NSE4 Firewall Policies and NAT Practice Test 10 — 15 Questions

Question 1

A FortiGate has a policy that allows traffic from 10.0.0.0/8 to any destination with NAT enabled using an IP pool 'Pool1' (203.0.113.10-203.0.113.20). The admin notices that internal servers using fixed ports (e.g., SIP) are failing. What is the likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IP pool is configured with overload (PAT), which changes source ports. When an IP pool is configured with overload (PAT), the FortiGate translates the source IP address and also changes the source port to a random high port. For protocols like SIP that rely on fixed source ports (e.g., UDP 5060), this port remapping breaks the application because the SIP server expects traffic from a specific port. Option D correctly identifies this as the root cause.

Answer

The policy order is incorrect

Answer

The IP pool is configured with one-to-one NAT

Answer

The IP pool uses fixed port range, which should work

Question 2

An admin needs to create a firewall policy that matches traffic based on the destination being a specific geographic location (e.g., France). Which address object should be used?

Accepted Answer

A geography object. A geography object is specifically designed to match traffic based on geographic location (country, continent, or region) using the GeoIP database integrated into FortiOS. When a firewall policy needs to allow or deny traffic to or from a specific country like France, a geography object is the correct address object type because it dynamically resolves IP ranges assigned to that country by IANA/RIRs.

Answer

An FQDN object

Answer

A subnet object

Answer

A wildcard FQDN object

Question 3

A FortiGate admin is troubleshooting an issue where internal users cannot access a specific external service over TCP/443. The admin confirms that the firewall policy allows HTTP/HTTPS. Which TWO CLI commands should the admin use to diagnose? (Choose two.)

Accepted Answer

diagnose firewall iprope list. 'diagnose firewall iprope list' displays the kernel's internal firewall rule chains, allowing the admin to verify whether the policy lookup is matching the expected rule for TCP/443 traffic. This command helps confirm that the policy is installed and active in the kernel, which is essential for troubleshooting policy-based access issues.

Answer

diagnose sys session filter dport 443

Answer

get system performance status

Answer

execute ping 8.8.8.8

Question 4

An organization wants to implement least privilege for firewall policies. Which THREE best practices should be followed? (Choose three.)

Accepted Answer

Specify the exact services required (e.g., TCP/443, TCP/22). Specifying exact services (e.g., TCP/443, TCP/22) enforces least privilege by allowing only the necessary protocols and ports, reducing the attack surface. In FortiGate firewall policies, this is configured under the 'Service' field, where you can select predefined services or create custom ones to match specific TCP/UDP port numbers. This prevents overly permissive rules that could expose services like SMB (TCP/445) or RDP (TCP/3389) unintentionally.

Answer

Use a single schedule covering all days

Answer

Use any any for source and destination to simplify management

Question 5

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

Accepted Answer

The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy. The FQDN object in a policy above the allow policy resolved to an IP that includes 203.0.113.5. FortiGate performs policy lookup based on cached IP addresses for FQDN objects. Since the FQDN object's cached IP now matches the destination IP of the website, traffic hits the higher-priority policy (which likely denies or otherwise blocks the traffic) before reaching the allow policy. This is why users cannot access the website despite the allow policy existing.

Answer

The destination NAT on the allow policy is misconfigured

Answer

The FortiGate's DNS server is not resolving the FQDN correctly

Answer

The antivirus profile on the allow policy is blocking the website

Question 6

A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?

Accepted Answer

Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic. When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.

Answer

The FortiGate is using a proxy server that caches different results for different users

Answer

The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent

Answer

The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing

Question 7

A FortiGate administrator wants to allow traffic from the internal network to a specific external server using its fully qualified domain name (FQDN) rather than an IP address, because the server's IP changes frequently. Which type of address object should the administrator create for the destination?

Accepted Answer

FQDN object. FQDN object. FortiGate FQDN objects resolve domain names to IP addresses dynamically, allowing the firewall to update the destination IP automatically when the server's IP changes. This is ideal for scenarios where the external server uses a fully qualified domain name and its IP address is not static.

Answer

Subnet object

Answer

Wildcard FQDN object

Answer

Geography object

Question 8

An administrator is creating firewall policies for a FortiGate that separates the internal network (10.0.1.0/24) from a DMZ (192.168.1.0/24). The goal is to allow HTTP traffic from the internal network to the DMZ web server (192.168.1.10) but deny all other traffic. What is the recommended security posture for the implicit deny policy?

Accepted Answer

Rely on the implicit deny policy at the end of the policy list, which will block all traffic not explicitly allowed. The implicit deny policy is a default, hidden policy at the end of the FortiGate policy list that denies all traffic not explicitly allowed by preceding policies. Since the administrator wants to allow only HTTP traffic from internal to the DMZ web server and deny all other traffic, relying on the implicit deny is the correct and recommended security posture. It automatically blocks everything else without requiring manual configuration, ensuring no unintended traffic is permitted.

Answer

Set the allow policy to also deny all other traffic using security profiles

Answer

Disable the implicit deny policy and create a catch-all deny policy

Answer

Create an explicit deny policy with logging enabled before the allow policy

Question 9

A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?

Accepted Answer

No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions. When a FortiGate performs destination NAT (DNAT) via a VIP for inbound traffic, it automatically creates a session entry that includes the reverse NAT mapping. For return traffic from the internal server, the FortiGate uses this session to perform source NAT (SNAT) back to the original public IP (203.0.113.10). This is called 'implicit reverse NAT' and requires no additional configuration; the session state ensures the reply packets are correctly translated and forwarded to the external client.

Answer

Create a second VIP for the return traffic

Answer

Add a policy from DMZ to WAN allowing the internal server to reply

Answer

Configure static routing on the internal server to route through the FortiGate

Question 10

An administrator needs to block access to specific websites based on their FQDN (e.g., *.example.com). The FortiGate should match the destination domain regardless of the IP address the domain resolves to. Which type of address object should the admin use in the firewall policy destination?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.

Answer

Geography object

Answer

Subnet object

Answer

FQDN object

Question 11

A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?

Accepted Answer

Policy ID 1 because it is the first matching policy in the list. Policy ID 1 is correct because FortiGate uses a sequential, first-match policy evaluation model. Traffic from 10.0.1.10 to 203.0.113.5 matches the source and destination of Policy ID 1 exactly, and since it appears first in the policy list, it is applied immediately. Once a match is found, no further policies are evaluated, even if a later policy (like Policy ID 2) also matches.

Answer

Both policies will be applied because the traffic matches both

Answer

Policy ID 2 because it has a broader destination and is more inclusive

Answer

Neither policy; implicit deny will block the traffic

Question 12

An admin configures a firewall policy with a schedule object that restricts access to Monday to Friday from 9:00 to 17:00. A user attempts to connect on Saturday at 10:00. Which of the following best describes what happens?

Accepted Answer

The FortiGate skips this policy and tries the next policy; if no match, implicit deny blocks the traffic. When a firewall policy includes a schedule, the policy is only active during the specified time. Outside that schedule, the policy is skipped entirely, and the FortiGate evaluates the next policy in the list. If no subsequent policy matches, the implicit deny rule at the end blocks the traffic. Therefore, on Saturday at 10:00, the policy is skipped, and if no other policy allows it, the traffic is denied.

Answer

The traffic is allowed because the schedule is only used for logging

Answer

The traffic is allowed because the schedule is optional

Answer

The traffic is denied because the schedule is not valid

Question 13

An admin needs to configure a FortiGate to allow multiple internal servers to be accessible from the internet using the same public IP but different ports. For example, internal server A (192.168.1.10:80) should be reachable via 203.0.113.10:8080, and internal server B (192.168.1.20:443) via 203.0.113.10:8443. Which TWO configuration steps are required?

Accepted Answer

Create two separate VIPs, one for each server, and add them to a VIP group. Each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

Answer

Disable NAT on the policy to preserve the source IP

Answer

Configure Central SNAT to translate the source IP

Answer

Create a single VIP with port forwarding that maps multiple ports

Question 14

A FortiGate admin is creating a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network. The admin wants to ensure that traffic is inspected by security profiles (antivirus, web filter). Which THREE of the following must be configured on the firewall policy to achieve this?

Accepted Answer

Set the action to ACCEPT. Setting the action to ACCEPT is mandatory for the firewall policy to allow traffic through. Without ACCEPT, the policy would deny traffic by default, preventing any inspection by security profiles. The ACCEPT action enables the FortiGate to process the traffic through the configured security profiles.

Answer

Set the schedule to always

Answer

Enable NAT on the policy

Question 15

A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?

Accepted Answer

Policy 5 has a higher priority because it is above policy 10 in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. Since policy 5 with source 'all' and destination 'all' is listed above policy 10, traffic from 10.0.1.0/24 to the internet matches policy 5 first, preventing policy 10 from ever being evaluated. This is the most likely reason the intended policy is not being matched.

Answer

Policy 10 is configured with an expired security certificate

Answer

The source address object 'internal_subnet' is incorrectly configured

Answer

Policy 10 has a schedule that is not active