NSE4 Practice Test 11 — 15 Questions

Question 1

A FortiGate is configured with multiple policies. The first policy allows traffic from 10.0.0.0/8 to any destination. The second policy denies traffic from 10.0.1.0/24 to any destination. What happens when a packet from 10.0.1.5 to 8.8.8.8 arrives?

Accepted Answer

The packet is allowed by the first policy. FortiGate firewall policies are evaluated in sequential order from top to bottom. The first policy matches source 10.0.0.0/8, which includes 10.0.1.5, and allows the traffic to any destination. Since the packet matches this policy first, it is accepted and the second policy is never evaluated. Therefore, the packet is allowed by the first policy.

Answer

The packet is denied by implicit deny

Answer

The packet matches both policies and is allowed

Answer

The packet is denied by the second policy

Question 2

An administrator configures a firewall policy allowing traffic from the internal network to the internet with NAT enabled. Users report that some outbound connections fail intermittently. The administrator runs 'diagnose sys session list' and sees many sessions in 'proto_state=01' with a short TTL. What is the most likely cause?

Accepted Answer

The IP pool used for SNAT has exhausted its address range. The 'diagnose sys session list' output showing many sessions in 'proto_state=01' with a short TTL indicates that sessions are failing to establish properly. When the IP pool used for Source NAT (SNAT) exhausts its address range, new outbound connections cannot obtain a translated source IP, causing them to fail intermittently. This matches the symptom of intermittent failures as the pool becomes temporarily depleted.

Answer

The firewall policy has the wrong source interface

Answer

The destination port is blocked by an implicit deny rule

Answer

The antivirus profile is blocking the connections

Question 3

A FortiGate admin runs 'diagnose sys session filter src 10.0.0.10' and gets no output. What does this indicate?

Accepted Answer

The source IP 10.0.0.10 is not currently active in any session table. The 'diagnose sys session filter' command in FortiGate is used to filter and display active session entries in the session table. When the command 'diagnose sys session filter src 10.0.0.10' returns no output, it means that no session in the session table matches the source IP address 10.0.0.10, indicating that this IP is not currently involved in any active session. This does not imply the session table is full, a policy block, or a syntax error.

Answer

The session table is full

Answer

The firewall policy is blocking traffic from 10.0.0.10

Answer

The diagnose command syntax is incorrect

Question 4

A FortiGate admin needs to configure source NAT for traffic from the internal network (10.0.0.0/8) to the internet. The requirement is to translate all internal IPs to a range of public IPs (203.0.113.1-203.0.113.10) while preserving the source port for specific applications. Which TWO configurations can achieve this? (Choose two.)

Accepted Answer

Use a One-to-One IP Pool. Option A is correct because a One-to-One IP Pool maps each internal IP to a unique public IP from the range 203.0.113.1-203.0.113.10, preserving the original source port for each session. This meets the requirement to translate all internal IPs while keeping the source port unchanged for specific applications. The pool size (10 IPs) must be sufficient for the number of concurrent internal hosts.

Answer

Use a Dynamic IP Pool with Overload

Answer

Enable NAT on the policy without an IP pool

Answer

Configure Central SNAT with Overload

Question 5

A FortiGate admin needs to block all traffic from the 'Guest' VLAN (192.168.100.0/24) to the internal network (10.0.0.0/8) except for DNS traffic (UDP 53) to the internal DNS server at 10.0.0.10. Which TWO firewall policy configuration elements are required to achieve this? (Choose two.)

Accepted Answer

A firewall policy with source 'Guest' VLAN, destination 'Internal network', service 'ALL', action 'deny'. Option B is correct because a deny policy with source 'Guest' VLAN (192.168.100.0/24), destination 'Internal network' (10.0.0.0/8), and service 'ALL' will block all traffic from the Guest VLAN to the internal network. Option C is correct because an explicit accept policy for DNS (UDP 53) to the internal DNS server (10.0.0.10) must be placed before the deny policy, as FortiGate firewall policies are evaluated in order from top to bottom, and the first matching policy determines the action.

Answer

An address group for the internal DNS server

Answer

A traffic shaper to limit DNS traffic

Answer

A schedule object to apply the policies only during business hours

Question 6

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

Accepted Answer

Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ. Option B is correct because to allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Answer

Use policy-based routing to forward SSH traffic

Answer

Configure source NAT on the outbound policy from DMZ to WAN

Answer

Enable NAT on the WAN interface

Question 7

An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?

Accepted Answer

The destination in the firewall policy is set to the public IP directly instead of the VIP object. When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Answer

The VIP is configured with port forwarding disabled

Answer

The server's default gateway is not set to the FortiGate

Answer

The source NAT is not configured

Question 8

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 9

A FortiGate admin configures a VIP to map 203.0.113.10:80 to 10.0.1.10:8080. However, when external users connect to http://203.0.113.10, they receive a connection timeout. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The firewall policy's destination is set to the real server IP (10.0.1.10) instead of the VIP object. The most likely cause is that the destination port in the policy is not set to the mapped port (8080) or the VIP is not properly associated. The policy must reference the VIP as the destination address, and if the policy uses the original port 80 instead of the mapped port, it might not match correctly. But the typical issue is that the policy needs to have the VIP as the destination address, not the real server IP. Alternatively, the VIP configuration might be missing the port mapping. Option A is common: the policy destination is set to the real server IP instead of the VIP object.

Answer

The VIP is configured on the wrong interface

Answer

The source NAT is not configured

Answer

The internal server is not listening on port 8080

Question 10

Which of the following describes the implicit deny action in FortiGate firewall policies?

Accepted Answer

A default policy that denies all traffic unless explicitly allowed. The implicit deny is a default rule at the end of the policy list that denies all traffic not explicitly allowed. It cannot be moved or deleted.

Answer

A policy that is automatically created when the first policy is added

Answer

A policy that denies traffic based on the source IP

Answer

A policy that denies all traffic and can be moved to any position

Question 11

A FortiGate administrator needs to configure source NAT for a group of internal servers (10.0.1.100-10.0.1.110) so that each server uses a unique public IP from the range 203.0.113.20-203.0.113.30. The requirement is that each internal IP maps to a fixed external IP (one-to-one mapping) and not port overload. Which TWO settings should be configured in the IP Pool? (Choose two.)

Accepted Answer

External IP Range: 203.0.113.20-203.0.113.30. Option C is correct because the External IP Range must be set to 203.0.113.20-203.0.113.30 to define the pool of public IPs that will be mapped one-to-one to the internal servers. Option D is correct because Type: One-to-One ensures each internal IP is permanently mapped to a unique external IP, without port address translation (PAT), meeting the requirement of fixed one-to-one mapping.

Answer

Type: Overload

Answer

Enable 'Fixed Port Range'

Answer

Use Central SNAT instead of IP Pool

Question 12

A FortiGate is configured with policy-based NAT and multiple IP pools. The administrator wants traffic from the 192.168.1.0/24 subnet to use IP pool 'POOL1' (203.0.113.1-203.0.113.10) and traffic from 192.168.2.0/24 to use IP pool 'POOL2' (203.0.113.11-203.0.113.20). Which THREE steps are necessary?

Accepted Answer

Create two firewall policies, one for each subnet. Option A is correct because policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Answer

Configure a single firewall policy with both subnets in the source address group

Answer

Enable Central NAT and define two NAT policies

Question 13

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'duration=3600' and 'expire=3599', which directly indicate the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds. The 'proto=6' confirms TCP (protocol 6), and 'proto_state=01' indicates an established TCP session. This is a standard FortiGate session diagnostic display.

Answer

The session is experiencing packet loss

Answer

The session is a UDP connection

Answer

The session is blocked by a firewall policy

Question 14

A network admin configures a firewall policy allowing HTTP traffic from internal users to an external web server. The policy uses a service object 'HTTP' defined as TCP/80. However, users cannot reach the server. What is the MOST likely cause?

Accepted Answer

The external web server is using HTTPS (TCP/443) instead of HTTP. The service object 'HTTP' is defined as TCP/80, but HTTPS uses TCP/443. The web server is likely expecting HTTPS on TCP/443. The policy should allow TCP/443.

Answer

The source address object does not include the users' subnet

Answer

The policy order is wrong; the policy is placed after a deny-all policy

Answer

The interface is set to the wrong zone

Question 15

A FortiGate has a policy that allows traffic from 10.0.0.0/8 to any destination with NAT enabled using an IP pool 'Pool1' (203.0.113.10-203.0.113.20). The admin notices that internal servers using fixed ports (e.g., SIP) are failing. What is the likely cause?

Accepted Answer

The IP pool is configured with overload (PAT), which changes source ports. When an IP pool is configured with overload (PAT), the FortiGate translates the source IP address and also changes the source port to a random high port. For protocols like SIP that rely on fixed source ports (e.g., UDP 5060), this port remapping breaks the application because the SIP server expects traffic from a specific port. Option D correctly identifies this as the root cause.

Answer

The policy order is incorrect

Answer

The IP pool is configured with one-to-one NAT

Answer

The IP pool uses fixed port range, which should work