NSE4 Firewall Policies and NAT Practice Test 13 — 15 Questions

Question 1

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. An IP Pool in FortiGate allows you to override the source IP address for specific traffic, even when NAT is enabled on the policy. By creating an IP Pool with the single address 203.0.113.2 and referencing it in the firewall policy, traffic from 10.0.0.10 will be NATed to that specific IP instead of the outgoing interface address (203.0.113.1). This is the standard method for fixed source NAT (also called 'static NAT' or 'one-to-one NAT') for a specific host.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'

Question 2

A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?

Accepted Answer

An inter-VDOM policy on the inter-VDOM link interface. When traffic must cross from one VDOM to another on a FortiGate, an inter-VDOM policy is required. This policy is applied to the inter-VDOM link interface, which acts as the logical boundary between VDOMs. It allows the firewall to enforce separate routing and security contexts while forwarding traffic between VDOMs.

Answer

A policy using a virtual wire pair

Answer

A regular intra-VDOM policy on VDOM A with destination interface port2

Answer

A policy on each VDOM with the same source/destination

Question 3

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy B is correct because at 8:00 AM on Saturday, the 'WorkHours' schedule (Mon-Fri 9-17) is not active. FortiGate evaluates policies sequentially; when the first matching policy's schedule is inactive, the firewall skips it and continues to the next policy. Policy B with schedule 'Always' matches and permits the traffic.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 4

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit

Question 5

A FortiGate administrator wants to create a firewall policy that matches traffic based on the destination domain name (e.g., *.example.com). Which type of address object should be used?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object (option B) is the correct choice because it allows pattern matching with a leading asterisk (e.g., *.example.com) to match any subdomain of example.com. Standard FQDN objects require an exact, fully qualified domain name and do not support wildcard patterns, making them unsuitable for matching traffic based on a domain pattern like *.example.com.

Answer

FQDN object

Answer

Subnet object

Answer

Geography object

Question 6

A FortiGate administrator is troubleshooting a connectivity issue where internal clients cannot reach a public web server. The administrator has confirmed that routing is correct and there are no security profiles blocking traffic. Which TWO debugging steps should the administrator take? (Choose two.)

Accepted Answer

Run a packet capture on the internal interface. Running a packet capture on the internal interface (Option B) allows the administrator to verify whether the client's request is actually reaching the FortiGate and whether the firewall is processing the traffic correctly. This step isolates whether the issue is before, at, or after the FortiGate, which is essential when routing is already confirmed as correct.

Answer

Reboot the FortiGate

Answer

Change the NAT mode to Central SNAT

Answer

Disable the antivirus profile

Question 7

An administrator needs to configure destination NAT for multiple internal servers using a single public IP address by differentiating based on destination port. The public IP 203.0.113.10 should map to: (A) 10.0.0.1:80 for HTTP, (B) 10.0.0.2:443 for HTTPS. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a VIP for HTTP mapping port 80 to 10.0.0.1. A Virtual IP (VIP) is required to map the public IP 203.0.113.10 and destination port 80 to the internal server 10.0.0.1:80. This is the standard FortiGate method for destination NAT (port forwarding) when multiple internal servers share a single public IP, differentiated by destination port.

Answer

Create an IP pool for the public IP

Answer

Configure policy-based routing for each server

Answer

Use Central SNAT with port forwarding

Question 8

A FortiGate administrator is implementing a policy to allow outbound traffic from the internal network to the internet. The requirements are: (1) all traffic from internal users must be source NATed to the external interface IP, (2) traffic from a specific server must use a different public IP, (3) HTTP traffic must be shaped to 10 Mbps. Which THREE configuration elements should the administrator create? (Choose three.)

Accepted Answer

A traffic shaper for HTTP traffic. A traffic shaper is required to enforce bandwidth limits on HTTP traffic. In FortiGate, traffic shaping policies allow you to define per-policy bandwidth constraints, such as capping HTTP traffic to 10 Mbps, by applying a shaper to the firewall policy that matches HTTP traffic.

Answer

A VIP for the server

Answer

A policy-based routing rule for the server

Question 9

A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?

Accepted Answer

The new policy is placed below the older policy in the policy list. A FortiGate firewall evaluates policies sequentially from top to bottom, applying the first match. If the new policy is placed below an older policy with a broader source definition, traffic from 'Internal_Net' will match the older policy first and never reach the new policy. Therefore, option B is the correct answer.

Answer

The source address object 'Internal_Net' has an incorrect subnet mask

Answer

The new policy is disabled

Answer

Traffic shaping is applied to the new policy and is interfering

Question 10

An admin needs to allow outbound HTTP and HTTPS traffic from the internal network to the internet. Which two built-in service objects can be used in a single firewall policy to achieve this?

Accepted Answer

HTTP and HTTPS. HTTP (TCP/80) and HTTPS (TCP/443) are the two built-in service objects that specifically match outbound web traffic. A single firewall policy can include both service objects to allow HTTP and HTTPS traffic from internal users to the internet, which is the most precise and secure way to permit web browsing without opening unnecessary ports.

Answer

WEB and SSL

Answer

ANY and HTTPS

Answer

ALL_TCP and ALL_UDP

Question 11

A FortiGate has a central SNAT policy that translates internal users to a single IP pool address. The admin wants specific traffic (e.g., from a particular subnet) to use a different IP pool. What is the correct approach?

Accepted Answer

Create a new central SNAT policy with the specific subnet as source and place it above the existing policy. Central SNAT policies are evaluated in sequential order, and the first matching policy is applied. By creating a new policy with the specific subnet as the source and placing it above the existing policy, the FortiGate will match the more specific traffic first and use the different IP pool, while all other traffic continues to match the original policy.

Answer

Create a policy-based NAT rule with the specific subnet and place it above the central SNAT policy

Answer

Use VIP to translate the source address

Answer

Modify the existing central SNAT policy to use a dynamic IP pool

Question 12

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

Accepted Answer

In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload. The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.

Answer

Create a central SNAT policy with the source as the mail server and the translated IP as the desired address

Answer

Use a VIP with port forwarding to translate the source

Answer

Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool

Question 13

A FortiGate policy allows traffic from the internal network to a DMZ server. The admin wants to limit access to only specific hours. Which object type should be used in the policy?

Accepted Answer

Schedule. A schedule object is the correct choice because it defines time-based conditions (e.g., specific hours, days, or recurring intervals) that FortiGate applies to firewall policies. By attaching a schedule to a policy, the admin can restrict traffic to the DMZ server only during the permitted hours, such as business hours or maintenance windows.

Answer

Address group

Answer

Service group

Answer

Traffic shaper

Question 14

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

Accepted Answer

FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually. When a firewall policy is deleted on a FortiGate, the existing sessions that were created by that policy are not automatically removed. The FortiGate continues to process those sessions until they expire naturally based on their timeout values. In this case, the sessions with 'proto=6' (TCP) and 'expire=3599' seconds remaining will persist until the timer counts down, even though the originating policy no longer exists. The admin must manually clear them using 'diagnose sys session clear' or wait for the timeout to expire.

Answer

The sessions are using UDP protocol, which has a longer timeout

Answer

The sessions are protected by a different policy that still exists

Answer

The sessions are in a different VDOM

Question 15

A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?

Accepted Answer

The traffic is in a different VDOM than the policy. In a multi-VDOM FortiGate, each VDOM operates as an independent virtual firewall with its own routing table, policies, and interfaces. A firewall policy created in the root VDOM only applies to traffic that enters and exits interfaces assigned to that root VDOM. If the traffic originates from or is destined to an interface belonging to a different VDOM, it will never match the root VDOM policy, causing the traffic to be dropped or handled by the correct VDOM's policies.

Answer

The internet-facing interface is not part of any VDOM

Answer

The subnet object is defined in the wrong address group

Answer

The policy is placed at the bottom of the list