NSE4 Firewall Policies and NAT Practice Test 13 — 15 Questions

Question 1

An administrator needs to allow traffic from a guest network (192.168.100.0/24) to the internet only during business hours (Mon-Fri, 08:00-18:00). The administrator creates a schedule object and applies it to the firewall policy. However, guests can still access the internet outside of the schedule. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The schedule is not selected in the firewall policy. If the schedule is not actually selected in the firewall policy configuration, the policy will apply without any time restriction, allowing traffic at all times. The administrator may have created the schedule object but forgotten to assign it to the policy's schedule field, which is a common oversight.

Answer

The guest network is also allowed by another policy without a schedule

Answer

The schedule object is configured as a group but not applied

Answer

The FortiGate clock is not synchronized with an NTP server

Question 2

A network administrator creates a firewall policy allowing HTTP traffic from the internal network to a web server in the DMZ. Users report that they cannot access the web server. The administrator runs 'diagnose firewall iprope list' and sees the policy is present. What is the MOST likely cause of the issue?

Accepted Answer

A deny policy with a lower policy ID is matching the traffic before the allow policy. The 'diagnose firewall iprope list' command confirms the allow policy exists in the FortiGate's kernel policy list, meaning it is present and enabled. However, FortiGate evaluates policies in sequential order based on policy ID (lowest first), so a deny policy with a lower ID that matches the same traffic (e.g., from internal to DMZ) will be hit first, blocking the HTTP request before the allow policy can be evaluated. This is the most likely cause because the policy is present but not being matched due to ordering.

Answer

The firewall policy has an incorrect source interface

Answer

The policy is disabled

Answer

The web server is not responding to HTTP requests

Question 3

An administrator needs to allow outbound DNS traffic (UDP port 53) from multiple internal subnets to the internet. Which object type should be used to group the subnets into a single source in the firewall policy?

Accepted Answer

Address group. An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.

Answer

VIP group

Answer

Schedule group

Answer

Service group

Question 4

A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?

Accepted Answer

The fixed port range is too small, causing port exhaustion. The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Answer

The external server is rate-limiting connections

Answer

The firewall policy has a timeout setting that is too low

Answer

The IP pool has run out of IP addresses

Question 5

An administrator creates a firewall policy with a traffic shaper to limit bandwidth for guest wireless users. After applying the policy, users can still consume high bandwidth. The administrator confirms the policy is matching. What is the MOST likely reason the traffic shaper is not effective?

Accepted Answer

The traffic shaper is configured but not applied to the policy's 'Traffic Shaper' field. In FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Answer

The traffic shaper's maximum bandwidth is set too high

Answer

The traffic shaper is applied to the wrong direction (egress vs ingress)

Answer

The traffic shaper is a per-IP shaper but the policy applies to a subnet

Question 6

A FortiGate administrator wants to ensure that traffic from the internal network to an external FTP server uses a specific source IP address (203.0.113.10). The internal network uses RFC 1918 addresses. Which NAT configuration should be used?

Accepted Answer

Policy-based NAT using an IP pool with type 'Overload' and the IP address 203.0.113.10. Policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

Answer

Policy-based NAT using an IP pool set to 'Fixed Port Range'

Answer

Virtual IP (VIP) mapping the internal server to 203.0.113.10

Answer

Central SNAT with dynamic IP pool

Question 7

An administrator configures a firewall policy with a schedule object that is set to 'Available: Mon-Fri 09:00-17:00'. At 10:00 AM on Saturday, users report they cannot access the resource. The administrator checks the policy list and sees the policy is enabled. What is the MOST likely reason?

Accepted Answer

The schedule object only allows traffic on weekdays, and Saturday is not included. The schedule object is configured to allow traffic only from Monday to Friday, 09:00-17:00. Since Saturday is outside this range, the firewall policy will deny or not match the traffic, even though the policy is enabled. This is the most direct and likely reason for the access failure.

Answer

The FortiGate's system time is incorrect

Answer

A deny policy with higher priority is blocking the traffic

Answer

The schedule object is not correctly applied to the policy

Question 8

Which of the following best describes a Virtual IP (VIP) in FortiGate?

Accepted Answer

A method to translate a public IP/port to a private IP/port for inbound traffic. A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Answer

A method to translate private source IPs to a public IP for outbound traffic

Answer

A method to group multiple firewall policies

Answer

A method to load balance traffic across multiple WAN interfaces

Question 9

An administrator needs to block traffic from a specific geographic region (e.g., country) from reaching the corporate web server. Which type of address object should be used to define the source?

Accepted Answer

Geography object. A Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

Answer

Wildcard FQDN object

Answer

FQDN object

Answer

Subnet object

Question 10

A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?

Accepted Answer

Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10. To allow inbound HTTPS to an internal server with destination NAT, a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10 is required. A firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination permits the traffic and applies the NAT. Additionally, to translate the source port to a fixed range for logging, an IP pool with fixed port range is needed. Thus, options A, B, and D are all required.

Answer

Configure Central SNAT to translate the server's source IP for return traffic

Answer

Enable 'allow source port translation' on the VIP

Question 11

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Accepted Answer

Define a traffic shaper object with the desired bandwidth limits. A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Answer

Enable SD-WAN on the FortiGate

Answer

Configure Central NAT to translate the source IP

Question 12

A FortiGate administrator needs to ensure that all internal users (10.0.0.0/8) accessing the internet use a single public IP address 203.0.113.10 for source NAT. Which NAT configuration should be used?

Accepted Answer

Create a Central SNAT rule with a Dynamic IP Pool using overload. Central SNAT with a Dynamic IP Pool using overload (Port Address Translation) allows all internal users in 10.0.0.0/8 to share a single public IP (203.0.113.10) by dynamically mapping multiple private source IPs and ports to unique source ports on the public IP. This is the standard method for many-to-one NAT, ensuring all outbound internet traffic appears from the same public address.

Answer

Enable NAT on the outgoing interface policy without an IP pool

Answer

Create a policy-based NAT rule with fixed port range

Answer

Configure a VIP with port forwarding

Question 13

An admin runs the command 'diagnose firewall iprope list 100000' and sees the following output:
id=2000000000 action=deny flag=0x0 src-interface=any dst-interface=any proto=0 src-addr=0.0.0.0-255.255.255.255 dst-addr=0.0.0.0-255.255.255.255
What does this entry represent?

Accepted Answer

The implicit deny policy at the end of the policy list. The output shows an entry with id=2000000000, action=deny, and source/destination addresses covering all possible IPs (0.0.0.0-255.255.255.255). In FortiGate, the implicit deny policy is automatically inserted at the end of the policy list with a high ID (typically 2000000000) and matches any traffic that hasn't been permitted by earlier policies. This is not a user-created policy but the built-in default deny rule.

Answer

A loopback interface policy

Answer

A user-created deny policy that blocks all traffic

Answer

A NAT policy that translates all addresses

Question 14

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

Accepted Answer

Create an allow policy for HTTP/HTTPS and apply a web filter profile. FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Answer

Configure a DNS filter instead of a web filter

Answer

Create a policy with action DENY and a web filter profile

Answer

Use an application control profile to block malicious sites

Question 15

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

Accepted Answer

Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ. To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Answer

Use policy-based routing to forward SSH traffic

Answer

Configure source NAT on the outbound policy from DMZ to WAN

Answer

Enable NAT on the WAN interface