Fortinet NSE4 - FortiGate Security Network Security Professional - Policies NAT VPN UTM HA SD-WAN

By Chris Weber · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,528
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.6 (34)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A FortiGate administrator needs to implement Source NAT (IP masquerading) so that all traffic from the 10.0.0.0/8 internal network appears to originate from the WAN interface IP address when accessing the internet. How is this configured in FortiOS?

Answer choices

  • A. Create a VIP (Virtual IP) with NAT type "Overload"

  • B. Enable "NAT" in the outbound firewall policy (From Internal to WAN), which automatically uses the egress interface IP for source address translation

  • C. Create a separate NAT policy rule under Policy > NAT

  • D. Configure IP Pool with type "No-NAT" and reference it in the firewall policy

Question 2

A FortiGate administrator is troubleshooting a connectivity issue. A user reports they cannot access a specific website. The administrator wants to trace the packet through the FortiGate to see what policy matches and what action is taken. Which FortiOS diagnostic command is most useful?

Answer choices

  • A. `show firewall policy all` to list all policies

  • B. `diagnose debug flow filter addr <client_ip>` followed by `diagnose debug flow show console enable` and `diagnose debug enable` — the packet flow debugging trace

  • C. `get system session list` to see active sessions

  • D. `show security policy lookup` to check policy match

Question 3

A FortiGate administrator needs to configure two-factor authentication (2FA) for SSL VPN users. The organization already has a FortiToken Cloud subscription. How is this configured?

Answer choices

  • A. Configure RADIUS to point to FortiToken Cloud's RADIUS endpoint

  • B. Register FortiTokens to user accounts in User & Authentication > User Definition, enable Two-factor Authentication for each user, and configure FortiToken Cloud as the 2FA method

  • C. Install FortiToken Mobile app on users' devices and configure PIN authentication

  • D. Configure SAML authentication with FortiToken as the SAML IdP

Question 4

An administrator configures FortiGate in an Active-Active HA cluster. How does traffic load balancing work in Active-Active HA, and what is required for this configuration?

Answer choices

  • A. Active-Active HA distributes sessions across all cluster members using a load balancing algorithm; the primary unit coordinates session distribution and both units process traffic simultaneously

  • B. Active-Active HA is identical to Active-Passive; both units process traffic only when the primary fails

  • C. Active-Active HA requires an external load balancer to distribute traffic to each FortiGate

  • D. Active-Active HA is only supported on FortiGate 1000-series and above

Question 5

A security operations team wants FortiGate to automatically block IP addresses that are identified as malicious by FortiGuard threat intelligence. Which FortiGate feature provides automated threat intelligence-based IP blocking?

Answer choices

  • A. Configure a manual block list under Firewall > Address and update it weekly

  • B. Enable FortiGuard IP Reputation / Threat Intelligence in the Security Fabric with automatic blocking of known malicious IPs via the Threat Feed integration

  • C. Configure IPS signatures to detect and block known malicious IP communications

  • D. Use a Web Filter category for "Malicious Websites" in the firewall policy