NSE4 Firewall Policies and NAT Practice Test 15 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose firewall iprope list. The 'diagnose firewall iprope list' command (D) displays the kernel's internal firewall rule list, allowing the administrator to verify the exact order and matching criteria of all policies. The 'diagnose debug flow' command (E) enables real-time packet flow tracing, showing which policy each packet matches and why it is accepted or denied. Together, these two commands directly reveal if traffic is matching a different policy than intended.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 2

A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?

Accepted Answer

A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP. A firewall policy from WAN to DMZ is required to permit the inbound HTTPS traffic to the VIP. The policy must reference the VIP as the destination and allow HTTPS (TCP/443) to pass through the FortiGate.

Answer

A static route for 203.0.113.10 pointing to the ISP gateway

Answer

A Central SNAT policy to translate the source to the FortiGate's IP

Question 3

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

Accepted Answer

The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443). The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Answer

The source interface is misconfigured

Answer

The destination address object 'all' is incorrect

Answer

The policy order is incorrect and a deny policy above is blocking the traffic

Question 4

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

Accepted Answer

Enable NAT on the firewall policy without specifying an IP pool. When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.

Answer

Create an IP pool with the external IP and reference it in the firewall policy

Answer

Create a VIP for the web server and reference it in the firewall policy

Answer

Configure Central SNAT and a matching rule

Question 5

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

Accepted Answer

Policy ID 2 because it matches the source and service. Policy ID 2 matches because the source IP 10.0.1.50 falls within the 10.0.1.0/24 subnet, and the service is set to ALL, which includes HTTP. FortiGate uses a top-down policy lookup and selects the first match based on source, destination, and service; since Policy ID 2 matches all criteria, it is applied.

Answer

Both policies, and the traffic is load-balanced

Answer

No policy matches, traffic is denied by implicit deny

Answer

Policy ID 1 because it is first in order and matches the service HTTP

Question 6

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

Accepted Answer

Change the IP pool type to 'Fixed Port Range'. When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.

Answer

Disable NAT and use policy-based routing

Answer

Use Central SNAT instead of policy-based NAT

Answer

Enable 'Preserve Source Port' in the firewall policy

Question 7

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

Accepted Answer

Create an IP Pool with 203.0.113.2 and reference it in the policy. An IP Pool in FortiGate allows you to override the source IP address for specific traffic, even when NAT is enabled on the policy. By creating an IP Pool with the single address 203.0.113.2 and referencing it in the firewall policy, traffic from 10.0.0.10 will be NATed to that specific IP instead of the outgoing interface address (203.0.113.1). This is the standard method for fixed source NAT (also called 'static NAT' or 'one-to-one NAT') for a specific host.

Answer

Create a VIP with the external IP and apply it to the policy

Answer

Configure route-based NAT

Answer

Set the NAT to 'Use Outgoing Interface Address'

Question 8

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

Accepted Answer

Create a traffic shaper and reference it in the firewall policy. Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.

Answer

Use an application control profile to restrict video streaming

Answer

Configure policy-based routing to shape traffic

Answer

Enable QoS on the interface and set the bandwidth limit

Question 9

A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?

Accepted Answer

The new policy is placed below the older policy in the policy list. A FortiGate firewall evaluates policies sequentially from top to bottom, applying the first match. If the new policy is placed below an older policy with a broader source definition, traffic from 'Internal_Net' will match the older policy first and never reach the new policy. Therefore, option B is the correct answer.

Answer

The source address object 'Internal_Net' has an incorrect subnet mask

Answer

The new policy is disabled

Answer

Traffic shaping is applied to the new policy and is interfering

Question 10

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

Accepted Answer

In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload. The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.

Answer

Create a central SNAT policy with the source as the mail server and the translated IP as the desired address

Answer

Use a VIP with port forwarding to translate the source

Answer

Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool

Question 11

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

Accepted Answer

FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually. When a firewall policy is deleted on a FortiGate, the existing sessions that were created by that policy are not automatically removed. The FortiGate continues to process those sessions until they expire naturally based on their timeout values. In this case, the sessions with 'proto=6' (TCP) and 'expire=3599' seconds remaining will persist until the timer counts down, even though the originating policy no longer exists. The admin must manually clear them using 'diagnose sys session clear' or wait for the timeout to expire.

Answer

The sessions are using UDP protocol, which has a longer timeout

Answer

The sessions are protected by a different policy that still exists

Answer

The sessions are in a different VDOM

Question 12

A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?

Accepted Answer

The traffic is in a different VDOM than the policy. In a multi-VDOM FortiGate, each VDOM operates as an independent virtual firewall with its own routing table, policies, and interfaces. A firewall policy created in the root VDOM only applies to traffic that enters and exits interfaces assigned to that root VDOM. If the traffic originates from or is destined to an interface belonging to a different VDOM, it will never match the root VDOM policy, causing the traffic to be dropped or handled by the correct VDOM's policies.

Answer

The internet-facing interface is not part of any VDOM

Answer

The subnet object is defined in the wrong address group

Answer

The policy is placed at the bottom of the list

Question 13

An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?

Accepted Answer

The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP. When a firewall policy has NAT enabled (typically 'Enable NAT' or 'Use Outgoing Interface Address'), the FortiGate performs source NAT (SNAT) on the traffic, replacing the original client source IP with the IP of its egress interface (the internal interface in this scenario). This is standard behavior for source NAT, which hides the original client IP from the internal server, causing the server logs to show the FortiGate's internal interface IP instead of the actual client IP.

Answer

The VIP is configured with port forwarding and the server is expecting a different port

Answer

The VIP is using a different public IP than expected

Answer

The server's routing is misconfigured and traffic is returning via a different path

Question 14

Which statement best describes the implicit deny policy at the end of a FortiGate policy list?

Accepted Answer

It is always present and denies any traffic that does not match an explicit allow policy. The implicit deny policy is a built-in, last-resort rule at the bottom of the FortiGate policy list that silently drops any traffic not matching an explicit allow policy. It cannot be moved, disabled, or deleted because it is a fundamental security mechanism ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It denies all traffic that does not match any explicit policy, and it logs the denied traffic

Answer

It can be moved to a different position in the policy list

Answer

It can be disabled or deleted by the admin

Question 15

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Accepted Answer

diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80. B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.

Answer

execute ping 203.0.113.50

Answer

diagnose debug flow

Answer

get firewall policy