NSE4 Practice Test 13 — 15 Questions

Question 1

An admin runs 'diagnose sys session filter saddr 10.0.1.10' and 'diagnose sys session list' to check sessions from a specific internal host. The output shows multiple sessions with destination IP 203.0.113.50 using source port 12345. The admin then checks the firewall policy and sees that the policy uses an IP pool for source NAT. What does the source port 12345 indicate?

Accepted Answer

This is the translated source port after PAT. When using IP pool with overload (PAT), the FortiGate will perform port translation. The source port in the session list is the translated port (the port number after NAT). The original source port (from the internal host) is not shown in the session list; the output shows the post-NAT source port.

Answer

The IP pool is configured for one-to-one NAT (no port translation)

Answer

The IP pool is using port range 12345-12345

Answer

The internal host's original source port is 12345

Question 2

A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?

Accepted Answer

No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions. When traffic arrives at the VIP, the destination is translated to the internal server IP. The internal server sends its response with source IP 192.168.1.10, which the FortiGate must translate back to the VIP IP (203.0.113.10) before sending to the external user. This reverse translation happens automatically if the policy is correctly configured. However, if the internal server needs to initiate outbound connections (not just respond), additional policies may be needed. The question asks about the response: no additional step is needed because the FortiGate automatically performs reverse NAT for sessions initiated through the VIP.

Answer

Create a second VIP for the return traffic

Answer

Add a policy from DMZ to WAN allowing the internal server to reply

Answer

Configure static routing on the internal server to route through the FortiGate

Question 3

A FortiGate admin is troubleshooting an issue where traffic from a specific internal host (10.0.1.50) to the internet is not being NATed as expected. The firewall policy has NAT enabled with an IP pool of type Overload. Which TWO conditions could cause the traffic to bypass the IP pool?

Accepted Answer

A policy with a lower policy ID matches the traffic and has NAT enabled with a different IP pool or no pool. Traffic may bypass the IP pool if a higher-priority policy matches first (policy ordering) or if the IP pool is incorrectly configured (e.g., the pool's source filter does not include the internal host).

Answer

The firewall policy's NAT setting is set to 'disable'

Answer

The IP pool is configured for one-to-one NAT

Answer

The internal host is using a non-standard source port

Question 4

A FortiGate admin is creating a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network. The admin wants to ensure that traffic is inspected by security profiles (antivirus, web filter). Which THREE of the following must be configured on the firewall policy to achieve this?

Accepted Answer

Set the action to ACCEPT. To inspect traffic with security profiles, the admin must enable inspection mode (proxy-based or flow-based), select the appropriate security profiles, and ensure that traffic matches the policy (correct source/destination). The service object for HTTP and HTTPS is needed to match the traffic.

Answer

Set the schedule to always

Answer

Enable NAT on the policy

Question 5

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

Accepted Answer

Move the allow policy above the deny policy. Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).

Answer

Add a new policy with a higher ID

Answer

Disable the deny policy

Answer

Delete the deny policy

Question 6

An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?

Accepted Answer

Traffic shaper (e.g., shared or per-IP shaper). To apply traffic shaping, you need a traffic shaper (defining bandwidth limits), an application control profile to identify YouTube traffic, and a firewall policy that applies both the shaper and the profile.

Answer

A DNS filter to block YouTube

Answer

A static route for YouTube's IP range

Question 7

A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?

Accepted Answer

Policy ID 1 because it is the first matching policy in the list. Firewall policies are evaluated from top to bottom (lowest policy ID first). Policy ID 1 has a more specific destination (203.0.113.0/24) than Policy ID 2 (all). The traffic matches Policy ID 1 because it is the first policy that matches all criteria (source, destination). Since policy ID 1 is evaluated first and its destination includes 203.0.113.5, it will be used.

Answer

Both policies will be applied because the traffic matches both

Answer

Policy ID 2 because it has a broader destination and is more inclusive

Answer

Neither policy; implicit deny will block the traffic

Question 8

A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?

Accepted Answer

Policy 5 has a higher priority because it is above policy 10 in the policy list. FortiGate matches firewall policies from top to bottom. Policy 5 is higher in the policy list order than policy 10, so traffic matches policy 5 first and never reaches policy 10.

Answer

Policy 10 is configured with an expired security certificate

Answer

The source address object 'internal_subnet' is incorrectly configured

Answer

Policy 10 has a schedule that is not active

Question 9

An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?

Accepted Answer

The destination interface should be the internal interface, not wan1. For inbound DNAT, the firewall policy must have the incoming interface as source interface and internal interface as destination interface. If both are set to wan1, the traffic is not forwarded to the internal network.

Answer

The policy needs NAT enabled

Answer

The source interface should be the internal interface

Answer

The VIP is not associated with the policy

Question 10

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

Accepted Answer

Central SNAT overrides policy-based NAT. Central SNAT takes precedence over policy-based NAT when both are configured. The Central SNAT rule might be incorrect or missing, causing unexpected behavior.

Answer

Both NAT methods are applied, causing double NAT

Answer

The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict

Answer

Policy-based NAT always overrides Central SNAT

Question 11

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When 'NAT' is enabled on a firewall policy, FortiGate performs source NAT using the egress interface IP by default. Option A correctly states this default behavior for outbound traffic.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 12

A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?

Accepted Answer

An inter-VDOM policy on the inter-VDOM link interface. An inter-VDOM link policy (or simply a policy between VDOMs) must be configured, often using a physical or logical inter-VDOM link. Option D correctly identifies the need for an inter-VDOM policy.

Answer

A policy using a virtual wire pair

Answer

A regular intra-VDOM policy on VDOM A with destination interface port2

Answer

A policy on each VDOM with the same source/destination

Question 13

A FortiGate administrator is troubleshooting a connectivity issue where internal clients cannot reach a public web server. The administrator has confirmed that routing is correct and there are no security profiles blocking traffic. Which TWO debugging steps should the administrator take? (Choose two.)

Accepted Answer

Run a packet capture on the internal interface. Checking the firewall policy list helps identify if an allow policy exists and its order. Running a packet capture helps see if traffic reaches the FortiGate and is being matched. Option A and D are correct.

Answer

Reboot the FortiGate

Answer

Change the NAT mode to Central SNAT

Answer

Disable the antivirus profile

Question 14

A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?

Accepted Answer

The new policy is placed below the older policy in the policy list. FortiGate evaluates policies from top to bottom. The new policy must be placed above the broader policy to be matched first. By default, new policies are added at the bottom.

Answer

The source address object 'Internal_Net' has an incorrect subnet mask

Answer

The new policy is disabled

Answer

Traffic shaping is applied to the new policy and is interfering

Question 15

A FortiGate policy allows traffic from the internal network to a DMZ server. The admin wants to limit access to only specific hours. Which object type should be used in the policy?

Accepted Answer

Schedule. Schedule objects define time ranges (recurring or one-time) during which a policy is effective. They are applied directly in the firewall policy.

Answer

Address group

Answer

Service group

Answer

Traffic shaper