NSE4 Firewall Policies and NAT Practice Test 10 — 15 Questions

Question 1

An administrator wants to limit the bandwidth for a specific application (e.g., YouTube) across all users. The administrator creates a traffic shaper and applies it to the firewall policy. What additional configuration is needed to identify YouTube traffic?

Accepted Answer

Apply an Application Control profile to the policy. Application control profiles identify applications by signature. After identification, traffic shapers can be applied to limit bandwidth.

Answer

Enable deep inspection and create a URL filter

Answer

Create a custom service object for YouTube

Answer

Use a geography object to block non-local traffic

Question 2

A FortiGate administrator needs to configure source NAT for a group of internal servers (10.0.1.100-10.0.1.110) so that each server uses a unique public IP from the range 203.0.113.20-203.0.113.30. The requirement is that each internal IP maps to a fixed external IP (one-to-one mapping) and not port overload. Which TWO settings should be configured in the IP Pool? (Choose two.)

Accepted Answer

External IP Range: 203.0.113.20-203.0.113.30. Option C is correct because the External IP Range must be set to 203.0.113.20-203.0.113.30 to define the pool of public IPs that will be mapped one-to-one to the internal servers. Option D is correct because Type: One-to-One ensures each internal IP is permanently mapped to a unique external IP, without port address translation (PAT), meeting the requirement of fixed one-to-one mapping.

Answer

Type: Overload

Answer

Enable 'Fixed Port Range'

Answer

Use Central SNAT instead of IP Pool

Question 3

An administrator notices that VoIP traffic (SIP) is not being inspected by the IPS profile applied to the firewall policy. The administrator suspects the traffic is being accelerated by NPU offloading. Which TWO actions can prevent NPU offloading for SIP traffic to ensure IPS inspection? (Choose two.)

Accepted Answer

Change the policy inspection mode to 'Proxy-Based'. Disabling NPU offloading per policy can be done by configuring the policy to use 'Proxy-Based' inspection or by disabling 'capwap' and 'offload' options in the firewall policy advanced settings. Also, enabling SSL inspection forces software processing.

Answer

Enable 'Set SNAT' on the policy

Answer

Enable 'Deep Inspection' on the policy

Answer

Create a separate VIP for SIP

Question 4

Which THREE of the following are valid address object types in FortiGate? (Choose three.)

Accepted Answer

Subnet. A is correct because a Subnet address object in FortiGate defines a range of IP addresses using a network address and subnet mask (e.g., 192.168.1.0/24). This is one of the fundamental object types used in firewall policies to match traffic based on source or destination IP ranges.

Answer

MAC address

Answer

Wildcard

Question 5

A network administrator has configured a firewall policy allowing traffic from the internal network (10.0.0.0/8) to the internet. Users report that some websites are not loading. The administrator runs 'diagnose firewall iprope list 100000' and sees the policy listed with a hit count of zero. What is the MOST likely cause?

Accepted Answer

The policy is placed below a more specific or broader policy that matches the same traffic. The hit count of zero indicates the policy is not being matched. Policy order matters; if a policy above this one matches the traffic, this policy will never be used. The administrator should check if a policy above is matching the traffic first.

Answer

The source interface or destination interface is incorrectly configured

Answer

The policy has a schedule that does not match the current time

Answer

The FortiGate has a routing issue preventing traffic from reaching the internet

Question 6

Which of the following statements about FortiGate policy lookup order is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first matching policy is used. FortiGate uses a top-down sequential search for policy matching. When a packet arrives, the firewall starts at the top of the policy list and evaluates each policy in order until it finds one where all configured criteria (source, destination, service, schedule, etc.) match. The first matching policy is then applied, and no further policies are checked. This is the fundamental behavior of FortiGate's firewall policy lookup.

Answer

Policies are evaluated based on a priority number assigned to each policy

Answer

Policies are evaluated from bottom to top, and the last matching policy is used

Answer

Policies are evaluated randomly to balance load

Question 7

An administrator needs to configure a firewall policy that allows internal users to access a specific web server on the internet using its domain name. The web server's IP address may change. Which type of address object should be used as the destination in the policy?

Accepted Answer

FQDN address object. An FQDN address object resolves the domain name to IP addresses dynamically. This allows the policy to adapt to IP changes, unlike a subnet object.

Answer

IP Range object that covers the entire public IP space

Answer

Subnet object with the current IP address

Answer

Geography object

Question 8

You run the following command on a FortiGate: 'diagnose sys session filter dport 443' and see:
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate?

Accepted Answer

The session is in SYN_SENT state and the three-way handshake is not yet complete. The output shows `proto=6`, which indicates TCP, and `proto_state=01`, which corresponds to the TCP state SYN_SENT (0x01). This means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `duration=3600` and `expire=3599` indicate the session has been tracked for 3600 seconds and will expire in 3599 seconds, but the state confirms it is not yet established.

Answer

The session is using UDP and the duration is 3600 seconds

Answer

The session is being torn down and will expire in 3599 seconds

Answer

The session is fully established and has been active for 3600 seconds

Question 9

A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?

Accepted Answer

Central SNAT with a dynamic IP pool using overload. IP Pool with Overload (PAT) allows many private IPs to be translated to a single public IP using port address translation. This is the most common configuration for internet access.

Answer

Policy-based NAT with a fixed port range

Answer

One-to-one NAT IP Pool

Answer

Virtual IP (VIP) with port forwarding

Question 10

An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?

Accepted Answer

Policy-based routing (PBR) configured with a policy matching the destination and service. Policy-based routing (PBR) allows traffic matching a policy to be routed to a specific next-hop or interface, overriding the regular routing table. This is the correct approach for selective routing.

Answer

Central NAT policy to force the traffic out of WAN2

Answer

Static route with a higher priority for WAN2 to 203.0.113.0/24

Answer

SD-WAN with a strategy of 'Best Quality'

Question 11

What is the purpose of the 'implicit deny' policy on a FortiGate?

Accepted Answer

It denies all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a default, last-resort rule that denies all traffic not matching any explicit firewall policy. It ensures that any packet that does not meet the source, destination, service, or schedule criteria of a configured policy is dropped, enforcing a default-deny security posture. This behavior is fundamental to stateful firewall operation and prevents unauthorized traffic from traversing the device.

Answer

It allows traffic from trusted internal networks

Answer

It logs all traffic that is denied

Answer

It allows all traffic that matches no other policy

Question 12

An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?

Accepted Answer

The destination in the firewall policy is set to the public IP directly instead of the VIP object. When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Answer

The VIP is configured with port forwarding disabled

Answer

The server's default gateway is not set to the FortiGate

Answer

The source NAT is not configured

Question 13

You execute 'get firewall policy 5' and see the following output:
policyid=5
name="test"
status=enable
schedule="always"
logtraffic=all
What does 'logtraffic=all' mean?

Accepted Answer

All traffic matching the policy will be logged, regardless of action. Option D is correct because 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

Answer

Only the first packet of each session will be logged

Answer

Only traffic that triggers a security profile will be logged

Answer

Only traffic that is denied by the policy will be logged

Question 14

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. Geography address objects allow matching based on country (or region) using the IP geolocation database. This is useful for geo-blocking.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 15

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

Accepted Answer

Move the allow policy above the deny policy. Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).

Answer

Add a new policy with a higher ID

Answer

Disable the deny policy

Answer

Delete the deny policy