NSE4 System and Network Administration Practice Question
An administrator needs to back up the full configuration of a FortiGate, including all system settings, policies, and objects. Which CLI command should be used?
⚠ Common exam trap
Watch out — candidates often confuse the 'backup' and 'restore' commands (options B and D) or mistaking a display-only command like 'show full-configuration' for an actual backup operation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
execute backup config tftp <filename> <server>
The correct command is 'execute backup config tftp <filename> <server>' because it explicitly triggers a full configuration backup (including system settings, policies, and objects) to a TFTP server. This is the standard FortiGate CLI command for exporting the entire running configuration to an external TFTP server, ensuring all configuration elements are captured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
diagnose debug config-error-log read
Why it's wrong here
The diagnose debug config-error-log read command outputs only the most recent configuration error messages logged by the FortiGate's configuration system. It does not export the running configuration or any backup data; it is a troubleshooting tool for reviewing why certain config changes failed. Therefore it is not a valid method for backing up the full configuration.
- ✓
execute backup config tftp <filename> <server>
Why this is correct
The execute backup config tftp command saves the complete current configuration to a TFTP server as a plain-text file, which can later be used for restoration. It requires the TFTP server IP address and a filename, and the FortiGate will transfer the full configuration to that location. This is the standard CLI method for a full configuration backup and is the correct command to use in this scenario.
- ✗
show full-configuration
Why it's wrong here
The show full-configuration command prints the entire effective configuration to the terminal or console output. While it can be copied to a text file via terminal emulation capture, it is not a dedicated backup operation and does not create a backup file on an external server. It may also omit some runtime-only settings and is not as reliable as an actual backup command.
- ✗
execute restore config tftp <filename> <server>
Why it's wrong here
The execute restore config tftp command loads a previously saved configuration from a TFTP server into the FortiGate's running and startup configuration. It is the inverse operation of a backup — it writes configuration data into the device rather than extracting it. Using it for a backup would overwrite your current configuration with the file's contents, making it completely unsuitable for the task.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.