NSE4 Practice Test 12 — 15 Questions

Question 1

A FortiGate has a firewall policy with NAT enabled using an IP pool of type 'Fixed Port Range'. The pool range is 203.0.113.10-203.0.113.20 with port range 10000-20000. A user initiates a connection to an external server. Which of the following describes how the FortiGate will assign the source address and port?

Accepted Answer

The FortiGate assigns a fixed IP and port mapping based on the original source IP and port, so the same internal host always gets the same public IP and port range. Fixed Port Range NAT (also known as NAT with fixed port range) creates a deterministic mapping between an internal host's source IP and port and a specific public IP and port range from the pool. This ensures that the same internal host always receives the same public IP and a dedicated port range (10000-20000 in this case), which is essential for protocols that require consistent source addressing, such as SIP or H.323. The FortiGate does not round-robin, randomly assign, or sequentially assign ports; it uses a hash of the original source IP to select the fixed public IP and port range.

Answer

The FortiGate uses the pool IPs in round-robin and assigns the same port number as the original source port

Answer

The FortiGate randomly selects an IP from the pool and a random port from 10000-20000 for each session

Answer

The FortiGate uses the first available IP in the pool and assigns a port sequentially from 10000 upward

Question 2

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Accepted Answer

Define a traffic shaper object with the desired bandwidth limits. Option A is correct because a traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Answer

Enable SD-WAN on the FortiGate

Answer

Configure Central NAT to translate the source IP

Question 3

A company wants to allow FTP (TCP ports 20-21) from their internal network (192.168.1.0/24) to a specific external server (203.0.113.50). They also need to inspect FTP traffic for viruses. What should the admin configure?

Accepted Answer

Create a policy from internal to external with service FTP and enable antivirus. FTP inspection requires an explicit proxy policy for FTP or enabling FTP inspection in the security profile. The simplest is to create a policy allowing FTP and apply an antivirus profile.

Answer

Configure an explicit proxy policy for FTP and apply antivirus

Answer

Enable NAT on the policy and use a custom service for FTP

Answer

Use a policy with service ALL and rely on the antivirus profile

Question 4

A company has a FortiGate with two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to ensure that traffic from a specific internal server (10.0.1.100) destined to the internet always exits via port2, while all other traffic uses port1. Which feature should the admin configure on the firewall policy for that server?

Accepted Answer

Enable policy-based routing on the policy and specify port2 as the egress interface. Policy-based routing (PBR) allows you to override the routing table for specific traffic based on criteria such as source IP, destination, or application. By enabling PBR on the firewall policy for server 10.0.1.100 and specifying port2 as the egress interface, the admin ensures that all traffic from that server exits via port2, while the routing table continues to direct all other traffic via port1. This is the correct approach because PBR operates at the policy level, not the routing table level, giving granular control over traffic path selection.

Answer

Create a VIP to redirect the traffic to port2

Answer

Configure a static route with a higher distance for port2

Answer

Set the outgoing interface to port2 in the firewall policy

Question 5

An admin needs to configure a FortiGate to allow multiple internal servers to be accessible from the internet using the same public IP but different ports. For example, internal server A (192.168.1.10:80) should be reachable via 203.0.113.10:8080, and internal server B (192.168.1.20:443) via 203.0.113.10:8443. Which TWO configuration steps are required?

Accepted Answer

Create two separate VIPs, one for each server, and add them to a VIP group. Option A is correct because each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

Answer

Disable NAT on the policy to preserve the source IP

Answer

Configure Central SNAT to translate the source IP

Answer

Create a single VIP with port forwarding that maps multiple ports

Question 6

Which of the following statements about FortiGate policy lookup order is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is used. FortiGate uses a top-down sequential search for policy matching. When a packet arrives, the firewall starts at the top of the policy list and evaluates each policy in order until it finds one where all configured criteria (source, destination, service, schedule, etc.) match. The first matching policy is then applied, and no further policies are checked. This is the fundamental behavior of FortiGate's firewall policy lookup.

Answer

Policies are evaluated based on a priority number assigned to each policy

Answer

Policies are evaluated from bottom to top, and the last matching policy is used

Answer

Policies are evaluated randomly to balance load

Question 7

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

Accepted Answer

Policy ID 2 because it matches the source and service. FortiGate uses first-match logic. Policy ID 1 matches source 10.0.0.0/24 and service HTTP. Policy ID 2 matches source 10.0.1.0/24 and service ALL. The host 10.0.1.50 is in 10.0.1.0/24 but also in 10.0.0.0/24? No, 10.0.1.0/24 is not a subset of 10.0.0.0/24. Actually 10.0.0.0/24 covers 10.0.0.0-10.0.0.255, so 10.0.1.50 is not in that range. Therefore policy ID 1 does not match (source mismatch). Policy ID 2 matches because source 10.0.1.0/24 includes 10.0.1.50 and service ALL includes HTTP. So answer B.

Answer

Both policies, and the traffic is load-balanced

Answer

No policy matches, traffic is denied by implicit deny

Answer

Policy ID 1 because it is first in order and matches the service HTTP

Question 8

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

Accepted Answer

Change the IP pool type to 'Fixed Port Range'. The IP pool overload mode uses dynamic port allocation, which can break applications needing a consistent port range. The 'Fixed Port Range' option in the IP pool configuration assigns a fixed port range to each session, preserving the original source port or a fixed range. Option A is correct.

Answer

Disable NAT and use policy-based routing

Answer

Use Central SNAT instead of policy-based NAT

Answer

Enable 'Preserve Source Port' in the firewall policy

Question 9

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy A's schedule 'WorkHours' is not active (Saturday 8 AM is outside Mon-Fri 9-17). Policy B's schedule 'Always' is always active. Since Policy A does not match due to schedule, Policy B matches and allows the traffic. Option B is correct.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 10

An administrator needs to configure destination NAT for multiple internal servers using a single public IP address by differentiating based on destination port. The public IP 203.0.113.10 should map to: (A) 10.0.0.1:80 for HTTP, (B) 10.0.0.2:443 for HTTPS. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a VIP for HTTP mapping port 80 to 10.0.0.1. A VIP group with multiple VIPs each having a different port mapping allows this. Alternatively, separate VIPs with different public ports can be used. Option A and C are correct.

Answer

Create an IP pool for the public IP

Answer

Configure policy-based routing for each server

Answer

Use Central SNAT with port forwarding

Question 11

A FortiGate has a central SNAT policy that translates internal users to a single IP pool address. The admin wants specific traffic (e.g., from a particular subnet) to use a different IP pool. What is the correct approach?

Accepted Answer

Create a new central SNAT policy with the specific subnet as source and place it above the existing policy. Central SNAT policies are evaluated in order; they can include source and destination criteria. To override the general policy, a more specific policy must be placed above it. Dynamic IP pools cannot be used in policy-based NAT for central SNAT.

Answer

Create a policy-based NAT rule with the specific subnet and place it above the central SNAT policy

Answer

Use VIP to translate the source address

Answer

Modify the existing central SNAT policy to use a dynamic IP pool

Question 12

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

Accepted Answer

FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually. FortiGate does not automatically tear down existing sessions when a policy is deleted. Sessions continue until they expire naturally or are explicitly cleared. The admin must use 'diagnose sys session clear' to remove them.

Answer

The sessions are using UDP protocol, which has a longer timeout

Answer

The sessions are protected by a different policy that still exists

Answer

The sessions are in a different VDOM

Question 13

An admin runs the command 'diagnose firewall iprope list 100000' and sees the following output:
id=2000000000 action=deny flag=0x0 src-interface=any dst-interface=any proto=0 src-addr=0.0.0.0-255.255.255.255 dst-addr=0.0.0.0-255.255.255.255
What does this entry represent?

Accepted Answer

The implicit deny policy at the end of the policy list. The ID 2000000000 is reserved for the implicit deny policy. It matches all traffic from any interface to any interface and denies. This is the last rule checked.

Answer

A loopback interface policy

Answer

A user-created deny policy that blocks all traffic

Answer

A NAT policy that translates all addresses

Question 14

An organization needs to restrict internet access for employees to business hours only (Monday to Friday, 8:00 to 18:00). Which object should the admin use in the firewall policy?

Accepted Answer

A schedule object with recurring time. Schedule objects define time ranges. The admin should create a recurring schedule for weekdays during business hours and apply it to the policy.

Answer

A time-range object

Answer

An on-time schedule

Answer

A calendar object

Question 15

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

Accepted Answer

The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy. Firewall policies are matched from top to bottom. If a higher-priority policy (with a lower policy ID) matches the traffic and denies or applies different NAT, it will be processed before the intended allow policy. In this case, an FQDN-based policy above the allow policy matches the destination IP, causing the traffic to be handled by that policy instead.

Answer

The destination NAT on the allow policy is misconfigured

Answer

The FortiGate's DNS server is not resolving the FQDN correctly

Answer

The antivirus profile on the allow policy is blocking the website