NSE4 Firewall Policies and NAT Practice Test 12 — 15 Questions

Question 1

A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Central SNAT with a dynamic IP pool using overload. Central SNAT with a dynamic IP pool using overload (PAT) is the correct method to translate all traffic from the 192.168.1.0/24 network to a single public IP address. The 'overload' option enables port address translation (PAT), allowing multiple internal hosts to share one public IP by using unique source port numbers, which is exactly what the administrator needs for internet-bound traffic.

Answer

Policy-based NAT with a fixed port range

Answer

One-to-one NAT IP Pool

Answer

Virtual IP (VIP) with port forwarding

Question 2

An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?

Accepted Answer

Policy-based routing (PBR) configured with a policy matching the destination and service. Policy-based routing (PBR) allows you to override the routing table based on match criteria such as source/destination IP, port, or protocol. In this scenario, you create a PBR policy that matches destination 203.0.113.50 and service TCP/443, then sets the next-hop to the WAN2 gateway. This ensures that only traffic to that specific web service exits via WAN2, while all other traffic follows the default route via WAN1.

Answer

Central NAT policy to force the traffic out of WAN2

Answer

Static route with a higher priority for WAN2 to 203.0.113.0/24

Answer

SD-WAN with a strategy of 'Best Quality'

Question 3

What is the purpose of the 'implicit deny' policy on a FortiGate?

Accepted Answer

It denies all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a default, last-resort rule that denies all traffic not matching any explicit firewall policy. It ensures that any packet that does not meet the source, destination, service, or schedule criteria of a configured policy is dropped, enforcing a default-deny security posture. This behavior is fundamental to stateful firewall operation and prevents unauthorized traffic from traversing the device.

Answer

It allows traffic from trusted internal networks

Answer

It logs all traffic that is denied

Answer

It allows all traffic that matches no other policy

Question 4

An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?

Accepted Answer

The destination in the firewall policy is set to the public IP directly instead of the VIP object. When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Answer

The VIP is configured with port forwarding disabled

Answer

The server's default gateway is not set to the FortiGate

Answer

The source NAT is not configured

Question 5

You execute 'get firewall policy 5' and see the following output:
policyid=5
name="test"
status=enable
schedule="always"
logtraffic=all
What does 'logtraffic=all' mean?

Accepted Answer

All traffic matching the policy will be logged, regardless of action. 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

Answer

Only the first packet of each session will be logged

Answer

Only traffic that triggers a security profile will be logged

Answer

Only traffic that is denied by the policy will be logged

Question 6

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. The Geography address object type in FortiGate allows you to match traffic based on the source or destination country by using the ISO 3166-1 alpha-2 country codes. This is configured within a firewall policy to enforce geo-blocking or geo-allowance, leveraging FortiGuard's GeoIP database to map IP addresses to countries.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 7

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

Accepted Answer

Move the allow policy above the deny policy. FortiGate policies are evaluated sequentially from top to bottom (lowest ID to highest ID). The first matching policy is applied. If an explicit deny policy appears above an allow policy for the same subnet, the deny policy will match first and drop the traffic. Moving the allow policy above the deny policy ensures it is evaluated first, allowing the traffic.

Answer

Add a new policy with a higher ID

Answer

Disable the deny policy

Answer

Delete the deny policy

Question 8

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

Accepted Answer

Central SNAT overrides policy-based NAT. Central SNAT (Source NAT) is a centralized NAT policy that takes precedence over policy-based NAT rules when both are configured for the same traffic. In FortiGate, Central SNAT is evaluated before policy-based NAT, and if a matching Central SNAT rule exists, it will override any policy-based NAT configuration. This is by design to provide a more predictable and manageable NAT architecture.

Answer

Both NAT methods are applied, causing double NAT

Answer

The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict

Answer

Policy-based NAT always overrides Central SNAT

Question 9

An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?

Accepted Answer

Traffic shaper (e.g., shared or per-IP shaper). A traffic shaper (shared or per-IP) defines the bandwidth limits (e.g., maximum rate, guaranteed rate) that will be enforced on the traffic. This shaper must be created first to control YouTube streaming bandwidth.

Answer

A DNS filter to block YouTube

Answer

A static route for YouTube's IP range

Question 10

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 11

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 12

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) is the correct feature because it performs destination NAT (DNAT), translating the public destination IP 203.0.113.10 to the internal server IP 10.0.0.5. This allows inbound traffic from the internet to reach the internal web server by rewriting the destination IP address in the packet header as it traverses the FortiGate.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 13

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The output shows `proto=6`, which is the protocol number for TCP, and `proto_state=01`, which in FortiGate's session table indicates an established TCP connection (state ESTABLISHED). The `duration=3600` seconds means the session has been active for exactly 1 hour, and `expire=3599` seconds shows the remaining time before the session times out. This confirms the session is an active TCP connection that has been established for 1 hour, making option C correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP

Question 14

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

Accepted Answer

Change the IP pool type to 'Fixed Port Range'. When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.

Answer

Disable NAT and use policy-based routing

Answer

Use Central SNAT instead of policy-based NAT

Answer

Enable 'Preserve Source Port' in the firewall policy

Question 15

A FortiGate administrator needs to block all traffic from a specific geographic region (country) from accessing the internal network. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. A Geography object is specifically designed to represent a geographic region (such as a country) based on IP address geolocation data. When used in a firewall policy, it allows the FortiGate to match traffic sources or destinations by country, enabling the administrator to block all traffic from that region. This is the correct and only address object type that supports country-based filtering.

Answer

FQDN object

Answer

Wildcard FQDN object

Answer

Subnet object