NSE4 Firewall Policies and NAT Practice Test 10 — 15 Questions

Question 1

Which statement about the implicit deny policy on a FortiGate is true?

Accepted Answer

It is always at the bottom of the policy list and denies all unmatched traffic. The implicit deny policy is a built-in, non-configurable security policy that resides at the very bottom of the FortiGate policy list. It automatically denies all traffic that does not match any explicit user-defined policy, ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It is a user-configurable policy that can be deleted

Answer

It allows traffic that matches no other policy

Answer

It can be moved to a different position in the policy list

Question 2

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol number 6), 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means the session will expire in 3599 seconds. This is a standard session table entry from the FortiGate 'diagnose sys session' command, showing an established TCP session with its remaining lifetime.

Answer

The session is a UDP session for DNS

Answer

The session is an ICMP echo request

Answer

The session is blocked by a firewall policy

Question 3

An admin wants to ensure that VoIP traffic (UDP ports 5060-5061) from the internal network to the internet is prioritized over other traffic when the WAN link is congested. Which feature should be configured on the firewall policy?

Accepted Answer

Traffic shaping policy with a guaranteed bandwidth allocation and high priority. A traffic shaping policy with guaranteed bandwidth allocation and high priority ensures that VoIP traffic (UDP ports 5060-5061) receives the necessary bandwidth and is prioritized over other traffic during WAN congestion. Traffic shaping policies on FortiGate allow you to set guaranteed bandwidth, maximum bandwidth, and priority levels, which directly address congestion by reserving resources for critical traffic like VoIP.

Answer

Enable NAT on the policy

Answer

QoS marking only (DSCP)

Answer

Configure a security profile with QoS settings

Question 4

A FortiGate admin configures an IP pool with type 'Fixed Port Range' to translate source IPs from 192.168.1.0/24 to 203.0.113.0/28 using port range 10000-20000. After applying the IP pool to a policy, some users cannot establish connections while others work. What is the MOST likely cause?

Accepted Answer

The IP pool's port range is exhausted because the number of internal hosts exceeds the number of available port ranges. Fixed Port Range NAT uses a one-to-one mapping of source IPs to unique port ranges. With a /28 pool (16 IPs) and port range 10000-20000 (10,001 ports), each internal host gets a dedicated port block. If more than 16 concurrent internal hosts attempt NAT, the pool is exhausted, causing connection failures for excess hosts. This matches the symptom where some users work and others do not.

Answer

The internal subnet is using RFC 1918 addresses that cannot be NATed

Answer

The IP pool is configured with overload enabled, causing conflicts

Answer

The firewall policy has NAT disabled

Question 5

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy must specify the destination address of the traffic, which is the web server at 192.168.2.10. Without an address object for this server, the policy cannot match the destination IP of the VPN users' HTTP requests.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 6

An admin is troubleshooting why traffic from VLAN 10 to the internet is not being translated by a Central SNAT rule. The Central SNAT rule is configured with source interface 'port2.10', destination interface 'wan1', source address '192.168.10.0/24', and IP pool 'pool1'. The firewall policy for internet access has NAT enabled but no IP pool attached. Which THREE steps should the admin take to resolve the issue? (Choose three.)

Accepted Answer

Verify that the firewall policy does not have an IP pool configured. Central SNAT rules require that the firewall policy has NAT enabled but no IP pool attached. If the policy has an IP pool, Central SNAT is bypassed. Also, the Central SNAT rule must match the traffic's source interface and destination interface. Common issues: policy has an IP pool attached, or the policy's NAT is disabled, or the Central SNAT rule's interface is wrong.

Answer

Ensure the Central SNAT rule's IP pool is configured with overload enabled

Answer

Disable NAT on the firewall policy to force Central SNAT usage

Question 7

An admin needs to create a firewall policy that allows SMTP traffic (TCP/25) from the internal network (10.0.0.0/24) to a mail server in the DMZ (172.16.1.10). Additionally, the admin wants to ensure that the mail server can only be accessed by the internal network, not from the internet. Which THREE settings must be configured in the firewall policy? (Choose three.)

Accepted Answer

Source interface set to 'internal'. The source interface must be set to 'internal' to restrict the firewall policy to traffic originating from the internal network (10.0.0.0/24). This ensures that only hosts on the internal interface can reach the mail server, effectively blocking any internet traffic that would arrive on a different interface like 'wan'.

Answer

Set schedule to 'always'

Answer

Enable NAT to translate source IP

Question 8

A network admin has configured a firewall policy allowing traffic from the 'internal' zone to the 'external' zone. The policy uses a service object 'HTTP' (TCP/80). Users report they can access HTTP websites but not HTTPS. The admin confirms no other policies block HTTPS. What is the most likely cause?

Accepted Answer

HTTPS traffic is being dropped by implicit deny because no policy matches it. The firewall policy explicitly allows only HTTP (TCP/80) traffic from the internal zone to the external zone. HTTPS uses TCP/443, which is not included in the service object 'HTTP'. Since no other policy permits HTTPS, the traffic hits the implicit deny rule at the end of the policy list, which drops all unmatched traffic. This is the default behavior on FortiGate firewalls.

Answer

The FortiGate needs to perform SSL inspection on HTTPS traffic

Answer

There is a policy ordering issue; a later policy might block HTTPS

Answer

The service object 'HTTP' also includes TCP/443 by default

Question 9

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session that has been active for 1 hour and will expire in about 1 hour. The output shows 'proto=6' indicating TCP (protocol 6), 'duration=3600' meaning the session has been active for 3600 seconds (1 hour), and 'expire=3599' meaning the session will expire in 3599 seconds (approximately 1 hour). The 'proto_state=01' indicates a TCP session in the established state (state 1), confirming it is a TCP session.

Answer

The session is a TCP session that has been active for 1 hour and will expire immediately

Answer

The session is a UDP session that has been idle for 3600 seconds

Answer

The session is an ICMP session with a short timeout

Question 10

An administrator needs to allow FTP traffic from the internal network to a specific server on the internet. The FTP server uses passive mode. Which service object should be used in the firewall policy to ensure proper operation?

Accepted Answer

Use the predefined 'FTP' service object and also allow a high port range (e.g., TCP/1024-65535). In passive FTP mode, the client initiates the control connection (TCP/21) and the data connection to a high port (typically >1024) assigned by the server. The predefined 'FTP' service object in FortiGate includes both TCP/21 (control) and TCP/20 (active data), but for passive mode, the data channel uses a random high port, not TCP/20. Therefore, to allow the data channel, you must also permit a high port range (e.g., TCP/1024-65535). Option B correctly combines the predefined FTP object with this high port range, ensuring both control and data traffic are allowed.

Answer

Use a custom service object with TCP/21 and TCP/20

Answer

Use the predefined 'FTP' service object

Answer

Use the 'ALL' service object

Question 11

A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?

Accepted Answer

Policy ID 2, because it matches the source interface and destination. Policy ID 2 is matched because it allows all traffic from the DMZ interface to the WAN destination interface without any service restriction. The packet originates from the DMZ interface and is destined to the internet (WAN), so the source and destination interfaces match Policy ID 2. Since Policy ID 2 does not specify a service, it implicitly permits all protocols, including HTTPS.

Answer

Policy ID 1, because it is first in order

Answer

Policy ID 2, but only if it has a service allowing HTTPS

Answer

Implicit deny, because no policy matches HTTPS traffic

Question 12

Which of the following is a characteristic of policy-based NAT on a FortiGate?

Accepted Answer

NAT is configured directly in the firewall policy using the 'set nat' option. Policy-based NAT on a FortiGate is configured directly within a firewall policy using the 'set nat' command. This allows NAT to be applied selectively based on the policy's matching criteria (source, destination, service, etc.), rather than being defined as a separate rule. This approach is the traditional method on FortiGate and is distinct from Central NAT, which decouples NAT rules from firewall policies.

Answer

NAT is configured separately from firewall policies using Central NAT rules

Answer

NAT is applied to all traffic regardless of policy

Answer

NAT can only be used with IP pools

Question 13

An administrator is troubleshooting a connectivity issue where users in the 10.0.0.0/24 subnet cannot access the internet. The FortiGate has the following policies (in order):
1: allow 10.0.0.0/24 -> any, service: HTTP, HTTPS
2: deny any -> any, service: all
Users can browse HTTP but not HTTPS. Which TWO actions would resolve the issue?

Accepted Answer

Verify that the HTTPS service object is correctly defined and not misspelled. If the HTTPS service object is misconfigured (e.g., misspelled name, missing TCP/443 port, or incorrect port definition), the firewall policy will not match HTTPS traffic even though HTTPS is listed in the policy, causing the traffic to be denied by policy 2. Verifying the service object definition (Option A) and checking that it includes the correct ports (Option E) are the correct troubleshooting steps. Option C (adding HTTPS again) would not resolve the issue if the underlying service object is incorrectly defined, and adding a broad policy or reordering the policies would not address the specific issue.

Answer

Create a new policy above policy 1 allowing all traffic from 10.0.0.0/24

Answer

Add HTTPS to the allowed services in policy 1

Answer

Move policy 2 above policy 1

Question 14

An administrator needs to allow internal users to access a public web server using the server's private IP address, while external users access it via a public IP. Which TWO components are required?

Accepted Answer

A VIP (Virtual IP) mapping the public IP to the private IP. A VIP (Virtual IP) is required to map the public IP address to the private IP address of the web server, enabling external users to reach the server via the public IP while the FortiGate performs destination NAT (DNAT). A firewall policy must allow traffic from internal users to the server's private IP, as internal traffic does not traverse the VIP and must be permitted directly to the private address.

Answer

Central SNAT policy

Answer

An IP pool for source NAT

Answer

A static route on the FortiGate for the public IP

Question 15

A FortiGate is configured with policy-based NAT and multiple IP pools. The administrator wants traffic from the 192.168.1.0/24 subnet to use IP pool 'POOL1' (203.0.113.1-203.0.113.10) and traffic from 192.168.2.0/24 to use IP pool 'POOL2' (203.0.113.11-203.0.113.20). Which THREE steps are necessary?

Accepted Answer

Create two firewall policies, one for each subnet. Policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Answer

Configure a single firewall policy with both subnets in the source address group

Answer

Enable Central NAT and define two NAT policies