How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 13 Refer to the Exhibit Practice Questions scenario questions for the NSE4 exam, each with detailed explanations and wrong-answer analysis.

How should I approach NSE4 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 4 Network Security Professional NSE4 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Fortinet NSE 4 Network Security Professional NSE4 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

NSE4

exam code

Fortinet

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1easymultiple choice

Read the full VPN explanation →

Refer to the exhibit. A network administrator configured an IPsec VPN between the main office and a branch office. Remote users at the branch office report that they cannot access resources in the main office. The tunnel status shows up on both sides. What is the most likely cause of the connectivity issue?

Exhibit

Refer to the exhibit.
config vpn ipsec phase1-interface
    edit "to_Branch"
        set interface "wan1"
        set ike-version 2
        set keylife 86400
        set peertype any
        set net-device disable
        set mode-cfg enable
        set proposal aes256-sha256
        set dhgroup 14
        set remote-gw 203.0.113.5
        set psksecret ENC ...
    next
end
config vpn ipsec phase2-interface
    edit "to_Branch_p2"
        set phase1name "to_Branch"
        set proposal aes256-sha256
        set pfs enable
        set dhgrp 14
        set auto-negotiate enable
        set keylifeseconds 3600
    next
end

A
The phase1 keylife is longer than the phase2 keylife, causing rekey issues.
Why wrong: Different keylifes are acceptable; phase2 rekeys independently.
B
The 'set net-device disable' prevents the tunnel from being used for routing.
Why wrong: net-device disable is typical for route-based VPNs; the tunnel interface is still used.
C
The phase2 configuration does not specify the local and remote subnets to protect.
Without 'set src-addr-type' and 'set dst-addr-type', the tunnel does not know which traffic to encrypt.
D
The phase2 proposal does not match the phase1 proposal.
Why wrong: Both use aes256-sha256; they match.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Allow-Internet"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
    edit 2
        set name "Block-SSH"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "SSH"
        set logtraffic all
    next
end

A
The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.
Policy 1 matches all traffic from internal to wan1, so SSH is allowed before reaching the deny policy.
B
The SSH connection will succeed because policy 2 is evaluated first.
Why wrong: Policies are evaluated from top to bottom; policy 1 is first.
C
The SSH connection will be blocked because policy 2 explicitly denies SSH.
Why wrong: Firewall policies are evaluated in order; policy 1 (allow all) is before policy 2 (deny SSH), so policy 1 matches first and allows the traffic.
D
The SSH connection will be blocked because policy 1 does not include SSH service specifically.
Why wrong: Policy 1 uses service 'ALL', which includes SSH. The issue is the order.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

Refer to the exhibit. An administrator is troubleshooting why SSL inspection is not working for web traffic. The policy shown is the only policy matching the traffic. What is the most likely reason SSL inspection is failing?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "SSL-Inspection"
        set srcintf "wan1"
        set dstintf "internal"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "deep-inspection"
        set profile-protocol-options "default"
        set av-profile "default"
        set webfilter-profile "default"
    next
end

A
The policy is missing the 'set inspection-mode proxy' command.
Deep inspection requires proxy-based inspection mode.
B
The ssl-ssh-profile is set to 'deep-inspection' but the policy is using flow-based inspection.
Why wrong: This is essentially the same as B, but B is more precise.
C
The source interface is 'wan1' but the traffic is coming from 'internal'.
Why wrong: The exhibit shows the policy matches traffic from wan1 to internal, which is correct for inbound inspection.
D
The policy has 'set action deny' instead of 'set action accept'.
Why wrong: The action is accept, so traffic is allowed.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full NAT/PAT explanation →

Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?

Exhibit

Refer to the exhibit.

config ips sensor
    edit "sensor1"
        config entries
            edit 1
                set severity medium
                set action block
            next
            edit 2
                set severity critical
                set action block
            next
        end
    next
end

A
The packet will be allowed (pass).
Signatures not matching any entry use the default action 'pass'.
B
The packet will be logged and a session will be created.
Why wrong: Logging is not configured; no log action is set.
C
The packet will be blocked if the signature severity is 'low' or 'high'.
Why wrong: Only severities defined in entries are processed; 'low' is not defined.
D
The packet will be blocked because the sensor is enabled.
Why wrong: The sensor only blocks signatures with explicitly configured severity.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full routing breakdown →

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Exhibit

Refer to the exhibit.
config router static
    edit 1
        set device port1
        set gateway 203.0.113.1
        set dst 0.0.0.0 0.0.0.0
        set distance 10
    next
    edit 2
        set device port2
        set gateway 10.0.0.1
        set dst 0.0.0.0 0.0.0.0
        set distance 20
    next
end

A
The second route is overwriting the first route
Why wrong: FortiGate supports multiple default routes with different distances.
B
Both routes are equal-cost and load-balancing is not working
Why wrong: Routes have different distances, so they are not equal-cost.
C
The configuration is invalid because duplicate default routes are not allowed
Why wrong: Multiple default routes are allowed with different distances.
D
The gateway 203.0.113.1 (port1) is unreachable
The first route is preferred (distance 10), so if its gateway is unreachable, traffic fails.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. An administrator runs 'diagnose firewall auth list' and sees two authenticated users. The firewall policy requires authentication for HTTP traffic from 10.0.0.0/24 to 192.168.1.10. User 'jsmith' has been idle for 20 minutes, but the authentication session is still active. The idle timeout is set to 30 minutes. What will happen after 30 minutes of inactivity?

Exhibit

FGT # diagnose firewall auth list
1: authid=1 type=ldap user=jsmith src=10.0.0.5 dst=192.168.1.10 proto=6 port=80 duration=1200 timeout=3600
2: authid=2 type=ldap user=ajones src=10.0.0.6 dst=192.168.1.10 proto=6 port=80 duration=600 timeout=3600

A
The authentication session will remain active because the firewall session is still valid
Why wrong: Authentication sessions have their own idle timer.
B
The user will be automatically re-authenticated without prompting
Why wrong: Automatic re-authentication does not happen; the user must re-enter credentials.
C
The firewall session will be torn down immediately
Why wrong: The firewall session continues until it times out or traffic ends.
D
The authentication session will expire, and the user must re-authenticate for new traffic
The user will be prompted for credentials again after idle timeout.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full NAT/PAT explanation →

An administrator has configured the policy shown in the exhibit. Traffic to the web server at 10.0.1.10 over HTTPS is allowed, but users complain that they cannot access the web server's login page. The IPS sensor 'High_Security_Sensor' has a signature that blocks SQL injection attempts. The application list 'Block_Social_Media' blocks Facebook and Twitter. What is the most likely cause of the issue?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Web-Server"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "10.0.1.10"
        set action accept
        set schedule "always"
        set service "HTTPS"
        set utm-status enable
        set ips-sensor "High_Security_Sensor"
        set application-list "Block_Social_Media"
    next
end

A
The IPS sensor is blocking the login page due to a false positive.
Why wrong: IPS sensor blocks SQL injection, not typical login pages.
B
The firewall policy action is set to 'deny' but the exhibit shows 'accept'.
Why wrong: The exhibit clearly shows action accept.
C
The HTTPS service is not correctly defined and blocking the traffic.
Why wrong: The service is set to HTTPS, which is a predefined service, so it should work.
D
The application control profile is blocking the web application.
Application control may block the web application if it is misclassified.

Full breakdown with real-world context →

Question 8mediummulti select

Read the full VPN explanation →

An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?

A
Enable NAT on the hub's tunnel interface.
Why wrong: NAT would break routing between spokes.
B
Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.
This allows traffic to any destination, including other spokes.
C
Configure the hub as a DNS server for the spokes.
Why wrong: DNS is not required for spoke-to-spoke routing.
D
Configure IKEv2 instead of IKEv1 on all tunnels.
Why wrong: IKE version is not specific to spoke-to-spoke communication.
E
Create firewall policies on the hub that allow traffic between the spoke networks.
Policies must permit traffic from one spoke to another.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full VPN explanation →

A network admin is configuring a hub-and-spoke VPN with three spokes. Which TWO statements are correct about route-based VPN in this topology?

A
Each spoke must have a route-based VPN interface configured to the hub
Route-based VPN uses tunnel interfaces.
B
A single firewall policy can control traffic to all spokes
Why wrong: Each tunnel interface typically requires its own policies.
C
BGP can be used to exchange routes between the hub and spokes
BGP is a common dynamic routing protocol over route-based VPN.
D
Aggressive mode must be enabled for the hub to accept multiple spokes
Why wrong: Main mode can also accept multiple spokes with 0.0.0.0 remote gateway.
E
All spokes can share the same Phase 1 configuration
Why wrong: Each spoke typically has its own Phase 1 with unique remote IP or PSK.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full VPN explanation →

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

A
ADVPN (Auto-Discovery VPN)
ADVPN enables dynamic direct tunnels between spokes.
B
Site-to-site VPN between each spoke pair manually
Why wrong: Manual configuration is possible but not dynamic.
C
Policy-based VPN with multiple Phase 2 selectors
Why wrong: This does not create dynamic direct tunnels.
D
SSL VPN tunnel mode
Why wrong: SSL VPN is not typically used for site-to-site.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full VPN explanation →

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

A
Enable 'forward traffic' in Phase 1 settings
Why wrong: There is no such setting; traffic forwarding is controlled by policies and routing.
B
Static routes for each branch's subnet pointing to the respective VPN interface
The hub needs routes to forward traffic between spokes.
C
Phase 2 selectors that include both branch subnets in one proposal
Each spoke's Phase 2 should include the other spoke's subnet so the hub can encrypt/decrypt.
D
Disable anti-replay on all tunnels
Why wrong: Disabling anti-replay is not required and reduces security.
E
A firewall policy allowing traffic between the VPN interfaces
An inter-VDOM or inter-zone policy to allow spoke-to-spoke traffic through the hub.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full VPN explanation →

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

A
Set the 'add-route' option to 'enable' on the spoke Phase 1 settings
Why wrong: The 'add-route' option automatically adds routes on the spoke for the remote subnet, but does not create direct spoke-to-spoke tunnels.
B
Configure dynamic routing (BGP) on all sites and enable route exchange
Dynamic routing (BGP/OSPF) can advertise spoke subnets to each other, allowing direct tunnels to be established if using ADVPN or additional Phase 2 selectors.
C
Add static routes on the hub pointing to each spoke's subnet via the respective tunnels
Why wrong: Static routes on the hub would route traffic through the hub, not directly between spokes.
D
Create a separate IPsec VPN between each spoke pair
Why wrong: That would work but is not a change within the hub-and-spoke topology; it's creating a full mesh.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full VPN explanation →

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?

A
The hub is missing static routes to the spoke networks via the respective tunnel interfaces
Route-based VPNs require explicit routes; without them, traffic cannot be forwarded between spokes.
B
The firewall policies on the hub do not allow traffic between the spoke networks
Why wrong: Even if policies exist, without routes the traffic is not forwarded.
C
The spokes have mismatched IKE versions
Why wrong: This would prevent tunnel establishment, not just inter-spoke traffic.
D
The hub's IPsec Phase1 is not configured for DPD
Why wrong: DPD detects dead peers but does not cause inter-spoke failure after reboot.

Full breakdown with real-world context →

These NSE4 practice questions are part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style NSE4 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related NSE4 topic practice pages

System and Network Administration practice questions

Firewall Policies and NAT practice questions

Authentication and VPN practice questions

Security Profiles practice questions

High Availability and Diagnostics practice questions

NSE4 fundamentals practice questions

NSE4 scenario practice questions

NSE4 troubleshooting practice questions

Practice scenarios

Exhibit

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Exhibit

Refer to the exhibit. An administrator is troubleshooting why SSL inspection is not working for web traffic. The policy shown is the only policy matching the traffic. What is the most likely reason SSL inspection is failing?

Exhibit

Refer to the exhibit. An administrator has created an IPS sensor with two entries. The first entry sets severity 'medium' and action 'block'. The second entry sets severity 'critical' and action 'block'. What will happen when a packet triggers an IPS signature with severity 'low'?

Exhibit

Refer to the exhibit. The FortiGate has two default routes. The administrator attempts to ping 8.8.8.8 from the CLI and receives no response. What is the most likely reason?

Exhibit

Exhibit

Exhibit

An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?

A network admin is configuring a hub-and-spoke VPN with three spokes. Which TWO statements are correct about route-based VPN in this topology?

A FortiGate in a hub-and-spoke VPN topology has multiple spoke sites connecting via IPsec. The hub administrator wants to enable direct spoke-to-spoke communication without routing traffic through the hub. What technology should be used?

A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)

In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?

A FortiGate in a hub-and-spoke VPN topology is configured with a single IPsec tunnel to each spoke. The hub has a route-based VPN with a tunnel interface for each spoke. After a reboot, traffic between spoke A and spoke B fails, although each spoke can reach the hub. What is the likely cause?