Free Fortinet NSE 4 - FortiOS 8.0 Administrator practice test: 30 questions with answers

With override disabled, the unit that took over as primary keeps that role, and the repaired unit rejoins as secondary. Enabling override would let the higher-priority unit take the primary role back. The reclaim option describes the override behavior that is switched off here, the split option describes a split-brain state that FGCP heartbeats are designed to prevent, and both units going secondary does not happen while a healthy unit remains.

FortiAnalyzer is Fortinet's central logging and reporting platform, so it can retain logs for long periods and report across many devices. Local disks and manual exports do not provide central retention or reporting, packet capture is a troubleshooting tool rather than log retention, and disabling logging removes the evidence the company needs.

get system performance status reports CPU, memory and session statistics. get system status shows the firmware version and serial number, show system global displays the global settings, and execute ping only tests reachability to a host.

diagnose sniffer packet captures live packets on the CLI and accepts host, port and interface filters. A configuration backup does not capture traffic, the routing command lists routes rather than packets, and diagnose debug reset only clears debug settings.

An SDN connector lets FortiGate read cloud resource information and fill dynamic address objects that policies can reference. Hand-edited static addresses break as soon as instances change, a route to the management interface does not identify workloads, and turning off logging has no effect on how addresses are matched.

ZTNA grants access per application based on identity and device posture, so contractors reach only the HR application. A full-tunnel VPN exposes the wider internal network, a shared account gives broad rights and weakens accountability, and a public login page exposes the server to the internet with no device check.

Deep inspection re-signs server certificates with a FortiGate CA, so clients that do not trust that CA show warnings until the CA certificate is installed as trusted. The warning comes from an untrusted issuer, not from web filtering, the inspection mode, or the TLS version.

Certificate inspection checks the server certificate only, so the payload stays encrypted and clients do not need a FortiGate CA. Scanning decrypted content and re-signing the server certificate are deep inspection features, not certificate inspection features.

An SSL inspection exemption lets chosen destinations, such as a bank, skip decryption while the rest of the HTTPS traffic is still inspected. Disabling inspection everywhere removes protection for all users, turning off antivirus does not stop decryption, and a deny policy would block the bank rather than exempt it.

A web filter profile uses FortiGuard URL categories, so blocking the gambling category covers many sites without a manual list. A DHCP reservation only fixes addresses, a static route does not filter content, and an address list would miss sites whose IP addresses change.

Application control identifies applications from their traffic patterns and signatures, so it works on non-standard ports. A port-based deny only catches expected ports, while web and DNS filters act on website names rather than on the application itself.

Sandbox inspection submits unknown files to a sandbox such as FortiSandbox, which runs them and observes their behavior, so zero-day malware can be caught without a matching signature. IPS signatures target network attacks, web filtering blocks sites rather than analyzing files, and a static route does not inspect content.

Proxy-based inspection buffers the complete file, so the antivirus engine can scan all of it before delivery. Flow-based inspection processes traffic as it streams and does not hold the whole file before delivery, a larger MTU does not change how content is scanned, and removing the profile drops the scan the requirement asks for.

FortiGate checks policies from the top of the list down and applies the first match, so policy 1 allows the session before policy 2 is reached. This is why a specific deny placed below a broad allow has no effect. Moving the deny above the allow would change the result.

Source NAT using the outgoing interface address rewrites each private source address to the FortiGate WAN address. Destination NAT changes the destination of traffic rather than the source, an IP pool would give hosts their own public addresses, and a static route through a loopback does not translate addresses at all.

A virtual IP (VIP) defines destination NAT from an external address and port to an internal server, and the inbound policy references it. An IP pool is used for source NAT, an address group only groups existing objects, and a static route forwards packets without translating the destination address.

RADIUS is a standard AAA protocol that the FortiGate uses to pass credentials and challenge responses to an external server, which is how many one-time code services are integrated. LDAP is used to look up directory records and groups rather than to run one-time code challenges, while NTP and SNMP do not authenticate users.

FSSO learns which user is logged on at each IP address from the domain, through a collector agent or agentless polling, and policies can then match user groups. Captive portal sign-in is a different mechanism, and FSSO does not replace firewall policies, which still decide what traffic is allowed.

The routing table picks the matching route with the longest prefix, so the /16 route through port2 wins for 10.10.5.20. Configuration order does not decide the route, traffic is not split between routes with different prefixes, and overlapping routes are allowed.

A floating static route has a higher administrative distance than the primary route, so it is used only after the primary route is removed from the table. A lower distance would make it preferred, equal settings share traffic between the two routes, and the routing table does not create backup routes on its own.

SD-WAN health checks send probes over each member and report measured latency, jitter and loss, which rules compare against their SLA targets. Fixed static route metrics do not measure link quality, NAT pools do not measure performance, and DNS forwarding does not choose WAN links.

A bandwidth-utilization-based SD-WAN strategy measures how loaded each member is and steers new sessions toward the one with the most spare capacity. A fixed member order does not react to load, a lower-distance static route is not load-aware, and a policy route matched only by source does not measure link capacity.

A policy route matches traffic by source, destination and service, and can send that traffic out a chosen interface, which a destination-based routing table cannot do. A second default route with equal distance shares traffic rather than targeting guests, a virtual IP translates addresses, and IPsec proposals do not select an internet link.

A static route with a gateway is active only while its outgoing interface is up and the gateway is reachable, so it is missing while port2 is down. A low metric does not hide routes, static routes can use gateways on physical interfaces, and private destination ranges are routed like any other network.

Phase 1 (the IKE SA) authenticates the two peers and creates a protected channel that is used to negotiate phase 2. Phase 2 creates the IPsec SAs that encrypt data, DHCP address assignment is a separate feature, and firewall policies are configured separately from tunnel negotiation.

Phase 2 negotiates the IPsec proposals and traffic selectors, so a mismatch there leaves phase 1 up while data does not flow. A pre-shared key mismatch would stop phase 1 instead, DNS reachability is unrelated to tunnel negotiation, and a policy denial does not change the phase 2 proposals the peers exchange.

TLS 1.3 uses ephemeral key exchange in every cipher suite, which gives forward secrecy, and it removes static RSA key transport. The last two options describe features that TLS 1.3 removed rather than features it keeps.

A route-based tunnel uses a virtual tunnel interface, so routing protocols such as OSPF can advertise routes across it. Policy-based tunnels match traffic with fixed selectors and do not give routing protocols an interface, manual-key tunnels skip IKE negotiation, and SSL VPN serves individual remote users rather than site-to-site routing.

NAT traversal wraps the IPsec packets in UDP when a NAT device is detected, so the device can translate and forward them. Dead peer detection monitors whether a peer is still alive, quantum-safe key exchange addresses future cryptography, and split tunneling decides which traffic enters the tunnel.

Quantum-safe IPsec uses post-quantum key exchange in IKE, which protects session keys against future decryption of recorded traffic. A longer pre-shared key does not address the quantum threat, MTU changes packet sizes rather than secrecy, and route-based tunnels do not hide traffic from capture.