NSE4 Practice Test 16 — 15 Questions

Question 1

A FortiGate has policy-based NAT enabled. The admin wants to translate the source IP of internal users to the interface IP for internet traffic. The firewall policy has NAT enabled. However, traffic from the internal network to the internet shows the original source IP instead of the interface IP. What is the MOST likely reason?

Accepted Answer

Central NAT is enabled and overrides the per-policy NAT setting. Central NAT must be disabled for policy-based NAT to work. When central NAT is enabled, it overrides the per-policy NAT settings.

Answer

The destination is a VIP that disables NAT

Answer

The NGFW mode is set to profile-based

Answer

The policy is configured in proxy inspection mode

Question 2

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

Accepted Answer

The VIP does not have NAT reflection enabled. Without NAT reflection (also called hairpin NAT), traffic from internal users to the public IP goes out then comes back, but the firewall may not translate it correctly. The solution is to enable NAT reflection on the VIP.

Answer

The server is not responding to internal requests

Answer

The firewall policy for internal to VIP is missing

Answer

The VIP is configured on a different interface

Question 3

A FortiGate with multiple VDOMs has a policy that allows traffic from VDOM A to VDOM B. The admin notices that traffic from VDOM A to a specific server in VDOM B is being dropped. The session log shows 'deny by forward policy check'. What is the MOST likely cause?

Accepted Answer

The policy in VDOM B to allow traffic from VDOM A is missing or misconfigured. Inter-VDOM links require policies in both VDOMs: one in VDOM A for outgoing traffic, and one in VDOM B for incoming traffic. The error 'deny by forward policy check' indicates that the policy in the destination VDOM (VDOM B) is missing or denying the traffic.

Answer

The inter-VDOM link is down

Answer

NAT is required for inter-VDOM traffic

Answer

The source VDOM has exceeded its session limit

Question 4

An admin needs to configure NAT so that internal users (10.0.0.0/24) accessing the internet (any destination) are translated using an IP pool (203.0.113.10-203.0.113.20) with overload. The admin also needs to ensure that traffic from a specific server (10.0.0.100) always uses a fixed source port range (10000-20000) when translated. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a central SNAT rule for 10.0.0.0/24 using the IP pool with overload enabled. To achieve this, the admin must configure a central SNAT rule for the subnet with overload, and a separate central SNAT rule (or fixed port range) for the server using fixed port range. Alternatively, the server could have a policy-based NAT with fixed port range, but central SNAT is specified. The question implies using central SNAT for both.

Answer

Configure the IP pool with one-to-one NAT

Answer

Use policy-based NAT instead of central SNAT

Answer

Disable NAT on the firewall policy for the server

Question 5

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). Destination NAT (DNAT) is used to translate the destination IP of incoming traffic. Virtual IP (VIP) is the FortiGate object for DNAT. Option B is correct.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 6

A FortiGate administrator needs to block all traffic from a specific geographic region (country) from accessing the internal network. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. Geography-based address objects allow matching traffic based on the source IP's country. Option B is correct.

Answer

FQDN object

Answer

Wildcard FQDN object

Answer

Subnet object

Question 7

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. To apply traffic shaping, a traffic shaper must be created and then referenced in the firewall policy. Option A is correct.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit

Question 8

A FortiGate administrator is implementing a policy to allow outbound traffic from the internal network to the internet. The requirements are: (1) all traffic from internal users must be source NATed to the external interface IP, (2) traffic from a specific server must use a different public IP, (3) HTTP traffic must be shaped to 10 Mbps. Which THREE configuration elements should the administrator create? (Choose three.)

Accepted Answer

A traffic shaper for HTTP traffic. An IP pool for the specific server, a traffic shaper for HTTP, and firewall policies to apply them. Option B, C, and D are correct.

Answer

A VIP for the server

Answer

A policy-based routing rule for the server

Question 9

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

Accepted Answer

In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload. Policy-based NAT allows specifying a fixed IP address or IP pool for source NAT. The admin should configure the policy's NAT settings to use a specific IP pool or IP address.

Answer

Create a central SNAT policy with the source as the mail server and the translated IP as the desired address

Answer

Use a VIP with port forwarding to translate the source

Answer

Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool

Question 10

An admin is configuring a firewall policy to allow FTP traffic from a client to a server. The server is behind a VIP that translates public IP 203.0.113.10 port 21 to private IP 10.0.0.10 port 21. The admin wants to ensure the FTP data channel works correctly. Which TWO additional configurations are required? (Choose two.)

Accepted Answer

Enable FTP ALG on the firewall policy. FTP uses separate control and data connections. FortiGate's FTP ALG (application layer gateway) or session helper is needed to inspect FTP traffic and handle dynamic data ports. Additionally, for VIP, the policy must allow the appropriate services, and the ALG must be enabled.

Answer

Enable NAT on the policy for return traffic

Answer

Create a separate policy for the data channel

Answer

Configure a service object for FTP data port (TCP 20)

Question 11

An admin creates a firewall policy allowing HTTP traffic from internal users to the internet. Users complain that they cannot access HTTPS websites. The admin checks and sees that the policy only has HTTP service. What is the BEST course of action to allow HTTPS while maintaining security?

Accepted Answer

Add the HTTPS service to the existing policy. The simplest and most secure approach is to add the HTTPS service to the existing policy, as it is a common web protocol.

Answer

Create a new policy above the existing one with HTTPS service

Answer

Use a security policy that automatically adds HTTPS

Answer

Change the HTTP service to ALL services

Question 12

You run the following CLI command on a FortiGate:
# diagnose debug flow filter saddr 192.168.1.10
# diagnose debug flow show function enable
# diagnose debug enable
You then initiate a ping from 192.168.1.10 to 8.8.8.8. The output shows 'no matching policy'. What does this indicate?

Accepted Answer

The traffic is dropped by the implicit deny rule. The 'no matching policy' message indicates that the traffic did not match any firewall policy, likely because there is no policy allowing the traffic from that source to the destination.

Answer

The traffic is being NAT'd but not logged

Answer

The debug filter is incorrectly configured

Answer

There is a routing issue preventing the traffic

Question 13

What is the purpose of a schedule object in a firewall policy?

Accepted Answer

To specify the time of day when the policy is effective. Schedule objects define time ranges during which the policy is active. This allows time-based access control.

Answer

To set the bandwidth limit for the policy

Answer

To prioritize traffic based on application

Answer

To limit the number of concurrent sessions

Question 14

An admin is troubleshooting why traffic from VLAN 10 to the internet is not being translated by a Central SNAT rule. The Central SNAT rule is configured with source interface 'port2.10', destination interface 'wan1', source address '192.168.10.0/24', and IP pool 'pool1'. The firewall policy for internet access has NAT enabled but no IP pool attached. Which THREE steps should the admin take to resolve the issue? (Choose three.)

Accepted Answer

Verify that the firewall policy does not have an IP pool configured. Central SNAT rules require that the firewall policy has NAT enabled but no IP pool attached. If the policy has an IP pool, Central SNAT is bypassed. Also, the Central SNAT rule must match the traffic's source interface and destination interface. Common issues: policy has an IP pool attached, or the policy's NAT is disabled, or the Central SNAT rule's interface is wrong.

Answer

Ensure the Central SNAT rule's IP pool is configured with overload enabled

Answer

Disable NAT on the firewall policy to force Central SNAT usage

Question 15

Which of the following is a characteristic of policy-based NAT on a FortiGate?

Accepted Answer

NAT is configured directly in the firewall policy using the 'set nat' option. Policy-based NAT uses the 'set nat' command in a firewall policy to enable source NAT, while Central NAT uses a separate NAT policy table.

Answer

NAT is configured separately from firewall policies using Central NAT rules

Answer

NAT is applied to all traffic regardless of policy

Answer

NAT can only be used with IP pools