NSE4 Firewall Policies and NAT Practice Test 11 — 15 Questions

Question 1

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

Accepted Answer

Central SNAT overrides policy-based NAT. Central SNAT takes precedence over policy-based NAT when both are configured. The Central SNAT rule might be incorrect or missing, causing unexpected behavior.

Answer

Both NAT methods are applied, causing double NAT

Answer

The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict

Answer

Policy-based NAT always overrides Central SNAT

Question 2

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Accepted Answer

diagnose firewall iprope list. Using diagnose debug flow to trace the packet and diagnose firewall iprope list to see policy hit counts are effective ways to identify traffic matching.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 3

A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?

Accepted Answer

A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP. To allow inbound HTTPS and preserve the source IP, you need a VIP to translate destination, a firewall policy allowing the traffic, and no source NAT (or use a policy that does not SNAT). SNAT would hide the original source IP.

Answer

A static route for 203.0.113.10 pointing to the ISP gateway

Answer

A Central SNAT policy to translate the source to the FortiGate's IP

Question 4

An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?

Accepted Answer

Traffic shaper (e.g., shared or per-IP shaper). To apply traffic shaping, you need a traffic shaper (defining bandwidth limits), an application control profile to identify YouTube traffic, and a firewall policy that applies both the shaper and the profile.

Answer

A DNS filter to block YouTube

Answer

A static route for YouTube's IP range

Question 5

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 6

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When 'NAT' is enabled on a firewall policy, FortiGate performs source NAT using the egress interface IP by default. Option A correctly states this default behavior for outbound traffic.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 7

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

Accepted Answer

Policy ID 2 because it matches the source and service. FortiGate uses first-match logic. Policy ID 1 matches source 10.0.0.0/24 and service HTTP. Policy ID 2 matches source 10.0.1.0/24 and service ALL. The host 10.0.1.50 is in 10.0.1.0/24 but also in 10.0.0.0/24? No, 10.0.1.0/24 is not a subset of 10.0.0.0/24. Actually 10.0.0.0/24 covers 10.0.0.0-10.0.0.255, so 10.0.1.50 is not in that range. Therefore policy ID 1 does not match (source mismatch). Policy ID 2 matches because source 10.0.1.0/24 includes 10.0.1.50 and service ALL includes HTTP. So answer B.

Answer

Both policies, and the traffic is load-balanced

Answer

No policy matches, traffic is denied by implicit deny

Answer

Policy ID 1 because it is first in order and matches the service HTTP

Question 8

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). Destination NAT (DNAT) is used to translate the destination IP of incoming traffic. Virtual IP (VIP) is the FortiGate object for DNAT. Option B is correct.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 9

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The session is a TCP (proto=6) session, state 01 means TCP SYN sent, duration 3600 seconds indicates it has been up for 1 hour, expire 3599 means it will expire in about 3599 seconds (almost 1 hour from now). Option C is correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP

Question 10

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

Accepted Answer

Change the IP pool type to 'Fixed Port Range'. The IP pool overload mode uses dynamic port allocation, which can break applications needing a consistent port range. The 'Fixed Port Range' option in the IP pool configuration assigns a fixed port range to each session, preserving the original source port or a fixed range. Option A is correct.

Answer

Disable NAT and use policy-based routing

Answer

Use Central SNAT instead of policy-based NAT

Answer

Enable 'Preserve Source Port' in the firewall policy

Question 11

A FortiGate administrator needs to block all traffic from a specific geographic region (country) from accessing the internal network. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. Geography-based address objects allow matching traffic based on the source IP's country. Option B is correct.

Answer

FQDN object

Answer

Wildcard FQDN object

Answer

Subnet object

Question 12

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. To use a specific source IP for NAT, an IP Pool object must be created with the desired IP (203.0.113.2) and then referenced in the firewall policy. Option C is correct.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'

Question 13

A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?

Accepted Answer

An inter-VDOM policy on the inter-VDOM link interface. An inter-VDOM link policy (or simply a policy between VDOMs) must be configured, often using a physical or logical inter-VDOM link. Option D correctly identifies the need for an inter-VDOM policy.

Answer

A policy using a virtual wire pair

Answer

A regular intra-VDOM policy on VDOM A with destination interface port2

Answer

A policy on each VDOM with the same source/destination

Question 14

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy A's schedule 'WorkHours' is not active (Saturday 8 AM is outside Mon-Fri 9-17). Policy B's schedule 'Always' is always active. Since Policy A does not match due to schedule, Policy B matches and allows the traffic. Option B is correct.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 15

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. To apply traffic shaping, a traffic shaper must be created and then referenced in the firewall policy. Option A is correct.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit