URL. This is distinct from content inspection; it operates at the HTTP/HTTPS request level by matching the requested URL against predefined or custom category lists.

ZTNA requires ZTNA rules (to control access) and ZTNA tags (client posture assessment). The ZTNA gateway is part of the FortiGate, but the question asks for components. ZTNA tags are used to verify client compliance before granting access.

Split tunneling with specific routes ensures only traffic destined for internal applications goes through the VPN, and all other traffic goes directly to the internet.

Option A is correct because adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation. This ensures that applications using non-standard ports are not affected by the overload behavior of the IP pool, which could otherwise cause port conflicts or session failures. The policy-based NAT (central SNAT) processes policies sequentially, so a higher-priority match with NAT disabled overrides any subsequent NAT rules.

When a website is categorized as 'Unrated' in FortiGate web filtering, it means FortiGuard's web filtering database has not yet assigned a category to that URL. This commonly occurs for newly registered or recently launched websites that have not been crawled and classified by FortiGuard's rating infrastructure. The correct answer is B because the 'Unrated' status directly indicates the site is new and not yet categorized.