NSE4 System and Network Administration Practice Question
An administrator needs to back up the FortiGate configuration to a remote server using SCP. Which command is correct?
⚠ Common exam trap
Many exam-takers confuse 'scp' with 'ftp' or 'tftp' because they all transfer files, but only SCP provides encryption, which is the key requirement for a secure remote backup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
execute backup config scp <server> <filename>
The correct command is 'execute backup config scp <server> <filename>' because SCP (Secure Copy Protocol) is the only option listed that provides encrypted file transfer over SSH, which is required for securely backing up the FortiGate configuration to a remote server. FortiGate uses this CLI command to initiate an SCP session to the specified server and save the configuration file with the given filename.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
execute backup config copy <server> <filename>
Why it's wrong here
The command 'execute backup config copy <server> <filename>' is not a valid FortiGate CLI command. FortiOS offers subcommands such as scp, ftp, tftp, and usb under 'execute backup config', but 'copy' is not one of the supported options. Attempting to use it will result in a syntax error and the configuration will not be backed up. The word 'copy' might be familiar from other systems, but it has no meaning in this FortiOS context.
- ✓
execute backup config scp <server> <filename>
Why this is correct
The command 'execute backup config scp <server> <filename>' is the correct, secure method to back up a FortiGate configuration. SCP (Secure Copy Protocol) runs over SSH, encrypting the entire transfer session, which protects the configuration file and any server credentials from interception. Because the configuration contains sensitive data such as VPN preshared keys, passwords, and certificates, using SCP is strongly recommended, especially when backing up over an untrusted network. The <server> parameter can include a username in user@host format for SSH authentication.
- ✗
execute backup config tftp <server> <filename>
Why it's wrong here
The command 'execute backup config tftp <server> <filename>' is syntactically valid on FortiGate, but TFTP (Trivial File Transfer Protocol) transmits all data in plaintext with no authentication or encryption. An attacker on the network could capture the configuration file, which often holds confidential settings like hashed passwords and network addresses. TFTP is also a simple UDP-based protocol with no flow control or security, making it unreliable for large files and entirely unsuitable for secure backups. Therefore, this command is wrong when a secure backup method is required.
- ✗
execute backup config ftp <server> <filename>
Why it's wrong here
The command 'execute backup config ftp <server> <filename>' is a valid FortiGate command, but FTP (File Transfer Protocol) is inherently insecure because both the control channel and the data channel are sent in cleartext. In addition to exposing the configuration file itself, FTP login credentials (username and password) can be sniffed easily. Unlike SCP, which leverages SSH encryption, FTP provides no confidentiality or integrity protection. While FTP does have authentication, unlike TFTP, it lacks encryption, making this option incorrect for secure backup operations.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.