NSE4 Firewall Policies and NAT — 40 Questions

Question 1

A network administrator configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to a web server (172.16.1.10). Users on the 10.0.0.0/8 network cannot access the web server, but other internal users can. The administrator checks the policy list and sees the policy is enabled and in the correct position. What is the most likely cause?

Accepted Answer

The firewall does not have a route to the 10.0.0.0/8 network. The most likely cause is that the firewall does not have a route to the 10.0.0.0/8 network. Even though the policy is enabled and correctly positioned, the firewall must have a return route to the source network (10.0.0.0/8) for the web server's response traffic to reach the users. Without this route, the firewall drops the return packets, causing connectivity failure for those specific users.

Answer

The policy is placed below a deny-all policy

Answer

NAT is not configured on the policy

Answer

The policy is disabled

Question 2

An organization wants to authenticate VPN users using an LDAP server. They configure an LDAP server object and a user group. However, users are unable to authenticate. The administrator checks the logs and sees 'authentication failed' errors. What is the most common misconfiguration?

Accepted Answer

The LDAP server bind DN or password is incorrect. The most common misconfiguration when LDAP authentication fails is an incorrect bind DN or password. The FortiGate uses the bind DN to authenticate to the LDAP server before it can search for users; if these credentials are wrong, the LDAP server rejects the bind request, resulting in an 'authentication failed' log entry. This error occurs even before user credentials are checked, making it a frequent root cause.

Answer

The user group is not configured with the correct members

Answer

The LDAP server uses SSL/TLS but the FortiGate is not configured for it

Answer

The LDAP server is not reachable from the FortiGate

Question 3

A FortiGate administrator needs to allow SMTP traffic from the internal network to an external mail server. The internal network uses source NAT to the external interface IP. Which firewall policy configuration is correct?

Accepted Answer

Policy: source internal, destination external, service SMTP, enable NAT. Option A is correct because SMTP traffic from the internal network to an external mail server requires source NAT (masquerading) to translate private source IPs to the FortiGate's external interface IP. This ensures return traffic is routed back correctly. The default SMTP service uses TCP port 25, and enabling NAT on the policy is the standard configuration for outbound traffic to the internet.

Answer

Policy: source internal, destination external, service SMTP, disable NAT

Answer

Policy: source internal, destination external, service SMTP (port 587), enable NAT

Answer

Policy: source internal, destination external, service SMTP (UDP), enable NAT

Question 4

Refer to the exhibit. A FortiGate has this policy configured. Traffic from 10.0.1.0/24 to 192.168.1.10 on HTTP is being logged as allowed. However, users report that they cannot access the web server. What is the most likely issue?

Accepted Answer

NAT is not enabled on the policy. The correct answer is A because the policy allows traffic from 10.0.1.0/24 to 192.168.1.10 on HTTP, but without NAT enabled, the return traffic from the web server will be sent directly to the source IP (10.0.1.x) without going through the FortiGate. Since the source is a private IP, the server cannot route back to it unless the FortiGate performs source NAT (SNAT) to translate the source IP to its own interface IP. Without NAT, the session is logged as allowed but the client never receives the server's response, resulting in a connectivity failure.

Answer

The policy is placed below a deny policy

Answer

The service is set to HTTP but the server uses HTTPS

Answer

The policy is disabled

Question 5

Refer to the exhibit. An administrator runs 'diagnose firewall auth list' and sees two authenticated users. The firewall policy requires authentication for HTTP traffic from 10.0.0.0/24 to 192.168.1.10. User 'jsmith' has been idle for 20 minutes, but the authentication session is still active. The idle timeout is set to 30 minutes. What will happen after 30 minutes of inactivity?

Accepted Answer

The authentication session will expire, and the user must re-authenticate for new traffic. Option D is correct because the authentication idle timeout of 30 minutes governs the authentication session, not the firewall session. Once the user 'jsmith' has been idle for 30 minutes, the authentication session expires. Any new HTTP traffic from 10.0.0.0/24 to 192.168.1.10 will then require re-authentication, as the firewall policy enforces authentication for that traffic. The existing firewall session may persist briefly, but it will not allow new traffic without a valid authentication entry.

Answer

The authentication session will remain active because the firewall session is still valid

Answer

The user will be automatically re-authenticated without prompting

Answer

The firewall session will be torn down immediately

Question 6

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

Accepted Answer

The user's IP address is not in the source address range of the policy. Option C is correct because even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Answer

The user is not a member of the FSSO group

Answer

The FSSO collector agent is not running

Answer

The FortiGate is not polling the domain controller

Question 7

An administrator wants to create a firewall policy that blocks all traffic from a specific IP address (10.0.0.99) to the internet, but allows all other traffic. Which policy configuration is correct?

Accepted Answer

Create a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface, then an allow policy for all other traffic. Option A is correct because FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. By placing a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface first, traffic from that IP is blocked. Then a subsequent allow policy for all other traffic (source 'all') permits everything else, ensuring the specific IP is blocked while all other traffic is allowed.

Answer

Create an allow policy for source 'all' and then a deny policy for 10.0.0.99

Answer

Use a local-in policy to block the IP

Answer

Create a policy that denies all traffic from 10.0.0.99 to any destination

Question 8

Which TWO statements about firewall policy authentication are correct?

Accepted Answer

Authentication can be configured on a per-policy basis. Option C is correct because FortiGate firewall policies allow authentication to be enabled on a per-policy basis using the 'set auth-on-demand' or 'set auth-cert' options, which enforce user authentication before traffic is processed. This granular control enables administrators to apply authentication only to specific policies, such as those controlling access to sensitive resources, without affecting other traffic flows.

Answer

Authentication cannot be used with FSSO

Answer

Authentication is only supported for inbound traffic

Answer

Authentication is performed after the traffic is allowed by the policy

Question 9

Which THREE conditions must be met for a firewall policy with FSSO authentication to work correctly?

Accepted Answer

The FortiGate must be able to communicate with the domain controller. Option A is correct because FSSO (Fortinet Single Sign-On) relies on the FortiGate communicating with the domain controller to retrieve user login events via NetAPI or WMI. Without this communication, the FortiGate cannot map user identities to IP addresses, which is essential for FSSO-based authentication in firewall policies.

Answer

The user's IP address must be in the destination address range of the policy

Answer

The user must be authenticated to the FortiGate locally

Question 10

Refer to the exhibit. An administrator configures the policies as shown. Traffic from 10.0.0.0/8 to the internet on HTTP is denied. What is the most likely reason?

Accepted Answer

The Deny-All policy is placed above the Allow-HTTP policy. In FortiGate firewall policies, the first matching policy is applied to traffic. The Deny-All policy is placed above the Allow-HTTP policy, so traffic from 10.0.0.0/8 to the internet on HTTP matches the Deny-All policy first and is denied before reaching the Allow-HTTP policy. This is a classic policy ordering issue.

Answer

The Allow-HTTP policy uses service HTTP but the traffic uses HTTPS

Answer

The Allow-HTTP policy has the wrong source interface

Answer

The Allow-HTTP policy is disabled

Question 11

A FortiGate administrator wants to restrict access to a sensitive server (10.0.0.100) such that only users who authenticate via LDAP can access it. Which firewall policy configuration is required?

Accepted Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP, set groups "LDAP-Users". Option C is correct because it combines the required firewall policy elements: enabling authentication, setting the authentication type to LDAP, and restricting access to members of the LDAP group 'LDAP-Users'. This ensures that only users who successfully authenticate via LDAP and belong to the specified group can reach the sensitive server at 10.0.0.100. Without the group restriction, any authenticated LDAP user could access the server, which does not meet the requirement of restricting access to only authenticated users.

Answer

Policy: source any, destination 10.0.0.100, service any, action accept

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP

Answer

Policy: source any, destination 10.0.0.100, service any, action accept, enable FSSO authentication

Question 12

A company has a FortiGate 100F with two ISPs (ISP1 and ISP2) for load balancing. They use SD-WAN to direct traffic. The firewall has a policy that allows HTTP and HTTPS traffic from internal users (10.0.0.0/8) to the internet. The policy uses FSSO authentication with an Active Directory domain controller. Recently, users on the 10.0.1.0/24 subnet report that they are prompted for authentication repeatedly, even though they are domain-joined and logged in. Users on other subnets do not have this issue. The administrator checks the FSSO configuration and sees that the collector agent is running and the FortiGate is receiving login events. The FortiGate's policy is configured with source address 10.0.0.0/8 and FSSO group 'Domain Users'. The administrator also notices that the FortiGate's SD-WAN rules are configured to use ISP1 for traffic from 10.0.0.0/8 except for traffic from 10.0.1.0/24, which uses ISP2. The FortiGate's FSSO collector agent is configured to listen on the IP address 192.168.1.1, which is the IP of the interface connected to ISP1. What is the most likely cause of the authentication issue?

Accepted Answer

The FSSO collector agent is listening on an IP that is not reachable from the 10.0.1.0/24 subnet due to SD-WAN routing. The FSSO collector agent listens on 192.168.1.1, which is the IP of the interface connected to ISP1. SD-WAN rules send traffic from 10.0.1.0/24 via ISP2, so authentication packets from these users (e.g., to the collector agent) may be routed through ISP2 and never reach the collector agent at 192.168.1.1, causing repeated authentication prompts. This is a classic SD-WAN routing asymmetry issue where FSSO traffic does not follow the expected path.

Answer

The FSSO group 'Domain Users' does not include the affected users

Answer

The SD-WAN rule for 10.0.1.0/24 is misconfigured and drops authentication traffic

Answer

The domain controller is not reachable from the FortiGate

Question 13

A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?

Accepted Answer

A security profile applied to the policy is blocking the HTTPS traffic.. The correct answer is C because security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.

Answer

NAT is disabled, so the server cannot send replies back.

Answer

The policy order is incorrect; a deny policy above is blocking traffic.

Answer

The schedule is configured incorrectly and the policy is inactive during the current time.

Question 14

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Accepted Answer

The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.. Policy 1 is an implicit allow-all rule that matches all traffic before policy 2 is evaluated. Since FortiGate processes policies in sequential order from top to bottom, the SSH connection to 203.0.113.10 matches policy 1 first, which permits all services, including SSH. Therefore, the connection succeeds without ever reaching policy 2.

Answer

The SSH connection will succeed because policy 2 is evaluated first.

Answer

The SSH connection will be blocked because policy 2 explicitly denies SSH.

Answer

The SSH connection will be blocked because policy 1 does not include SSH service specifically.

Question 15

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

Accepted Answer

The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.. Option B is correct because when the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Answer

The SD-WAN zone does not include the backup interface wan2.

Answer

The static routes have the same distance, so failover does not occur.

Answer

The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.

Question 16

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Question 17

Drag and drop the steps to configure SSL VPN on FortiGate into the correct order.

Question 18

Match each Fortinet product to its primary role.

Question 19

Match each FortiGate logging destination to its description.

Question 20

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Accepted Answer

Create a traffic shaping policy and apply it to the firewall policy. Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

Answer

Increase the bandwidth of the internet link

Answer

Configure policy-based routing for HTTPS traffic

Answer

Enable QoS on the outgoing interface