Fortinet NSE 4 - FortiOS Administrator Practice Exam

What the Fortinet NSE 4 - FortiOS Administrator exam covers

• Deployment and system configuration219 questions
• Firewall policies and authentication188 questions
• Content inspection240 questions
• Routing102 questions
• VPNs105 questions

Free Fortinet NSE 4 - FortiOS Administrator practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 854.

1. Question 1Deployment and system configuration

   An administrator changes the HTTPS administrative access port on a FortiGate interface from the default 443 to 8443. What is the most likely reason for this change?

   • APort 443 cannot be used with certificate based GUI login
   • BPort 8443 is mandatory for joining a High Availability cluster
   • CPort 443 is already used by another service like SSL VPNCorrect
   • DPort 443 is reserved solely for FortiGuard licensing traffic
   ✓ Correct answer: C

   Both the administrative GUI and the SSL VPN web portal can default to TCP port 443. When both services need to be reachable on the same interface, an administrator commonly moves one of them, often the GUI, to an alternate port such as 8443, to avoid a port conflict between the two services.

   Why the other options are wrong

   • ACertificate based GUI login works fine on port 443; the port number itself does not affect certificate authentication.
   • BHigh Availability cluster formation does not require the administrative HTTPS port to be changed to 8443.
   • DPort 443 is not reserved exclusively for FortiGuard traffic; FortiGuard uses its own dedicated services and ports separate from admin GUI access.
2. Question 2Deployment and system configuration

   What does the DHCP lease time setting on a FortiGate DHCP server control?

   • AHow long a client may use its assigned address before renewingCorrect
   • BHow many MAC addresses may be reserved at the same time
   • CHow often the DHCP server synchronizes with an NTP server
   • DHow long the device waits before answering a discover message
   ✓ Correct answer: A

   Lease time defines the period a client is allowed to use an assigned IP address before it must renew the lease with the DHCP server or risk losing that address. Shorter lease times cause more frequent renewal traffic, while longer lease times reduce it.

   Why the other options are wrong

   • BThe number of reservations that can be configured is not limited or controlled by the lease time setting.
   • CNTP synchronization is unrelated to the DHCP server and is not governed by the lease time value.
   • DThere is no deliberate delay built into answering DHCP discover messages controlled by the lease time setting.
3. Question 3Firewall policies and authenticationSelect all that apply

   Which two statements correctly describe combining source NAT with a VIP based destination address in the same FortiGate firewall policy? (Choose two.)

   • AA single policy can perform source NAT and reference a VIP as the destination address at the same timeCorrect
   • BEnabling the policy's NAT option applies source address translation in addition to the VIP's own destination translationCorrect
   • CReferencing a VIP as the destination address forces the policy's action to be set to deny
   • DA policy that references a VIP as the destination address can only be used for traffic arriving from the internet
   ✓ Correct answer: A, B

   There is nothing that prevents a firewall policy from both enabling source NAT and referencing a VIP as its destination address, allowing a single session to have its source and destination addresses translated at the same time, such as in a hairpin scenario. When the NAT option is enabled on such a policy, the source address translation happens in addition to, and independently of, the destination translation the VIP already provides. A VIP based destination address is not restricted to internet originated traffic, and it never forces the policy action to deny, since the policy must accept the traffic for the VIP's translation to be useful.

   Why the other options are wrong

   • CA policy referencing a VIP must be set to accept for the session to be permitted and translated; forcing a deny action would make the VIP configuration pointless.
   • DVIP based destination addresses are also used in internal to internal hairpin scenarios and other cases, not only for traffic arriving from the internet.
4. Question 4Firewall policies and authentication

   Which local password policy setting notifies a user ahead of time that their password is about to expire?

   • AThe expiration warning period settingCorrect
   • BRestriction on reusing old passwords
   • CRequired character composition ruleset
   • DMinimum password length requirement
   ✓ Correct answer: A

   FortiGate's password policy can be configured with a warning period, measured in days before the expiration date, during which the user is notified to change their password proactively. This works alongside the expiration setting itself, giving users time to update credentials before being locked out. Minimum length, reuse restriction, and character composition govern password strength and history, not advance expiration notices.

   Why the other options are wrong

   • BReuse restriction prevents recycling old passwords, it is unrelated to advance expiration notices.
   • CCharacter composition requirements dictate what characters a password must contain, not when a warning is issued.
   • DMinimum length controls how long a password must be, it does not provide an expiration warning.
5. Question 5VPNs

   A network administrator wants remote employees to reach a few internal web applications using only a browser, with no client software installed on their laptops. Which SSL VPN mode meets this requirement?

   • AWeb mode, which renders portal bookmarks in a browserCorrect
   • BSite to site mode, which connects two office gateways
   • CTunnel mode, which installs a virtual network adapter
   • DIPsec dialup mode, which relies on a separate IKE client
   ✓ Correct answer: A

   SSL VPN web mode is clientless: after logging in over HTTPS, the user is presented with a portal containing bookmarks to internal resources, all rendered inside the browser. Because no virtual adapter or client agent is required, it is ideal for occasional access from unmanaged devices. Tunnel mode, by contrast, needs FortiClient or the built-in SSL VPN client to establish network-layer connectivity.

   Why the other options are wrong

   • BSite to site mode links two FortiGate devices or networks together and is not used for individual remote user browser access.
   • CTunnel mode gives full network-layer access via a virtual adapter and needs FortiClient or the built-in tunnel client, not just a browser.
   • DIPsec dialup mode is a different VPN technology using IKE negotiation and requires an IPsec client, not an SSL browser session.
6. Question 6Content inspection

   Which characteristic is unique to proxy-based antivirus inspection compared to flow-based inspection?

   • AIt cannot be selected within an antivirus profile in current FortiOS versions
   • BIt only scans traffic that is already listed on an external malware block list
   • CIt relies exclusively on the IPS engine to pattern-match traffic in real time
   • DIt buffers the entire file on the FortiGate before releasing it to the recipientCorrect
   ✓ Correct answer: D

   Proxy-based inspection reassembles and holds the complete file on the FortiGate before releasing it to the recipient, allowing more thorough analysis and features such as content disarm and reconstruction. This full buffering is what distinguishes it from the single-pass flow-based method.

   Why the other options are wrong

   • AProxy-based is a selectable inspection mode in antivirus profiles alongside flow-based inspection.
   • BProxy-based inspection scans all applicable traffic, not just files already on a block list.
   • CReal-time IPS-engine pattern matching without full buffering describes flow-based inspection, not proxy-based.
7. Question 7Routing

   Which SD-WAN rule strategy repeatedly measures each eligible member against a chosen quality indicator, such as latency, jitter, or packet loss, and steers new sessions to whichever member currently scores best?

   • ALowest Cost (SLA), which always uses the cheapest member that still meets its SLA
   • BMaximize Bandwidth (SLA), which proportionally spreads sessions across compliant members
   • CManual, which always uses the same administrator ranked member unless it fails
   • DBest Quality, which dynamically selects the top performing member for the chosen metricCorrect
   ✓ Correct answer: D

   Best Quality continuously compares all eligible members using the selected quality measure and forwards new sessions to the interface that is currently performing best on that measure. Manual instead relies on a fixed preference order, Lowest Cost (SLA) optimizes for cost among compliant links, and Maximize Bandwidth (SLA) distributes load across multiple links rather than concentrating on a single best performer.

   Why the other options are wrong

   • ALowest Cost (SLA) optimizes for expense among compliant members, not for the best measured quality.
   • BMaximize Bandwidth (SLA) spreads sessions across several members rather than picking a single top performer.
   • CManual relies on a fixed administrator ranked order and does not continuously re-evaluate quality.
8. Question 8Routing

   An administrator wants existing static routes to be advertised to OSPF neighbors. What should be enabled in the OSPF configuration?

   • ARedistribution of OSPF routes into the static table
   • BRedistribution of static routes into the OSPF processCorrect
   • CA prefix list that matches the local OSPF area only
   • DA link monitor watching that same static gateway
   ✓ Correct answer: B

   To share existing static routes with an OSPF domain, the administrator enables redistribute static under the router ospf configuration, optionally combined with a route map to control which routes and attributes are advertised.

   Why the other options are wrong

   • AThis describes the reverse direction, taking OSPF routes and installing them as static entries, not advertising static routes into OSPF.
   • CA prefix list can filter which routes are redistributed but does not itself perform the redistribution.
   • DLink monitor only probes gateway reachability; it does not advertise routes into OSPF.
9. Question 9Deployment and system configuration

   Which logging destination is a Fortinet hosted cloud service that lets a FortiGate send logs off box for storage and viewing without deploying separate logging hardware or a virtual appliance?

   • AFortiCloudCorrect
   • BFortiAnalyzer
   • CLocal disk
   • DSyslog server
   ✓ Correct answer: A

   FortiCloud lets a FortiGate forward its logs to a Fortinet managed cloud service tied to device registration, providing storage and reporting without requiring the customer to deploy a dedicated FortiAnalyzer appliance or virtual machine.

   Why the other options are wrong

   • BFortiAnalyzer is a separate Fortinet appliance or virtual machine that the organization must deploy and manage itself.
   • CLocal disk logging stores logs on the FortiGate's own internal storage, not in a cloud service.
   • DA syslog server is typically a self managed third party or open source platform, not a Fortinet hosted service.
10. Question 10Content inspection

    FortiGate cannot reach the FortiGuard rating servers because of an upstream connectivity issue. How does web filtering typically behave for URLs that cannot be rated during the outage?

    • AThey fall under the profile's configured Unrated category actionCorrect
    • BAll traffic on the firewall policy is blocked until it returns
    • CFortiGate switches every category's action to Block automatically
    • DWeb filtering is disabled and traffic bypasses it entirely
    ✓ Correct answer: A

    FortiGuard's category list includes a built-in Unrated category for sites it cannot classify, including cases where the rating lookup fails because the rating servers are unreachable. FortiGate applies whatever action the administrator configured for Unrated, commonly Allow or Monitor by default, rather than blocking all traffic, disabling the feature, or forcing every category to Block.

    Why the other options are wrong

    • BOnly the Unrated category's action applies; unrelated traffic keeps working normally.
    • CFortiGate does not change every category's configured action during an outage.
    • DThe web filter profile stays active; it does not disable itself during an outage.

Who this Fortinet NSE 4 - FortiOS Administrator practice exam is for

This practice set is for anyone preparing for the Fortinet NSE 4 - FortiOS Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Fortinet NSE 4 - FortiOS Administrator practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Fortinet NSE 4 - FortiOS Administrator exam.

Related Security resources

• Fortinet NSE 4 - FortiOS Administrator study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Fortinet Secure Networking (FortiGate) practice examRelated
• ISACA CISA practice examRelated
• ISACA CISM practice examRelated

Fortinet NSE 4 - FortiOS Administrator practice exam FAQ