FortiGate SNMP Configuration for Read-Only Monitoring
An administrator wants to configure SNMP on a FortiGate to allow a monitoring server 192.168.1.100 to poll read-only information. Which set of commands is correct?
Quick Answer
The correct answer is the configuration under `config system snmp community` with `set query enable`, `set query-port 161`, and `set hosts 192.168.1.100`. This is correct because read-only SNMP monitoring on a FortiGate is achieved by enabling SNMP queries within a community, which allows the monitoring server to send GET requests for read-only data without needing to configure traps or global SNMP settings. On the Fortinet NSE 4 exam, this question tests your understanding of the specific hierarchy for SNMP read-only access, often tripping candidates who mistakenly enable SNMP globally under `config system snmp sysinfo` or who forget to restrict the host. A common trap is confusing the `set query enable` command with trap configuration, but remember: queries are for polling, traps are for alerts. For a quick memory tip, think “QUERY for QUERYing data” — if you need read-only polling, you enable queries, not traps.
⚠ Common exam trap
Test-takers frequently confuse the `config system snmp sysinfo` context (for system contact/location) with the community configuration context, or mistakenly think SNMP is enabled globally via a simple `set enable` command, when in fact the community must be explicitly created and enabled with `set query enable`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
config system snmp community edit 1 set name public set query enable set query-port 161 set hosts 192.168.1.100 end
SNMP read-only polling on FortiGate is configured under the `config system snmp community` hierarchy. The `set query enable` command allows SNMP GET requests, `set query-port 161` specifies the standard SNMP port, and `set hosts 192.168.1.100` restricts polling to that specific monitoring server. This matches the requirement for read-only access without configuring traps or enabling SNMP globally via the sysinfo context.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator needs to allow SNMP monitoring from a management station at 10.10.10.50. Which TWO configuration steps are required? (Choose two.)
medium- ✓ A.Enable SNMP agent globally
- ✓ B.Configure an SNMP community with read-only access and restrict access to 10.10.10.50
- C.Configure an SNMP trap to send alerts to 10.10.10.50
- D.Enable SNMP on the interface connected to the management station
- E.Configure a firewall policy allowing SNMP from the management station
Why A: The SNMP agent must be globally enabled on the FortiGate before any SNMP queries can be processed. Option B is correct because an SNMP community with read-only access defines the authentication and access control parameters, and restricting it to 10.10.10.50 ensures only that management station can poll the device.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.