Sample Questions and Answers
Which encryption algorithm is considered strongest for IPSec VPN?
A. DES
B. AES-256
C. Blowfish
D. RC4
✅ Answer: B
Explanation: AES-256 is a widely accepted and secure encryption standard for VPNs and secure communications.
What type of object is used in FortiGate to define IP ranges?
A. Service group
B. Zone
C. Address object
D. Policy tag
✅ Answer: C
Explanation: Address objects define IP addresses, ranges, subnets, or FQDNs for use in firewall policies.
Which CLI command shows live traffic logs filtered by a specific IP address?
A. execute ping
B. diagnose debug application
C. diagnose debug flow filter addr x.x.x.x
D. show system interface
✅ Answer: C
Explanation: This command filters traffic logs in real-time by source or destination IP.
What happens if you disable SIP ALG on FortiGate?
A. SIP calls are blocked
B. FortiGate stops inspecting SIP headers
C. DNS requests fail
D. VPNs break
✅ Answer: B
Explanation: Disabling SIP ALG stops FortiGate from modifying SIP headers, which can resolve VoIP issues.
In SSL VPN, which mode gives users full access to internal networks?
A. Web mode
B. Tunnel mode
C. Split mode
D. Transparent mode
✅ Answer: B
Explanation: Tunnel mode establishes a virtual interface that routes all or selected traffic to the internal network.
How can administrators enforce time-based access to a service?
A. Using Schedule objects in firewall policies
B. Modifying NAT
C. Changing zone configuration
D. Enabling DHCP
✅ Answer: A
Explanation: Schedule objects allow policies to be active only during specific time intervals.
What is the default priority of a static route with distance 10 and priority 0?
A. Lowest
B. Highest
C. Medium
D. Cannot be determined
✅ Answer: B
Explanation: Lower priority values mean higher preference; 0 is the highest possible priority.
Which interface role must be set to create a DHCP server on that interface?
A. LAN
B. DMZ
C. WAN
D. Internal
✅ Answer: A
Explanation: LAN or internal interfaces are typically used for DHCP services in trusted zones.
Which FortiOS feature allows scanning encrypted HTTPS traffic?
A. Antivirus
B. Deep Packet Inspection
C. SSL Deep Inspection
D. IP Reputation
✅ Answer: C
Explanation: SSL Deep Inspection decrypts HTTPS traffic for scanning and re-encrypts it before forwarding.
Which type of NAT is typically used for outbound internet access from internal clients?
A. Static NAT
B. Destination NAT
C. PAT (Port Address Translation)
D. Virtual IP
✅ Answer: C
Explanation: PAT maps multiple internal IPs to a single public IP with different port numbers.
What is the purpose of using Zones in FortiGate?
A. To separate VLANs
B. To apply antivirus only
C. To group interfaces with similar security levels
D. To disable inspection
✅ Answer: C
Explanation: Zones simplify policy management by grouping interfaces and applying common rules.
What does FortiGate use to detect and block known malicious IP addresses?
A. DNS Filtering
B. Application Control
C. Threat Intelligence via FortiGuard
D. Virtual IP
✅ Answer: C
Explanation: FortiGuard provides up-to-date threat intelligence including blacklisted IPs for real-time protection.
Which command shows the real-time CPU and memory usage on FortiGate?
A. show system performance
B. get system status
C. diagnose sys top
D. show hardware
✅ Answer: C
Explanation: diagnose sys top gives a real-time overview of resource utilization, similar to the Linux top command.
Here are the next 30 high-quality, updated, human-written, and plagiarism-free multiple-choice questions for the Fortinet NSE 4 – Network Security Professional Exam, starting from Question 211 to 240, with detailed explanations:
Fortinet NSE 4 Exam Practice Questions (211–240)
What does the “set allowaccess ping https ssh” command do on a FortiGate interface?
A. Enables all traffic through that interface
B. Allows access to the GUI, CLI, and ping on that interface
C. Opens all ports on the firewall
D. Disables administrative access
✅ Answer: B
Explanation: This command enables HTTPS (GUI), SSH (CLI), and ICMP (ping) access on the specified interface.
Which protocol is typically used for FortiGate to retrieve FortiGuard updates?
A. FTP
B. HTTP
C. HTTPS
D. SNMP
✅ Answer: C
Explanation: FortiGate uses secure HTTPS to communicate with FortiGuard for real-time updates.
What happens if you disable session helper for SIP traffic?
A. SIP traffic is blocked
B. SIP ALG stops modifying packet headers
C. Calls become encrypted
D. FortiGate automatically creates sessions
✅ Answer: B
Explanation: Disabling session helpers avoids automatic manipulation of SIP traffic, useful for compatibility with external SIP servers.
What is the role of the AV Engine in FortiGate?
A. Creates VLANs
B. Filters spam emails
C. Scans files and traffic for malware
D. Encrypts web traffic
✅ Answer: C
Explanation: The antivirus engine scans incoming and outgoing traffic to detect and block malware.
Which Fortinet service integrates security data across multiple devices in real time?
A. FortiAnalyzer
B. FortiManager
C. FortiCloud
D. Fortinet Security Fabric
✅ Answer: D
Explanation: Security Fabric links Fortinet devices and services, enabling centralized threat intelligence and policy sharing.
Which command would you use to diagnose high CPU usage in FortiOS?
A. diagnose debug flow
B. get hardware status
C. diagnose sys top
D. get system performance
✅ Answer: C
Explanation: This command shows real-time CPU and memory usage, similar to the Linux top command.
What does the command get router info routing-table all display?
A. All NAT rules
B. The complete routing table
C. Active VPN sessions
D. Interface traffic stats
✅ Answer: B
Explanation: This command displays all routes currently used by FortiGate, including static, connected, and dynamic.
What is the default administrative port for FortiGate web-based GUI (HTTPS)?
A. 80
B. 22
C. 443
D. 10443
✅ Answer: C
Explanation: Port 443 is the default for HTTPS administrative access to FortiGate’s GUI.
Which FortiGate feature protects against DDoS attacks?
A. IPS
B. Application Control
C. DoS policies
D. Web Filtering
✅ Answer: C
Explanation: Denial-of-Service policies can limit the rate of certain types of traffic to prevent DDoS attacks.
Which security profile detects and blocks known command and control (C&C) IPs?
A. DNS Filter
B. Application Control
C. IP Reputation (Botnet Protection)
D. Web Filter
✅ Answer: C
Explanation: IP reputation blocks communication with known malicious C&C servers based on FortiGuard threat intelligence.
What is the purpose of a “zone” in FortiGate firewall configuration?
A. It separates administrative domains
B. It allows bundling interfaces for unified policy application
C. It creates VLANs
D. It performs DNS filtering
✅ Answer: B
Explanation: Zones help simplify policy management by grouping multiple interfaces under one logical unit.
What is the maximum number of policies FortiGate can handle in most mid-tier appliances?
A. 100
B. 1,000
C. 10,000
D. Depends on the firmware
✅ Answer: C
Explanation: Most mid-range FortiGates support up to 10,000 firewall policies, but exact limits vary by model.
What does “application override” do in FortiGate?
A. Blocks encrypted apps
B. Forces classification of a specific app based on port or signature
C. Allows apps to bypass antivirus
D. Prevents tunneling
✅ Answer: B
Explanation: Application override ensures traffic is identified as a particular app, even if normal detection fails.
How does FortiGate enforce data loss prevention (DLP)?
A. Through sandboxing
B. By scanning content for sensitive patterns like SSNs or credit card numbers
C. By encrypting emails
D. Using URL filtering
✅ Answer: B
Explanation: DLP scans for sensitive data patterns in HTTP, SMTP, and FTP traffic to prevent accidental or malicious leaks.
What is a Virtual IP (VIP) used for in FortiGate?
A. VPN tunnel
B. DNS record
C. Port forwarding or NAT translation
D. VLAN interface
✅ Answer: C
Explanation: VIPs map external IP/ports to internal resources for NAT and port forwarding.
Which diagnostic tool can simulate a packet to test policy matches?
A. diagnose ip route
B. diagnose debug session
C. diagnose firewall iprope lookup
D. ping-options
✅ Answer: C
Explanation: This tool allows administrators to simulate how a packet would be processed by the firewall.
How can administrators monitor SSL VPN user sessions?
A. get system interface
B. show vpn tunnel
C. diagnose vpn ssl monitor
D. diagnose debug ssl
✅ Answer: C
Explanation: This command provides information about active SSL VPN sessions, users, and tunnel status.
Which setting helps improve logging efficiency and storage use?
A. Enable deep inspection
B. Use full-content logging
C. Set log severity to warning or above
D. Enable all debug logs
✅ Answer: C
Explanation: Filtering logs by severity ensures only significant events are logged, reducing storage usage.
Which interface type is used for connecting FortiGate to another device without IP addressing?
A. Loopback
B. VLAN
C. Virtual Wire Pair
D. DMZ
✅ Answer: C
Explanation: Virtual wire pairs allow transparent Layer 2 traffic forwarding without IP configuration.
What must be enabled to allow FortiAnalyzer to collect logs from FortiGate?
A. HTTPS access
B. Remote logging via syslog
C. Log forwarding to FortiAnalyzer
D. Web filtering
✅ Answer: C
Explanation: FortiAnalyzer must be specified as a log collector in FortiGate’s logging settings.
What does the diagnose debug enable command do?
A. Enables SNMP traps
B. Starts logging to disk
C. Activates real-time debug output
D. Enables VPN access
✅ Answer: C
Explanation: This command is used with other debug settings to view real-time logs in the CLI.
Which function does FortiSandbox provide in integration with FortiGate?
A. Traffic shaping
B. Real-time scanning of unknown files in a virtual environment
C. DNS resolution
D. Session logging
✅ Answer: B
Explanation: FortiSandbox analyzes suspicious files in a secure VM to detect previously unknown threats.
What is the difference between web filtering and DNS filtering in FortiOS?
A. DNS filtering blocks apps
B. Web filtering blocks URLs after DNS resolution
C. DNS filtering scans payloads
D. Web filtering only works in proxy mode
✅ Answer: B
Explanation: DNS filtering blocks access at the DNS query level, while web filtering inspects HTTP/HTTPS URLs after resolution.
What does the “match-vip” option in a policy do?
A. Matches VIP objects for incoming traffic
B. Filters VLANs
C. Matches VPN clients
D. Enables deep inspection
✅ Answer: A
Explanation: match-vip allows policies to apply to traffic directed to Virtual IPs.
What is required to perform SSL deep inspection?
A. No certificate
B. Custom IPS signature
C. Root certificate installed on client devices
D. Static routing
✅ Answer: C
Explanation: For SSL deep inspection, clients must trust the FortiGate’s CA certificate to avoid browser errors.
Which FortiOS feature provides threat correlation across multiple security events?
A. FortiAnalyzer
B. Threat Hunting
C. Security Fabric Automation
D. Automation Stitch
✅ Answer: D
Explanation: Automation Stitches link event triggers to actions, enabling automated responses across the Security Fabric.
Which configuration ensures FortiGate continues scanning even if one AV engine fails?
A. Dual-pass scanning
B. Flow-based mode
C. Use of multiple AV engines
D. Proxy-based scanning
✅ Answer: C
Explanation: FortiGate can use multiple antivirus engines for redundancy and improved detection.
What is the main advantage of using FortiManager?
A. File scanning
B. Policy and device management across multiple FortiGates
C. Hardware diagnostics
D. Real-time traffic shaping
✅ Answer: B
Explanation: FortiManager is used to centrally manage multiple FortiGate devices and maintain configuration consistency.
What can be used to trigger an automation stitch in FortiOS?
A. Only log severity
B. Log events, SNMP traps, or security incidents
C. Policy lookup
D. Routing table change
✅ Answer: B
Explanation: Automation stitches can be triggered by a wide variety of system or security events for automated response.
What is the role of inspection modes (proxy vs. flow) in FortiGate?
A. Determines packet size
B. Selects which port to monitor
C. Defines how traffic is processed for security scanning
D. Filters MAC addresses
✅ Answer: C
Explanation: Inspection mode determines how FortiGate scans traffic — proxy mode buffers and inspects full content; flow mode scans packets in real-time.
Reviews
There are no reviews yet.