NSE4_FGT-7-0 Practice Questions

In FortiOS, when a static route is configured with an "Internet Service" object as the destination, the FortiGate implements it as a policy route rather than a standard entry in the Routing Information Base (RIB). Because of this, it does not appear in the standard routing table output. To view routes managed as policy routes, including those derived from the Internet Service Database (ISDB), the administrator must query the policy route table using the diagnose firewall proute list command.

A: This command displays the standard kernel routing table (RIB), which excludes policy-based routes and does not show Internet Service-based static routes.

B: This is not a valid FortiGate command for displaying routing information; it is a distractor.

C: This command displays the routing database for standard routing protocols and conventional static routes, which does not include policy routes.

Fortinet. FortiGate Infrastructure 7.2 Study Guide. Fortinet Training Institute. (Section: Policy Routing, p. 59).

Fortinet. FortiGate / FortiOS 7.2.5 CLI Reference. Fortinet Document Library. (Command: diagnose firewall proute list).

FortiOS offers two Next-Generation Firewall (NGFW) modes: profile-based and policy-based. When configured in policy-based NGFW mode, FortiGate integrates application control and web filtering directly into the firewall policy. This mode is designed for simplicity and performance and exclusively uses the flow-based inspection engine. Flow-based inspection analyzes packets as they pass through the FortiGate, providing good performance with low latency, which is a key characteristic of this NGFW mode.

A. Full Content inspection: This is a descriptive term, not an official FortiOS inspection mode. Both flow-based and proxy-based modes perform content inspection.

B. Proxy-based inspection: This mode is available in profile-based NGFW mode but is not used in policy-based NGFW mode, which relies solely on flow-based inspection.

C. Certificate inspection: This is a specific inspection type used for SSL/TLS traffic within either flow-based or proxy-based modes, not a standalone firewall inspection mode.

Fortinet FortiOS 7.0.0 Administration Guide, "NGFW Mode" section, p. 838. It explicitly states, "In policy-based NGFW mode, FortiOS uses flow-based inspection and the security profiles functionality is limited."

Fortinet FortiOS 7.0.0 Security Profiles Guide, "Inspection modes" section, p. 10. This guide details the differences between flow-based and proxy-based inspection, clarifying their use cases and association with NGFW modes.

When split-task VDOM mode is enabled on a FortiGate, the root VDOM is designated to handle all management functions. This includes administrative access, communication with FortiManager and FortiAnalyzer, and establishing connections to the Security Fabric. Traffic-processing VDOMs are isolated from these management tasks. Therefore, the root VDOM of a downstream FortiGate is the one that must be configured to join the upstream FortiGate's Security Fabric.

B. FG-traffic is a common name for a traffic-processing VDOM, which, by design in split-task mode, does not handle management functions like Security Fabric connections.

C. A Customer VDOM is a generic term for a traffic VDOM and would not be responsible for management plane tasks.

D. Global VDOM is not a VDOM that can join the fabric; it refers to the global configuration scope that applies to all VDOMs.

1. FortiOS 7.0.1 Administration Guide, "System > VDOM" chapter, section "Split-task VDOM mode". It specifies, "In split VDOM mode, one VDOM is the management VDOM and the other VDOMs are traffic VDOMs... The management VDOM is used for all management traffic, such as connecting to FortiManager..."

2. Fortinet Security Fabric for FortiOS 7.0 Study Guide, "Security Fabric with VDOMs" section. It clarifies that the management VDOM (typically root) is used for fabric connectivity.

In a site-to-site IPsec VPN, the Phase 2 selectors (Quick Mode Selectors) must be configured as a mirror image on the two peers. The "local" subnet on one end of the tunnel must match the "remote" subnet on the other end, and vice versa. Since Site A's configuration defines the remote network as 192.168.2.0/24, this is the network that Site B must define as its local network for the Phase 2 negotiation to succeed and the tunnel to be established correctly.

A. 192.168.1.0/24 is Site A's local subnet, so it must be configured as Site B's remote subnet.

B. 192.168.0.0/24 is an incorrect subnet that does not match the selectors defined on Site A.

D. 192.168.3.0/24 is an incorrect subnet that does not match the selectors defined on Site A.

1. FortiOS 7.0.0 Administration Guide, "Phase 2 configuration", p. 1264. The guide states, "The source and destination addresses that you define here must be the opposite of the addresses that you define on the remote gateway."

2. FortiOS 7.0.0 Cookbook, "Site-to-site IPsec VPN with pre-shared key", p. 5. The example configuration clearly shows the local and remote selectors being mirrored between the two sites. For example, Site 1's local selector is Site 2's remote selector.

In the FortiOS packet flow architecture, Denial of Service (DoS) policies are evaluated significantly earlier in the ingress pipeline than Intrusion Prevention System (IPS) sensors. When a packet arrives at an ingress interface, Fortinet's Parallel Path Processing (Life of a Packet) dictates that the system first performs basic hardware checks and immediately evaluates DoS policies to protect the firewall and internal network from being overwhelmed. Only if the traffic passes the DoS policy—which evaluates Layer 3 and Layer 4 anomalies like ip_src_session—will the packet proceed to routing, firewall policy lookup, and subsequent deep packet inspection by security profiles like the IPS engine.

A. SMTP.Login.Brute.Force: This is an IPS signature evaluated by the IPS engine during deep packet inspection, which occurs only after the firewall policy allows the traffic.

B. IMAP.Login.brute.Force: Rate-based IPS signatures are also processed by the IPS engine, occurring much later in the packet flow than DoS policies.

D. Location: server Protocol: SMTP: This is an IPS filter applied within the IPS sensor profile, evaluated only after DoS inspection and standard firewall policy matching are complete.

Fortinet Technologies Inc. (2023). FortiOS 7.4 Administration Guide: Parallel Path Processing (Packet Flow). Under section: "Life of a packet", subsection: "Ingress". This section explicitly details that the DoS sensor is evaluated immediately upon ingress, prior to stateful inspection and security profile (IPS, AV, etc.) evaluation.

Fortinet Technologies Inc. (2022). FortiOS 7.2 Administration Guide: DoS protection. Details how DoS policies inspect traffic early in the flow using hardware or software state machines to detect and mitigate anomalies like ip_src_session before consuming CPU resources for full IPS inspection.

FortiGate offers two main types of authentication timeouts. An idle-timeout resets whenever the user generates traffic, de-authenticating them only after a period of inactivity. A hard-timeout, however, sets an absolute session duration starting from the moment of authentication. It will de-authenticate the user when the timer expires, regardless of any ongoing activity. The scenario described requires the timer to expire after a configured value irrespective of the user's behavior, which is the exact function of a hard timeout.

A. auth-on-demand: This is a trigger for authentication within a firewall policy, not a type of timeout.

B. soft-timeout: This is not a valid timeout option in FortiOS.

C. idle-timeout: This timeout is based on user inactivity. The timer resets with traffic, which contradicts the requirement that the timeout is independent of user behavior.

D. new-session: This is a setting related to when authentication is required for new sessions, not a timeout mechanism.

FortiOS 7.0.0 CLI Reference, config user setting section, p. 2511: Defines auth-timeout-type with options idle-timeout and hard-timeout.

FortiOS 7.0.1 Firewall Handbook, "Firewall authentication" section, p. 101: Explains that a hard timeout "is an absolute timeout. The user is logged out when the timer expires, even if they are active."

IPsec Phase 1 negotiation requires strict parameter matching between the two peers. Currently, there is an IKE mode mismatch: the HQ-FortiGate is set to Aggressive, while the Remote-FortiGate is set to Main (ID protection). They must be set to the same mode to successfully negotiate the tunnel. Additionally, the configuration on the Remote-FortiGate references port1, but the topology diagram explicitly shows the Remote-FortiGate connected to the internet via port2 (10.10.200.10). The interface must be set to port2 to ensure the FortiGate correctly routes IKE negotiation packets to the remote gateway.

B: Dead Peer Detection (DPD) is a mechanism to verify the liveliness of the tunnel. A mismatch in DPD settings does not prevent the initial Phase 1 negotiation from completing.

C: Both devices have Diffie-Hellman (DH) Group 5 selected. Modifying or disabling an unselected DH group (such as Group 2) has no effect on the Phase 1 negotiation process.

Fortinet Product Documentation: FortiOS 7.x Administration Guide, "IPsec VPN - Configuring Phase 1."

Fortinet Product Documentation: FortiOS 7.x Administration Guide, "Troubleshooting IPsec VPNs," Section regarding Phase 1 negotiation requirements (IKE mode and proposal matching).

Fortinet Knowledge Base: Technical Tip: Troubleshooting IPsec VPN Phase 1, identifying common causes for IKE negotiation failure, including interface mismatch and IKE mode mismatch.

A Web Application Firewall (WAF) profile provides specialized, application-layer protection for web servers. Its core function is to inspect HTTP/S traffic for common web-based attacks. This includes using signatures to detect and block SQL injection attempts, which target the application's database. It can also prevent the leakage of sensitive data, such as credit card numbers, from server responses using data leak prevention (DLP) techniques. Furthermore, WAF can block attacks aimed at disclosing server information, like software versions in headers, which attackers could use for reconnaissance.

A. Traffic to botnet servers is blocked by the IPS engine's botnet C&C database or the Web Filter, not by the WAF profile which protects inbound traffic to your servers.

B. Traffic to inappropriate web sites is a function of the Web Filter security profile, which controls outbound user access to the internet.

1. FortiOS 7.0.0 Administration Guide, "Web application firewall," Section: "Signatures". This section details protections against SQL Injection and Information Disclosure.

2. FortiOS 7.0.0 Administration Guide, "Web application firewall," Section: "Data Leak Prevention". This section describes how WAF can be configured to block sensitive data like credit card numbers.

3. Fortinet NSE 4 - FortiOS 7.0 Study Guide, "Security Profiles," page 273. It states, "WAF can detect and block known attacks, such as... SQL injection... It can also provide data leak prevention (DLP) by scanning outgoing web server traffic for sensitive information."

Within a single Virtual Domain (VDOM), each VLAN subinterface configured on the same physical parent interface must have a unique VLAN ID. The VLAN ID is the primary identifier that FortiGate uses to associate tagged traffic on a trunk link with the correct logical subinterface. Attempting to configure two subinterfaces on the same physical port with the same VLAN ID will result in a configuration error, as it would create ambiguity.

A. The uniqueness of the VLAN ID is a Layer 2 requirement, independent of the Layer 3 IP addressing scheme used on the subinterfaces.

C. This statement is incorrect because it is precisely the use of different VDOMs that allows the same VLAN ID to be used on the same physical interface.

D. The IP subnet configuration is irrelevant to the Layer 2 requirement that VLAN IDs must be unique on a per-physical-interface basis within a VDOM.

1. Fortinet Training Institute. (2021). NSE 4 Study Guide - FortiGate Infrastructure 7.0. "Layer 2 Switching and VLANs" section. "You can create multiple VLAN subinterfaces on a physical interface. Each subinterface must have a unique VLAN ID."

2. Fortinet. (2021). FortiOS Administration Guide 7.0.0. "Interfaces". p. 318. The configuration examples and principles demonstrate that each VLAN subinterface on a physical port is defined by its unique VLAN ID.

Under firewall policy ID 1, the command set http-policy-redirect enable is configured. This explicitly redirects matched HTTP and HTTPS traffic to the FortiGate's transparent web proxy for inspection, overriding the default firewall acceptance. Once redirected, traffic must match an active proxy policy to be permitted. The traffic is destined for http://www.fortinet.com. Proxy policy ID 1 is the only active proxy policy, but its destination address is constrained to the EICAR object, which uses a regex matching only .*eicar\.org. Therefore, www.fortinet.com does not match ID 1. Because proxy policies ID 2 and ID 3 are configured with set status disable, they are skipped. Consequently, the unmatched traffic falls through and is blocked by the proxy implicit deny policy.

Option A: Proxy policy ID 3 is explicitly configured with set status disable, rendering it inactive. Therefore, it cannot evaluate or allow any traffic.

Option B: Firewall policy ID 1 includes set http-policy-redirect enable, which dictates that traffic is redirected to the transparent proxy rather than being allowed directly by the firewall policy.

Option C: Proxy policy ID 1 restricts its destination to the EICAR address object (.*eicar\.org). Traffic destined for www.fortinet.com fails this condition and will not be allowed.

Fortinet, Inc. (2023). FortiOS 7.2 Administration Guide. Section: Security Profiles > Explicit and Transparent Proxy > Transparent web proxy (Details the function of the http-policy-redirect command intercepting traffic).

Fortinet, Inc. (2023). FortiOS 7.2 Administration Guide. Section: Policy and Objects > Proxy policies (Details proxy policy matching criteria, disabled status states, and the proxy implicit deny mechanism).