NSE4 Firewall Policies and NAT — 25 Questions

Question 1

A network administrator configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to a web server (172.16.1.10). Users on the 10.0.0.0/8 network cannot access the web server, but other internal users can. The administrator checks the policy list and sees the policy is enabled and in the correct position. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall does not have a route to the 10.0.0.0/8 network. The most likely cause is that the firewall does not have a route to the 10.0.0.0/8 network. Even though the policy is enabled and correctly positioned, the firewall must have a return route to the source network (10.0.0.0/8) for the web server's response traffic to reach the users. Without this route, the firewall drops the return packets, causing connectivity failure for those specific users.

Answer

The policy is placed below a deny-all policy

Answer

NAT is not configured on the policy

Answer

The policy is disabled

Question 2

An organization wants to authenticate VPN users using an LDAP server. They configure an LDAP server object and a user group. However, users are unable to authenticate. The administrator checks the logs and sees 'authentication failed' errors. What is the most common misconfiguration?

Accepted Answer

The LDAP server bind DN or password is incorrect. The most common misconfiguration when LDAP authentication fails is an incorrect bind DN or password. The FortiGate uses the bind DN to authenticate to the LDAP server before it can search for users; if these credentials are wrong, the LDAP server rejects the bind request, resulting in an 'authentication failed' log entry. This error occurs even before user credentials are checked, making it a frequent root cause.

Answer

The user group is not configured with the correct members

Answer

The LDAP server uses SSL/TLS but the FortiGate is not configured for it

Answer

The LDAP server is not reachable from the FortiGate

Question 3

A FortiGate administrator needs to allow SMTP traffic from the internal network to an external mail server. The internal network uses source NAT to the external interface IP. Which firewall policy configuration is correct?

Accepted Answer

Policy: source internal, destination external, service SMTP, enable NAT. SMTP traffic from the internal network to an external mail server requires source NAT (masquerading) to translate private source IPs to the FortiGate's external interface IP. This ensures return traffic is routed back correctly. The default SMTP service uses TCP port 25, and enabling NAT on the policy is the standard configuration for outbound traffic to the internet.

Answer

Policy: source internal, destination external, service SMTP, disable NAT

Answer

Policy: source internal, destination external, service SMTP (port 587), enable NAT

Answer

Policy: source internal, destination external, service SMTP (UDP), enable NAT

Question 4

Refer to the exhibit. A FortiGate has this policy configured. Traffic from 10.0.1.0/24 to 192.168.1.10 on HTTP is being logged as allowed. However, users report that they cannot access the web server. What is the most likely issue?

Accepted Answer

The service is set to HTTP but the server uses HTTPS. The policy only allows HTTP (port 80), but the web server is configured to use HTTPS (port 443). The FortiGate logs the HTTP traffic as allowed, but the server does not respond on port 80 because it only listens on HTTPS, so the client never receives a response. To resolve this, the policy service must be changed to HTTPS or include both ports. NAT is not normally required when routing between two internal subnets that are directly connected to the FortiGate.

Answer

NAT is not enabled on the policy

Answer

The policy is placed below a deny policy

Answer

The policy is disabled

Question 5

Refer to the exhibit. An administrator runs 'diagnose firewall auth list' and sees two authenticated users. The firewall policy requires authentication for HTTP traffic from 10.0.0.0/24 to 192.168.1.10. User 'jsmith' has been idle for 20 minutes, but the authentication session is still active. The idle timeout is set to 30 minutes. What will happen after 30 minutes of inactivity?

Accepted Answer

The authentication session will expire, and the user must re-authenticate for new traffic. The authentication idle timeout of 30 minutes governs the authentication session, not the firewall session. Once the user 'jsmith' has been idle for 30 minutes, the authentication session expires. Any new HTTP traffic from 10.0.0.0/24 to 192.168.1.10 will then require re-authentication, as the firewall policy enforces authentication for that traffic. The existing firewall session may persist briefly, but it will not allow new traffic without a valid authentication entry.

Answer

The authentication session will remain active because the firewall session is still valid

Answer

The user will be automatically re-authenticated without prompting

Answer

The firewall session will be torn down immediately

Question 6

An administrator wants to create a firewall policy that blocks all traffic from a specific IP address (10.0.0.99) to the internet, but allows all other traffic. Which policy configuration is correct?

Accepted Answer

Create a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface, then an allow policy for all other traffic. FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. By placing a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface first, traffic from that IP is blocked. Then a subsequent allow policy for all other traffic (source 'all') permits everything else, ensuring the specific IP is blocked while all other traffic is allowed.

Answer

Create an allow policy for source 'all' and then a deny policy for 10.0.0.99

Answer

Use a local-in policy to block the IP

Answer

Create a policy that denies all traffic from 10.0.0.99 to any destination

Question 7

Which TWO statements about firewall policy authentication are correct?

Accepted Answer

Authentication can be configured on a per-policy basis. FortiGate firewall policies allow authentication to be enabled on a per-policy basis using the 'set auth-on-demand' or 'set auth-cert' options, which enforce user authentication before traffic is processed. This granular control enables administrators to apply authentication only to specific policies, such as those controlling access to sensitive resources, without affecting other traffic flows.

Answer

Authentication cannot be used with FSSO

Answer

Authentication is only supported for inbound traffic

Answer

Authentication is performed after the traffic is allowed by the policy

Question 8

Which THREE conditions must be met for a firewall policy with FSSO authentication to work correctly?

Accepted Answer

The FortiGate must be able to communicate with the domain controller. FSSO (Fortinet Single Sign-On) relies on the FortiGate communicating with the domain controller to retrieve user login events via NetAPI or WMI. Without this communication, the FortiGate cannot map user identities to IP addresses, which is essential for FSSO-based authentication in firewall policies.

Answer

The user's IP address must be in the destination address range of the policy

Answer

The user must be authenticated to the FortiGate locally

Question 9

Refer to the exhibit. An administrator configures the policies as shown. Traffic from 10.0.0.0/8 to the internet on HTTP is denied. What is the most likely reason?

Accepted Answer

The Deny-All policy is placed above the Allow-HTTP policy. In FortiGate firewall policies, the first matching policy is applied to traffic. The Deny-All policy is placed above the Allow-HTTP policy, so traffic from 10.0.0.0/8 to the internet on HTTP matches the Deny-All policy first and is denied before reaching the Allow-HTTP policy. This is a classic policy ordering issue.

Answer

The Allow-HTTP policy uses service HTTP but the traffic uses HTTPS

Answer

The Allow-HTTP policy has the wrong source interface

Answer

The Allow-HTTP policy is disabled

Question 10

A FortiGate administrator wants to restrict access to a sensitive server (10.0.0.100) such that only users who authenticate via LDAP can access it. Which firewall policy configuration is required?

Accepted Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP, set groups "LDAP-Users". It combines the required firewall policy elements: enabling authentication, setting the authentication type to LDAP, and restricting access to members of the LDAP group 'LDAP-Users'. This ensures that only users who successfully authenticate via LDAP and belong to the specified group can reach the sensitive server at 10.0.0.100. Without the group restriction, any authenticated LDAP user could access the server, which does not meet the requirement of restricting access to only authenticated users.

Answer

Policy: source any, destination 10.0.0.100, service any, action accept

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable FSSO authentication

Question 11

A company has a FortiGate 100F with two ISPs (ISP1 and ISP2) for load balancing. They use SD-WAN to direct traffic. The firewall has a policy that allows HTTP and HTTPS traffic from internal users (10.0.0.0/8) to the internet. The policy uses FSSO authentication with an Active Directory domain controller. Recently, users on the 10.0.1.0/24 subnet report that they are prompted for authentication repeatedly, even though they are domain-joined and logged in. Users on other subnets do not have this issue. The administrator checks the FSSO configuration and sees that the collector agent is running and the FortiGate is receiving login events. The FortiGate's policy is configured with source address 10.0.0.0/8 and FSSO group 'Domain Users'. The administrator also notices that the FortiGate's SD-WAN rules are configured to use ISP1 for traffic from 10.0.0.0/8 except for traffic from 10.0.1.0/24, which uses ISP2. The FortiGate's FSSO collector agent is configured to listen on the IP address 192.168.1.1, which is the IP of the interface connected to ISP1. What is the most likely cause of the authentication issue?

Accepted Answer

The FSSO collector agent is listening on an IP that is not reachable from the 10.0.1.0/24 subnet due to SD-WAN routing. The FSSO collector agent listens on 192.168.1.1, which is the IP of the interface connected to ISP1. SD-WAN rules send traffic from 10.0.1.0/24 via ISP2, so authentication packets from these users (e.g., to the collector agent) may be routed through ISP2 and never reach the collector agent at 192.168.1.1, causing repeated authentication prompts. This is a classic SD-WAN routing asymmetry issue where FSSO traffic does not follow the expected path.

Answer

The FSSO group 'Domain Users' does not include the affected users

Answer

The SD-WAN rule for 10.0.1.0/24 is misconfigured and drops authentication traffic

Answer

The domain controller is not reachable from the FortiGate

Question 12

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Accepted Answer

The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.. Policy 1 is an implicit allow-all rule that matches all traffic before policy 2 is evaluated. Since FortiGate processes policies in sequential order from top to bottom, the SSH connection to 203.0.113.10 matches policy 1 first, which permits all services, including SSH. Therefore, the connection succeeds without ever reaching policy 2.

Answer

The SSH connection will succeed because policy 2 is evaluated first.

Answer

The SSH connection will be blocked because policy 2 explicitly denies SSH.

Answer

The SSH connection will be blocked because policy 1 does not include SSH service specifically.

Question 13

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Accepted Answer

1. Select source and destination interfaces, 2. Select source and destination addresses, 3. Select service (HTTP), 4. Set action to accept and enable logging. Firewall policies require defining interfaces, source/destination addresses, and services before enabling.

Answer

1. Select source and destination addresses, 2. Select source and destination interfaces, 3. Select service (HTTP), 4. Set action to accept and enable logging

Answer

1. Select service (HTTP), 2. Select source and destination interfaces, 3. Select source and destination addresses, 4. Set action to accept and enable logging

Answer

1. Set action to accept and enable logging, 2. Select source and destination interfaces, 3. Select source and destination addresses, 4. Select service (HTTP)

Question 14

Drag and drop the steps to configure SSL VPN on FortiGate into the correct order.

Accepted Answer

Step 1: Create user group, Step 2: Configure SSL VPN portal, Step 3: Configure SSL VPN settings, Step 4: Configure firewall policy, Step 5: Enable SSL VPN service. SSL VPN requires user group, portal, settings, firewall policy, and enabling the service.

Answer

Step 1: Create user group, Step 2: Configure SSL VPN settings, Step 3: Configure SSL VPN portal, Step 4: Configure firewall policy, Step 5: Enable SSL VPN service

Answer

Step 1: Create user group, Step 2: Configure SSL VPN portal, Step 3: Configure firewall policy, Step 4: Configure SSL VPN settings, Step 5: Enable SSL VPN service

Answer

Step 1: Enable SSL VPN service, Step 2: Create user group, Step 3: Configure SSL VPN portal, Step 4: Configure SSL VPN settings, Step 5: Configure firewall policy

Question 15

Match each Fortinet product to its primary role.

Accepted Answer

FortiGate: Provides next-generation firewall and security gateway capabilities.. FortiGate is the NGFW, FortiManager handles centralized management, FortiAnalyzer provides logging/reporting, and FortiSandbox performs advanced threat detection. Common confusions include swapping management with firewall roles or logging with threat detection.

Answer

FortiGate: Centralized management and orchestration.

Answer

FortiManager: Advanced threat detection through behavioral analysis.

Question 16

Match each FortiGate logging destination to its description.

Accepted Answer

Local memory: Logs are stored on the FortiGate's hard disk or memory.. The correct matches: Local memory (local storage), Syslog (remote syslog server), FortiAnalyzer (centralized analysis), FortiCloud (cloud logging). Common confusions involve swapping Syslog with FortiAnalyzer or misdescribing local storage.

Answer

Syslog: Logs are sent to FortiAnalyzer for logging and analysis.

Answer

Local memory: Logs are sent to an external server.

Question 17

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Accepted Answer

Create a traffic shaping policy and apply it to the firewall policy. Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

Answer

Increase the bandwidth of the internet link

Answer

Configure policy-based routing for HTTPS traffic

Answer

Enable QoS on the outgoing interface

Question 18

A FortiGate admin wants to create a firewall policy that allows traffic from the internal network to the internet. The source is a subnet 192.168.1.0/24, and the destination is 'all'. The admin wants to apply NAT to hide internal IPs. Which NAT configuration is BEST suited for this scenario?

Accepted Answer

Enable 'NAT' on the firewall policy and use the outgoing interface address. Enabling NAT on the firewall policy with the outgoing interface address is the standard method for source NAT (masquerading) in FortiGate. This configuration translates all internal source IPs (192.168.1.0/24) to the single IP address of the egress interface, hiding the internal subnet from the internet. It is the simplest and most efficient approach for typical internet-bound traffic, requiring no additional objects like IP pools or VIPs.

Answer

Configure a VIP for source NAT

Answer

Use policy-based routing to send traffic through a NAT device

Answer

Create a one-to-one IP pool and apply it to the policy

Question 19

An admin notices that a firewall policy allowing inbound HTTPS to a server is not matching traffic. The policy has source set to 'all', destination to the server's IP, and service to HTTPS. The admin checks the policy list and sees that policy ID 1 matches the traffic. What is the MOST likely reason the intended policy (ID 10) is not matching?

Accepted Answer

Policy ID 1 has a higher priority and matches before policy ID 10. Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

Answer

The firewall policy is disabled

Answer

The service object for HTTPS is misconfigured in policy ID 10

Answer

The destination address is incorrect in policy ID 10

Question 20

Which of the following is a valid address object type in FortiGate that can be used to match traffic based on the domain name of the destination?

Accepted Answer

FQDN. FortiGate supports FQDN (Fully Qualified Domain Name) address objects, which allow firewall policies to match traffic based on the destination domain name. When an FQDN object is used, FortiGate performs DNS resolution to obtain the IP addresses and updates the policy dynamically, enabling domain-based traffic filtering.

Answer

Wildcard FQDN

Answer

Subnet

Answer

Geography