NSE4 Firewall Policies and NAT Practice Test 11 — 15 Questions

Question 1

Which TWO statements about firewall policy order are true?

Accepted Answer

Policies are evaluated in the order they appear (top-down). FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Answer

If a packet does not match any policy, it is allowed by default

Answer

A more specific policy should be placed below a less specific one to avoid shadowing

Answer

Once a policy is matched, subsequent policies are still evaluated for logging purposes

Question 2

An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?

Accepted Answer

A traffic shaper object that defines bandwidth limits. A traffic shaper object is a fundamental component that defines the bandwidth limits (e.g., guaranteed bandwidth, maximum bandwidth, priority) that will be applied to traffic. Without this object, the firewall has no parameters to enforce rate limiting. In FortiGate, the traffic shaper object is created under 'Traffic Shapers' and can be per-policy or per-IP.

Answer

A static route for the YouTube subnet

Answer

A schedule object to apply the shaper only during business hours

Question 3

An administrator needs to block access to a specific website using FQDN address objects. Which TWO steps are necessary?

Accepted Answer

Create an FQDN address object for the website. Creating an FQDN address object (Option A) is necessary because it allows the firewall to resolve the fully qualified domain name to an IP address dynamically, enabling policy enforcement based on the domain rather than a static IP. Adding a firewall policy with destination set to that FQDN object and action DENY (Option B) is required to actually block traffic to the website by matching the resolved IP addresses against the policy. Without both steps, the firewall cannot identify and deny traffic to the specific website using FQDN-based control.

Answer

Create a wildcard FQDN address object

Answer

Configure a DNS filter to block the FQDN

Answer

Create a VIP for the website

Question 4

An administrator wants to apply policy-based routing (PBR) to route traffic from a specific subnet through a different ISP. Which TWO elements must be configured?

Accepted Answer

A policy route object with source subnet and gateway. Policy-based routing (PBR) in FortiGate requires a policy route object that defines the source subnet and the next-hop gateway (or interface) to override the routing table for matching traffic. This allows the administrator to force traffic from a specific subnet to exit through a different ISP.

Answer

A static route with a higher distance

Answer

An SD-WAN rule

Answer

A VIP to change the destination

Question 5

An administrator configures Central SNAT for traffic going from internal network (10.0.0.0/8) to the internet. The rule uses an IP Pool with overload (PAT) and the pool address is 203.0.113.10. However, traffic from 10.0.0.10 to a public server is not being NATed; the source IP remains 10.0.0.10. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The firewall policy does not have NAT enabled. Central SNAT rules are evaluated before policy-based NAT. If a Central SNAT rule exists but does not match the traffic (e.g., wrong source interface, destination, or pool), FortiGate falls back to policy-based NAT. If the firewall policy has no NAT enabled, the traffic is not translated. The admin likely has Central SNAT configured incorrectly or the policy has NAT disabled.

Answer

The IP Pool is configured for one-to-one NAT instead of overload

Answer

The Central SNAT rule's source interface is set to 'wan1' instead of 'internal'

Answer

The IP Pool is configured with 'Fixed Port Range' which conflicts with overload

Question 6

A FortiGate administrator needs to allow all internal users (10.0.0.0/8) to access a web server in the DMZ (192.168.1.100) using HTTPS. The administrator wants to apply a web filter profile to block malicious URLs while allowing legitimate traffic. Which of the following is the correct policy configuration?

Accepted Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=ACCEPT, web filter profile=default. The policy must match the HTTPS service (TCP/443) to allow encrypted web traffic to the DMZ web server, and the web filter profile is applied to inspect the HTTPS traffic for malicious URLs. The default web filter profile can block malicious URLs while allowing legitimate HTTPS traffic, provided SSL inspection is configured to enable content filtering.

Answer

Policy: source=internal, destination=DMZ, service=ALL, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTP, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=DENY, web filter profile=default

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the SYN_SENT state, waiting for a SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table corresponds to the TCP state `SYN_SENT` (the session has sent a SYN and is awaiting a SYN-ACK). The `duration=3600` and `expire=3599` indicate the session has been alive for 3600 seconds and will expire in 3599 seconds, but the state itself is not established or closing. Option A is correct because `proto_state=01` specifically maps to the TCP SYN_SENT state in FortiOS session diagnostics.

Answer

The session is using UDP protocol

Answer

The session is fully established and actively transferring data

Answer

The session is being torn down and will expire soon

Question 8

A FortiGate administrator is configuring a firewall policy to allow inbound HTTPS traffic from the internet to an internal web server. The web server has a private IP address 10.0.0.10. The administrator wants to translate the destination IP to the internal server using a Virtual IP (VIP). Which TWO of the following must be configured for the VIP to work correctly? (Choose two.)

Accepted Answer

The VIP must have the external IP set to a public IP address assigned to the FortiGate's WAN interface. A Virtual IP (VIP) must map a public IP address (typically assigned to the FortiGate's WAN interface) to the internal private IP of the web server. Without setting the external IP to a public address, the VIP cannot receive inbound traffic from the internet. Option D is correct because the firewall policy must reference the VIP as the destination address object; this triggers the destination NAT translation from the public IP to the private IP 10.0.0.10.

Answer

An IP Pool must be configured for the web server's return traffic

Answer

The VIP must have port forwarding enabled with the external and internal ports set to 443

Answer

The firewall policy must have NAT enabled

Question 9

An administrator is troubleshooting why traffic from a specific VLAN (192.168.10.0/24) to the internet is not being NATed correctly. The firewall policy allows the traffic with NAT enabled and uses an IP Pool (overload) for the source translation. The IP Pool is configured with the address 203.0.113.10. However, the traffic still shows the original source IP. Which THREE of the following could cause this issue? (Choose three.)

Accepted Answer

The firewall policy does not have the IP Pool selected in the NAT section. The IP Pool must be explicitly selected in the NAT section of the firewall policy for the pool to be used for source translation. Without this selection, the firewall will use the default NAT behavior (typically the outgoing interface IP) or no NAT at all, even if NAT is enabled on the policy.

Answer

There is a Central SNAT rule with higher priority that does not match the traffic

Answer

The IP Pool uses one-to-one NAT instead of overload

Question 10

A FortiGate administrator needs to block all traffic from a specific IP address (10.0.0.100) to the internet, but allow all other internal users. The administrator has created a firewall policy with source=10.0.0.100, destination=all, service=all, action=DENY, and placed it at the top of the policy list. Which TWO additional steps should the administrator take to ensure the block is effective? (Choose two.)

Accepted Answer

Enable the policy. A newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

Answer

Configure an IP Pool for the deny policy

Answer

Add a schedule to the policy for business hours

Answer

Set the action to ACCEPT

Question 11

An administrator is configuring policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet (172.16.1.0/24) through a different internet connection (wan2) instead of the default route via wan1. The administrator has created a PBR rule matching source 172.16.1.0/24 and set the gateway to the next-hop IP on wan2. The traffic is still using wan1. Which THREE of the following could be causing the issue? (Choose three.)

Accepted Answer

The PBR rule's gateway is not reachable from the FortiGate. PBR requires the specified next-hop gateway to be reachable via a directly connected route or a static route; if the gateway IP on wan2 is not reachable (e.g., due to a missing ARP entry or link failure), the FortiGate will fall back to the routing table and use the default route via wan1. The FortiGate performs a reachability check on the PBR gateway before applying the rule.

Answer

The PBR rule's priority is set too high (e.g., 100) and a static route with lower priority is used instead

Answer

The PBR rule's destination is set to 'all' but the traffic's destination is not covered

Question 12

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

Accepted Answer

The user's IP address is not in the source address range of the policy. Even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Answer

The user is not a member of the FSSO group

Answer

The FSSO collector agent is not running

Answer

The FortiGate is not polling the domain controller

Question 13

A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?

Accepted Answer

A security profile applied to the policy is blocking the HTTPS traffic.. Security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.

Answer

NAT is disabled, so the server cannot send replies back.

Answer

The policy order is incorrect; a deny policy above is blocking traffic.

Answer

The schedule is configured incorrectly and the policy is inactive during the current time.

Question 14

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

Accepted Answer

The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.. When the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Answer

The SD-WAN zone does not include the backup interface wan2.

Answer

The static routes have the same distance, so failover does not occur.

Answer

The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.

Question 15

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

Accepted Answer

The implicit deny rule. The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Answer

The security profile group

Answer

The default route

Answer

The last explicit deny policy in the policy list