Fortinet NSE 4 - FortiOS 8.0 Administrator

Last checked November 10, 2026 against the official Fortinet exam page.

1. Question 1Deployment and system configuration

   A FortiGate HA pair runs in active-passive mode with the override setting disabled. The primary unit fails and the secondary unit takes over as primary. After the failed unit is repaired and reconnects over the heartbeat link, what happens?

   1. AThe repaired unit immediately reclaims the primary role because it was the original primary unit in the cluster
   2. BThe cluster splits into two primary units until an administrator manually resets the heartbeat interfaces
   3. CThe repaired unit rejoins as the secondary, and the unit that took over keeps the primary role
   4. DBoth units switch to secondary mode until an administrator manually selects a new primary unit
   Show answer and explanationHide answer

   Correct answer: C

   With override disabled, the unit that took over as primary keeps that role, and the repaired unit rejoins as secondary. Enabling override would let the higher-priority unit take the primary role back. The reclaim option describes the override behavior that is switched off here, the split option describes a split-brain state that FGCP heartbeats are designed to prevent, and both units going secondary does not happen while a healthy unit remains.

2. Question 2Content inspection

   After SSL deep inspection is enabled, users see certificate warnings for every HTTPS site they visit. What is the most likely cause, and what is the fix?

   1. AClients do not trust the FortiGate CA used for deep inspection; install that CA certificate on each client
   2. BWeb filtering is blocking the sites, so the browser shows a warning; disable web filtering for the policy
   3. CPolicies run in flow-based mode, which cannot verify server certificates; switch every policy to proxy mode
   4. DThe sites use TLS 1.3, which deep inspection cannot handle; disable TLS 1.3 in all browsers
   Show answer and explanationHide answer

   Correct answer: A

   Deep inspection re-signs server certificates with a FortiGate CA, so clients that do not trust that CA show warnings until the CA certificate is installed as trusted. The warning comes from an untrusted issuer, not from web filtering, the inspection mode, or the TLS version.

3. Question 3Firewall policies and authentication

   An administrator must scan large file downloads with antivirus before the complete file is delivered to the user. Which inspection mode should the policy use?

   1. AFlow-based inspection, which checks each packet as it passes through the firewall
   2. BProxy-based inspection, which buffers the whole file so it can be scanned before delivery
   3. CNo inspection profile, because the endpoint antivirus product will scan the file instead
   4. DFlow-based inspection with a larger interface MTU so that each file arrives in one packet
   Show answer and explanationHide answer

   Correct answer: B

   Proxy-based inspection buffers the complete file, so the antivirus engine can scan all of it before delivery. Flow-based inspection processes traffic as it streams and does not hold the whole file before delivery, a larger MTU does not change how content is scanned, and removing the profile drops the scan the requirement asks for.

4. Question 4Routing

   A FortiGate routing table has a static route for 10.0.0.0/8 through port1 and another static route for 10.10.0.0/16 through port2. A packet is destined for 10.10.5.20. Which route is used?

   1. ANeither route, because overlapping static routes are rejected by the routing table
   2. BThe 10.0.0.0/8 route through port1, because it was configured before the other route
   3. CBoth routes at once, with the packet split between port1 and port2 by a hash
   4. DThe 10.10.0.0/16 route through port2, because it is the most specific match
   Show answer and explanationHide answer

   Correct answer: D

   The routing table picks the matching route with the longest prefix, so the /16 route through port2 wins for 10.10.5.20. Configuration order does not decide the route, traffic is not split between routes with different prefixes, and overlapping routes are allowed.

5. Question 5VPNs

   In an IPsec VPN, what is the purpose of phase 1 negotiation?

   1. AIt authenticates the peers and sets up a secure IKE channel for later negotiation
   2. BIt creates the IPsec security associations that encrypt the user data traffic
   3. CIt assigns VPN client addresses from a DHCP pool on the remote side
   4. DIt installs the firewall policies that permit the tunnel traffic through the FortiGate
   Show answer and explanationHide answer

   Correct answer: A

   Phase 1 (the IKE SA) authenticates the two peers and creates a protected channel that is used to negotiate phase 2. Phase 2 creates the IPsec SAs that encrypt data, DHCP address assignment is a separate feature, and firewall policies are configured separately from tunnel negotiation.