Fortinet NSE 4 Network Security Professional NSE4 (NSE4) — Questions 601–675

The 'diag debug fsso poll' command shows the status of the FSSO collector agent and polling process, helping to identify issues.

FortiGate firmware upgrades must follow a specific path to ensure compatibility of the firmware image, configuration database, and bootloader. Skipping intermediate versions (e.g., 6.2 and 6.4) can cause configuration corruption or boot failure because each major version may change the internal data structures or require a specific bootloader version. The official upgrade path from 6.0 to 7.0 is 6.0 → 6.2 → 6.4 → 7.0, as documented in Fortinet's release notes.

With IKEv1, both Phase 2 proposals must match exactly on both sides. AES128-SHA1 is mismatched if the other side uses a different encryption or authentication algorithm. AES128 is used, not AES256.

SYN_SENT indicates that the FortiGate has sent a SYN but not received a SYN-ACK, suggesting the server is not responding, possibly due to a missing DNAT or VIP configuration for inbound traffic.

Option B is correct because a loopback interface is a logical interface that is not tied to any physical link. It remains in an 'up' state as long as the FortiGate is operational, making it ideal for management access that must be available even if physical ports fail.

Event logs include audit events like authentication successes and failures.

Option A is correct because SD-WAN rules allow you to define application-based routing policies. By creating an SD-WAN rule that matches HTTP traffic and sets WAN1 as the preferred interface, the FortiGate will automatically steer HTTP sessions out through WAN1 while using the default routing table (which points to WAN2) for all other traffic. This leverages the SD-WAN feature's ability to perform per-application load balancing and failover without requiring policy-based routing.

Policy-based NAT uses the 'set nat' command in a firewall policy to enable source NAT, while Central NAT uses a separate NAT policy table.

Option A is correct because excluding trusted source IP addresses from certain signatures prevents the IPS from generating alerts for traffic that is known to be legitimate, directly reducing false positives. This is a common tuning technique in FortiGate IPS where you can create exceptions for specific sources or destinations to avoid unnecessary alerts from benign traffic.

The 'no acceptable proposal' error indicates that the IKE proposal sent by the initiator does not match any proposal configured on the responder. This is a Phase 1 mismatch.

For dial-up VPN with dynamic remote IPs, set the remote gateway to 'Dialup User' and configure an IP pool to assign addresses to clients.

The 'implicit deny' policy on a FortiGate is a built-in, last-resort rule that automatically denies any traffic not matching an explicit firewall policy. It is not visible in the policy list and cannot be moved, modified, or deleted; it is always applied as the final rule to ensure that only explicitly permitted traffic is allowed through the FortiGate.

FSSO relies on polling the domain controllers or using a collector agent to capture user logon events. If the DC polling fails or the collector agent is not working, FortiGate cannot correlate the user, so it prompts for authentication.

For spoke-to-spoke traffic to pass through the hub, the hub must have ARP reply enabled (so it responds for the remote spokes' IPs on its phase1 interface), must add the spoke subnets to its routing table, and must have 'add-route' disabled on the hub's phase1 interfaces to prevent automatic route creation that conflicts with manual routes.

FortiGate supports LDAP for integration with Active Directory. LDAP is the standard protocol for querying AD user information.

An antivirus profile can block files by file extension for both HTTP and HTTPS traffic, but only if SSL deep inspection is enabled for HTTPS. The file pattern filter is part of the antivirus profile.

The HA heartbeat interface configuration must match on both FortiGate units because the heartbeat interface is used for cluster communication, synchronization, and failure detection. If the interfaces designated for heartbeat traffic differ between units, they cannot establish the required Layer 2 adjacency or exchange HA control packets, preventing cluster formation.

Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

The log indicates that the initiator sent an IKE_SA_INIT message, which is part of aggressive mode (IKEv1). Since the responder expects main mode, it rejects the aggressive mode proposal.

The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Safe search enforces the search engine's built-in safe search settings (like Google SafeSearch) by appending parameters to the search URL, ensuring explicit content is filtered.

Options A and C are correct. The FortiGate must be able to communicate with the collector agent, and the collector agent must have access to Active Directory to monitor login events. Additionally, the FortiGate's firewall policies must use user groups based on FSSO authentication.

The 'diagnose ips anomaly list' output shows default anomaly entries. If the sensor were properly applied, the action would be 'block' as configured. The connectivity issues may be unrelated to IPS; the administrator should verify the sensor is attached to the policy.

Option B is correct because a firewall policy must be created to allow SMTP traffic from the internal network (10.0.0.0/8) to the DMZ mail server (172.16.0.10) on TCP port 25. The policy must specify the source, destination, service (SMTP), and action (ACCEPT) to permit the traffic. Without this policy, the traffic would be blocked by default.

Policy routes override the routing table for matching traffic, allowing you to force traffic from 192.168.10.0/24 out port1 while ECMP handles all other traffic. ECMP distributes traffic across multiple equal-cost routes, but a policy route takes precedence over the routing table for specified traffic. This meets the requirement without disrupting ECMP for other traffic.

Option C is correct because even if the IPsec tunnel is established, traffic will not pass unless firewall policies explicitly permit it. In FortiGate, a Phase 2 tunnel being up does not imply that traffic is allowed; you must have a policy that matches the source/destination and enables the action to forward traffic through the tunnel interface.

Option D is correct because the `execute backup config ftp` command is the specific FortiGate CLI command designed to back up the configuration file to a remote FTP server. This command directly initiates an FTP transfer of the current system configuration, ensuring the backup is stored externally for disaster recovery.

Option A is correct because the SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.

Option A is correct because an IP Pool with type Overload allows multiple internal hosts to share a single public IP (203.0.113.10) for source NAT when traffic goes to the internet. This is the standard method for PAT (Port Address Translation) in FortiGate, enabling many-to-one NAT.

If outgoing packets are being sent but no incoming packets, the remote side may have a misconfiguration such as a wrong remote subnet in Phase 2 or a firewall policy blocking return traffic.

To apply traffic shaping, a traffic shaper must be created and then referenced in the firewall policy. Option A is correct.

Option B is correct because the HA group ID must match on all cluster members for them to recognize each other as part of the same cluster. If the group IDs differ, each unit will operate independently in standalone mode, as they cannot form a common HA session.

Option B is correct because ECMP requires that multiple routes have the same priority (also known as 'distance' in some contexts) to be considered equal-cost. In FortiGate, priority is a metric that determines route preference; only routes with identical priority can be used simultaneously for load balancing. Option C is also correct because administrative distance must be the same for routes to be considered equal; if administrative distances differ, the route with the lower distance is preferred, and ECMP will not apply.

DLP sensors inspect traffic content. If the traffic is encrypted (e.g., via TLS), the sensor cannot see the plaintext unless SSL deep inspection is enabled to decrypt the traffic first.

Option C is correct because a Geography address object allows the FortiGate to match traffic based on the source IP's country of origin, using the built-in GeoIP database. This is the only address object type that can restrict access by country without requiring manual IP range updates.

To allow inbound HTTPS and preserve the source IP, you need a VIP to translate destination, a firewall policy allowing the traffic, and no source NAT (or use a policy that does not SNAT). SNAT would hide the original source IP.

Option C is correct because flow-based inspection does not buffer files for decompression, so viruses inside archives may be missed.

SSL deep inspection requires a firewall policy with SSL inspection enabled to intercept and decrypt HTTPS traffic. Without such a policy, the FortiGate cannot apply the CA certificate to re-encrypt traffic for inspection, making deep inspection non-functional.

An IP pool for the specific server, a traffic shaper for HTTP, and firewall policies to apply them. Option B, C, and D are correct.

Option B is correct. 'diagnose debug flow' can trace a packet from a specific source IP and show whether it is allowed or denied by a firewall policy.

Option D is correct because the FortiGate uses the `config log fortianalyzer setting` command to configure direct logging to a FortiAnalyzer. This command enables the log forwarding feature (`set status enable`) and specifies the FortiAnalyzer's IP address (`set server 10.10.10.10`). The other options either use incorrect command paths or are intended for different logging destinations (e.g., syslog or central management).

Option B is correct. The user group must be referenced in the IPsec Phase 1 authentication settings, specifically under 'Peer Options' or 'User Authentication' (depending on FortiOS version). Typically, this is done by setting 'xauthtype' to 'auto' or 'psk' and selecting the user group under 'usrgrp'.

Option A and C are correct: The application control profile must include the BitTorrent signature and be configured to block it. Additionally, if BitTorrent uses random high ports or encryption, SSL deep inspection may be needed to identify the traffic.

Option D is correct because the FortiGate must be configured with the FortiAnalyzer IP address under the `config system log-fortianalyzer` hierarchy to establish the logging destination. Option E is correct because after setting the IP, the `set status enable` command must be issued to activate log forwarding to that FortiAnalyzer; without this, no logs are sent even if the IP is configured.

For two-factor authentication, FortiGate requires a user group with the LDAP server as the primary authentication, and then enabling FortiToken two-factor authentication on that group. This allows the user to first authenticate via LDAP (password) and then provide a FortiToken code.

In an active-passive HA cluster, the secondary unit monitors the primary unit's health via heartbeat messages. When the primary fails and stops sending heartbeats, the secondary unit detects the loss of heartbeat and initiates a failover, transitioning to the active role. This is the default behavior in FortiGate HA, where the secondary unit does not require manual intervention or additional conditions to become active.

The command 'diagnose debug authd fsso list' displays all FSSO users currently known to FortiGate, including their IP addresses and login state. This is the primary command to verify if the user is recognized by FSSO.

Diagnose debug flow traces traffic through the policy lookup. Diagnose sys session filter can show active sessions for that source IP. Sniffer packet captures packets but doesn't directly show policy match.

Route-based VPNs use a virtual tunnel interface (e.g., port1.0) that supports dynamic routing protocols, whereas policy-based VPNs rely on firewall policies with IPSEC action and static selectors.

Common VPN types supported by FortiGate.

Option A is correct. The recommended procedure to upgrade with minimal downtime is to upgrade the secondary unit first, then force a failover to make it primary, and then upgrade the former primary unit.

Web filter safe search enforcement is the correct feature because it directly integrates with search engines (Google, Bing, Yahoo) to force the use of their built-in safe search parameters (e.g., Google's 'safe=active' parameter appended to URLs). This ensures that explicit content is filtered at the source, regardless of the user's browser settings or search engine choice.

FortiToken requires two-factor authentication. On FortiGate, this is configured by enabling 'Two-factor Authentication' under the user group or authentication settings, typically set to 'FortiToken' for token-based OTP.

Firmware upgrade requires uploading the image and confirming; the device reboots automatically.

IP Pool with Overload (PAT) allows many private IPs to be translated to a single public IP using port address translation. This is the most common configuration for internet access.

Policy 1 is an implicit allow-all rule that matches all traffic before policy 2 is evaluated. Since FortiGate processes policies in sequential order from top to bottom, the SSH connection to 203.0.113.10 matches policy 1 first, which permits all services, including SSH. Therefore, the connection succeeds without ever reaching policy 2.

Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.

The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet any "" 4 10' captures on all interfaces for 10 seconds with verbose output.

The duration is 3600 seconds and expire is 3599 seconds, meaning the session has been active for only about 1 second out of a 3600-second lifetime. The session is new.

Option D is correct because policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

In SSL VPN, client certificate authentication can be enabled to require users to present a certificate. The FortiGate validates the certificate against a CA certificate.

Option C is correct because in FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Flow-based inspection is faster using pattern matching and anomaly detection, while proxy-based provides full content reassembly and can detect more sophisticated threats. Both can use SSL inspection.

Web filtering profiles allow administrators to control access to websites based on FortiGuard categories, URL filtering, and DNS filtering.

Schedule objects define time ranges. The admin should create a recurring schedule for weekdays during business hours and apply it to the policy.

In transparent mode, FortiGate acts as a layer-2 bridge, forwarding traffic based on MAC addresses. VLAN interfaces can be created on physical interfaces to segment traffic at layer 2, and they do not require IP addresses for forwarding; IP addresses are only needed for management access if desired.

Captive portal uses form-based authentication where users enter credentials in a web page. It does not use NTLM or machine authentication by default.

Option A is correct. FortiToken requires that two-factor authentication is enabled for the user group. This is typically done by setting the 'two-factor' option to 'fortitoken' in the user group configuration or in the authentication rule.