NSE4 Firewall Policies and NAT Practice Test 14 — 15 Questions

Question 1

An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP. When a firewall policy has NAT enabled (typically 'Enable NAT' or 'Use Outgoing Interface Address'), the FortiGate performs source NAT (SNAT) on the traffic, replacing the original client source IP with the IP of its egress interface (the internal interface in this scenario). This is standard behavior for source NAT, which hides the original client IP from the internal server, causing the server logs to show the FortiGate's internal interface IP instead of the actual client IP.

Answer

The VIP is configured with port forwarding and the server is expecting a different port

Answer

The VIP is using a different public IP than expected

Answer

The server's routing is misconfigured and traffic is returning via a different path

Question 2

Which statement best describes the implicit deny policy at the end of a FortiGate policy list?

Accepted Answer

It is always present and denies any traffic that does not match an explicit allow policy. The implicit deny policy is a built-in, last-resort rule at the bottom of the FortiGate policy list that silently drops any traffic not matching an explicit allow policy. It cannot be moved, disabled, or deleted because it is a fundamental security mechanism ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It denies all traffic that does not match any explicit policy, and it logs the denied traffic

Answer

It can be moved to a different position in the policy list

Answer

It can be disabled or deleted by the admin

Question 3

An admin needs to allow traffic from a specific IP to a web server on port 8080. The web server is behind a VIP that forwards port 80 to port 8080. When configuring the security policy, which destination should be used?

Accepted Answer

The VIP object. When a VIP is used to translate the destination IP and port (e.g., from public IP:80 to private server IP:8080), the security policy must reference the VIP object as the destination. FortiGate matches the policy using the original destination IP before destination NAT is applied. The VIP object represents the original destination (the external IP) that clients use, so referencing it ensures the policy correctly permits the traffic.

Answer

The virtual IP address of the FortiGate

Answer

The real server IP address

Answer

Any destination, because the VIP translates automatically

Question 4

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from a specific subnet out of a particular interface. The admin also has a firewall policy allowing that subnet to the internet. However, the traffic is not being routed as expected. What could be the issue?

Accepted Answer

The PBR rule uses an incorrect source or destination address. Policy-based routing (PBR) is evaluated before firewall policies. If the PBR rule specifies an incorrect source or destination address, traffic from the intended subnet will not match the PBR rule and will fall through to the default routing table, potentially exiting via a different interface. The firewall policy alone cannot override the routing decision; the PBR rule must correctly identify the traffic to steer it to the desired egress interface.

Answer

The firewall policy is placed above the PBR rule

Answer

The PBR rule does not have a matching protocol or service defined

Answer

The FortiGate is in transparent mode

Question 5

An admin wants to allow traffic only from specific countries to access a web server. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. The Geography object (also known as a GeoIP object) in FortiGate allows firewall policies to permit or deny traffic based on the source or destination country. This is the correct choice because the requirement is to filter traffic by country, which is exactly what Geography objects are designed for, using IP-to-country mappings maintained by FortiGuard.

Answer

Subnet object

Answer

FQDN object

Answer

Wildcard FQDN object

Question 6

A network admin runs 'diag sys session filter proto 6' and 'diag sys session list' and sees many sessions with state 'SYN_SENT' to a public web server. The firewall policy allows TCP/443. What is the MOST likely cause?

Accepted Answer

The destination NAT (VIP) for the web server is not configured. The 'diag sys session filter proto 6' command filters for TCP sessions (protocol 6). Seeing many sessions stuck in 'SYN_SENT' state indicates that the FortiGate is sending SYN packets to the destination but never receiving a SYN-ACK reply. Since the firewall policy allows TCP/443, the most likely cause is that the destination NAT (VIP) for the public web server is not configured. Without a VIP, the FortiGate forwards the packet with the original destination IP (the public IP), which may not be routable or may not exist on the internal network, causing the SYN to be sent into a black hole.

Answer

The web server is overloaded and dropping connections

Answer

The policy is in proxy mode but should be flow mode

Answer

The firewall policy has session TTL set too low

Question 7

An admin wants to block all traffic from the internet to a specific internal server except for the IP address 203.0.113.50. Which firewall policy configuration achieves this using the principle of least privilege?

Accepted Answer

Create a deny policy from internet to server with any source, then an allow policy from source 203.0.113.50 to the server above it. It follows the principle of least privilege by explicitly denying all traffic from the internet to the internal server (with a deny policy using any source), then placing an explicit allow policy above it for source 203.0.113.50. In FortiGate firewall policy processing, policies are evaluated top-down, so the more specific allow rule for the trusted source is matched first, while the broader deny rule below it blocks all other internet traffic. This ensures only the permitted IP address can reach the server, and all other traffic is explicitly blocked.

Answer

Configure a VIP with restricted source

Answer

Use a local-in policy to block the server IP

Answer

Create a single allow policy from source 203.0.113.50 to the server and rely on implicit deny for all other traffic

Question 8

A FortiGate has policy-based NAT enabled. The admin wants to translate the source IP of internal users to the interface IP for internet traffic. The firewall policy has NAT enabled. However, traffic from the internal network to the internet shows the original source IP instead of the interface IP. What is the MOST likely reason?

Accepted Answer

Central NAT is enabled and overrides the per-policy NAT setting. When policy-based NAT is enabled, the per-policy NAT setting should translate the source IP to the interface IP. However, if Central NAT is also enabled, it takes precedence and overrides the per-policy NAT configuration. Central NAT uses its own rules (e.g., IP pools) and can prevent the interface IP translation from being applied, leaving the original source IP unchanged.

Answer

The destination is a VIP that disables NAT

Answer

The NGFW mode is set to profile-based

Answer

The policy is configured in proxy inspection mode

Question 9

An admin creates a firewall policy allowing HTTP traffic from internal users to the internet. Users complain that they cannot access HTTPS websites. The admin checks and sees that the policy only has HTTP service. What is the BEST course of action to allow HTTPS while maintaining security?

Accepted Answer

Add the HTTPS service to the existing policy. Adding the HTTPS service (TCP/443) to the existing policy allows HTTPS traffic without creating a separate rule, which could introduce complexity or misordering issues. This approach maintains security by explicitly permitting only the required service rather than opening all traffic. FortiGate policies evaluate services as part of the match criteria, so modifying the existing policy is the most efficient and secure method.

Answer

Create a new policy above the existing one with HTTPS service

Answer

Use a security policy that automatically adds HTTPS

Answer

Change the HTTP service to ALL services

Question 10

What is the order of evaluation for firewall policies on a FortiGate?

Accepted Answer

From top to bottom, first match. FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.

Answer

Random order

Answer

From bottom to top

Answer

By policy ID in ascending order

Question 11

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

Accepted Answer

The VIP does not have NAT reflection enabled. The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.

Answer

The server is not responding to internal requests

Answer

The firewall policy for internal to VIP is missing

Answer

The VIP is configured on a different interface

Question 12

You run the following CLI command on a FortiGate:
# diagnose debug flow filter saddr 192.168.1.10
# diagnose debug flow show function enable
# diagnose debug enable
You then initiate a ping from 192.168.1.10 to 8.8.8.8. The output shows 'no matching policy'. What does this indicate?

Accepted Answer

The traffic is dropped by the implicit deny rule. The 'no matching policy' output from the debug flow indicates that the FortiGate evaluated the packet against its firewall policy table and found no explicit policy permitting the traffic from source 192.168.1.10 to destination 8.8.8.8. Since no matching policy exists, the packet is implicitly denied by the default deny-all rule at the end of the policy table, which drops the traffic without logging unless explicitly configured. This is the expected behavior when no permit policy is configured for the traffic flow.

Answer

The traffic is being NAT'd but not logged

Answer

The debug filter is incorrectly configured

Answer

There is a routing issue preventing the traffic

Question 13

An admin configures a central SNAT rule to translate source IP 10.0.0.0/24 to IP pool 203.0.113.1-203.0.113.10 using overload (PAT). A policy-based NAT on a specific policy also translates the same source to the interface IP. Traffic from 10.0.0.0/24 to the internet shows source IP as the interface IP, not from the IP pool. What is the reason?

Accepted Answer

Policy-based NAT overrides central SNAT rules. Policy-based NAT (PBNAT) takes precedence over central SNAT rules because it is applied directly to a specific firewall policy. When a policy matches traffic, its NAT configuration (including translation to the interface IP) is evaluated before any central SNAT rules. This override occurs regardless of the central SNAT rule's order or status, as PBNAT is considered more specific and thus higher priority in FortiOS.

Answer

The central SNAT rule is disabled

Answer

The policy is using fixed port range

Answer

The IP pool is out of addresses

Question 14

Which address object type allows you to match traffic based on the domain name in the HTTPS SNI field?

Accepted Answer

Wildcard FQDN. The Wildcard FQDN address object type in FortiGate allows you to match traffic based on the domain name in the HTTPS Server Name Indication (SNI) field. Unlike a standard FQDN, which matches the exact domain, the Wildcard FQDN supports patterns like *.example.com, enabling policy enforcement for subdomains and dynamic hostnames within a domain.

Answer

Geography

Answer

Subnet

Answer

FQDN

Question 15

An admin wants to apply different QoS markings to traffic from two different departments. The admin creates two firewall policies: one for Sales (policy ID 1) and one for Engineering (policy ID 2). Both policies have traffic shaping enabled. However, traffic from both departments receives the same QoS marking. What is the MOST likely mistake?

Accepted Answer

The admin applied the same traffic shaper to both policies. If the same traffic shaper is applied to both firewall policies, the QoS marking defined in that shaper will be identical for all matched traffic, regardless of the policy. Each policy must reference a distinct traffic shaper with the desired DSCP or 802.1p marking to differentiate the departments.

Answer

The policies are in the wrong order

Answer

QoS marking is only applied at the interface level

Answer

The traffic shaping policy is applied globally