NSE4 Firewall Policies and NAT Practice Test 15 — 15 Questions

Question 1

A FortiGate admin configures an IP pool with type 'Fixed Port Range' to translate source IPs from 192.168.1.0/24 to 203.0.113.0/28 using port range 10000-20000. After applying the IP pool to a policy, some users cannot establish connections while others work. What is the MOST likely cause?

Accepted Answer

The IP pool's port range is exhausted because the number of internal hosts exceeds the number of available port ranges. Fixed port range assigns a unique port range per internal IP. If the number of internal hosts exceeds the number of available port ranges, no range will be available for new hosts, causing failures.

Answer

The internal subnet is using RFC 1918 addresses that cannot be NATed

Answer

The IP pool is configured with overload enabled, causing conflicts

Answer

The firewall policy has NAT disabled

Question 2

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy needs to identify the source (VPN users) and destination (web server). Address objects for the VPN subnet and the web server IP are required.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 3

An admin is troubleshooting why traffic from VLAN 10 to the internet is not being translated by a Central SNAT rule. The Central SNAT rule is configured with source interface 'port2.10', destination interface 'wan1', source address '192.168.10.0/24', and IP pool 'pool1'. The firewall policy for internet access has NAT enabled but no IP pool attached. Which THREE steps should the admin take to resolve the issue? (Choose three.)

Accepted Answer

Verify that the firewall policy does not have an IP pool configured. Central SNAT rules require that the firewall policy has NAT enabled but no IP pool attached. If the policy has an IP pool, Central SNAT is bypassed. Also, the Central SNAT rule must match the traffic's source interface and destination interface. Common issues: policy has an IP pool attached, or the policy's NAT is disabled, or the Central SNAT rule's interface is wrong.

Answer

Ensure the Central SNAT rule's IP pool is configured with overload enabled

Answer

Disable NAT on the firewall policy to force Central SNAT usage

Question 4

An admin needs to create a firewall policy that allows SMTP traffic (TCP/25) from the internal network (10.0.0.0/24) to a mail server in the DMZ (172.16.1.10). Additionally, the admin wants to ensure that the mail server can only be accessed by the internal network, not from the internet. Which THREE settings must be configured in the firewall policy? (Choose three.)

Accepted Answer

Source interface set to 'internal'. To define the traffic, the policy needs source interface (internal), destination interface (DMZ), source address (internal subnet), and destination address (mail server). Also, the service must be SMTP. Additionally, to block internet access, the policy from DMZ to internet should not exist, but the question asks for settings in the policy for internal traffic. The three required are source interface, destination interface, and service. Address objects are also required but the question asks for settings, not objects. However, the options include interface and service settings.

Answer

Set schedule to 'always'

Answer

Enable NAT to translate source IP

Question 5

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

Accepted Answer

Overload NAT. Overload NAT (Port Address Translation) allows many internal IPs to share one public IP by using unique source ports.

Answer

Central SNAT

Answer

One-to-one NAT

Answer

Fixed port range NAT

Question 6

A network admin has configured a firewall policy allowing traffic from the 'internal' zone to the 'external' zone. The policy uses a service object 'HTTP' (TCP/80). Users report they can access HTTP websites but not HTTPS. The admin confirms no other policies block HTTPS. What is the most likely cause?

Accepted Answer

HTTPS traffic is being dropped by implicit deny because no policy matches it. The policy only permits HTTP (TCP/80). HTTPS uses TCP/443, which is not allowed unless a separate service is defined.

Answer

The FortiGate needs to perform SSL inspection on HTTPS traffic

Answer

There is a policy ordering issue; a later policy might block HTTPS

Answer

The service object 'HTTP' also includes TCP/443 by default

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is a TCP session that has been active for 1 hour and will expire in about 1 hour. The output shows a TCP session (proto=6) in state 01 (possibly ESTABLISHED or SYN_SENT), duration 3600 seconds, with 3599 seconds until expiry. It is a normal session.

Answer

The session is a TCP session that has been active for 1 hour and will expire immediately

Answer

The session is a UDP session that has been idle for 3600 seconds

Answer

The session is an ICMP session with a short timeout

Question 8

An administrator needs to allow FTP traffic from the internal network to a specific server on the internet. The FTP server uses passive mode. Which service object should be used in the firewall policy to ensure proper operation?

Accepted Answer

Use the predefined 'FTP' service object and also allow a high port range (e.g., TCP/1024-65535). FTP uses TCP/21 for control. Passive mode uses a range of high ports for data. A generic FTP service object may include TCP/21 and TCP/20 (active mode). For passive, a custom service with TCP/21 and the data port range is needed, but the question asks which service object to use. Typically, the predefined 'FTP' service includes TCP/21 only. Many deployments create a custom service for passive. However, the best answer is to use the FTP service and also allow the ephemeral port range.

Answer

Use a custom service object with TCP/21 and TCP/20

Answer

Use the predefined 'FTP' service object

Answer

Use the 'ALL' service object

Question 9

A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?

Accepted Answer

Policy ID 2, because it matches the source interface and destination. Policy lookup is performed top-down. The first matching policy is used. Policy 1 matches only LAN traffic, not DMZ. Policy 2 matches all traffic from DMZ to WAN, so it matches the packet.

Answer

Policy ID 1, because it is first in order

Answer

Policy ID 2, but only if it has a service allowing HTTPS

Answer

Implicit deny, because no policy matches HTTPS traffic

Question 10

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

Accepted Answer

The firewall policy for HTTPS traffic is missing or has incorrect destination. VIPs with the same external IP but different ports should work. However, if no policy allows HTTPS traffic to the VIP, it will be dropped. Alternatively, the VIP configuration might be incomplete.

Answer

The server's HTTPS service is not running

Answer

VIPs cannot share the same public IP address

Answer

The HTTPS VIP is configured with the wrong internal port

Question 11

Which of the following is a characteristic of policy-based NAT on a FortiGate?

Accepted Answer

NAT is configured directly in the firewall policy using the 'set nat' option. Policy-based NAT uses the 'set nat' command in a firewall policy to enable source NAT, while Central NAT uses a separate NAT policy table.

Answer

NAT is configured separately from firewall policies using Central NAT rules

Answer

NAT is applied to all traffic regardless of policy

Answer

NAT can only be used with IP pools

Question 12

An administrator is troubleshooting a connectivity issue where users in the 10.0.0.0/24 subnet cannot access the internet. The FortiGate has the following policies (in order):
1: allow 10.0.0.0/24 -> any, service: HTTP, HTTPS
2: deny any -> any, service: all
Users can browse HTTP but not HTTPS. Which TWO actions would resolve the issue?

Accepted Answer

Verify that the HTTPS service object is correctly defined and not misspelled. Policy 1 only allows HTTP and HTTPS. If HTTPS is not working, check if HTTPS is correctly defined. Also, policy 2 denies all other traffic. The solution is to ensure HTTPS is allowed in policy 1 and that it is correctly defined.

Answer

Create a new policy above policy 1 allowing all traffic from 10.0.0.0/24

Answer

Move policy 2 above policy 1

Answer

Check if the HTTPS service object includes both TCP/443 and TCP/8443

Question 13

An administrator needs to allow internal users to access a public web server using the server's private IP address, while external users access it via a public IP. Which TWO components are required?

Accepted Answer

A VIP (Virtual IP) mapping the public IP to the private IP. To allow internal users to access the server via private IP, a firewall policy must allow the traffic. To allow external users, a VIP is used to map the public IP to the private IP, and a corresponding policy is needed.

Answer

Central SNAT policy

Answer

An IP pool for source NAT

Answer

A static route on the FortiGate for the public IP

Question 14

A FortiGate is configured with policy-based NAT and multiple IP pools. The administrator wants traffic from the 192.168.1.0/24 subnet to use IP pool 'POOL1' (203.0.113.1-203.0.113.10) and traffic from 192.168.2.0/24 to use IP pool 'POOL2' (203.0.113.11-203.0.113.20). Which THREE steps are necessary?

Accepted Answer

Create two firewall policies, one for each subnet. Option A is correct because policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Answer

Configure a single firewall policy with both subnets in the source address group

Answer

Enable Central NAT and define two NAT policies

Question 15

Which TWO statements about firewall policy order are true?

Accepted Answer

Policies are evaluated in the order they appear (top-down). FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Answer

If a packet does not match any policy, it is allowed by default

Answer

A more specific policy should be placed below a less specific one to avoid shadowing

Answer

Once a policy is matched, subsequent policies are still evaluated for logging purposes