NSE4 Firewall Policies and NAT Practice Test 15 — 15 Questions

Question 1

A FortiGate with multiple VDOMs has a policy that allows traffic from VDOM A to VDOM B. The admin notices that traffic from VDOM A to a specific server in VDOM B is being dropped. The session log shows 'deny by forward policy check'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy in VDOM B to allow traffic from VDOM A is missing or misconfigured. The session log message 'deny by forward policy check' indicates that the traffic was explicitly denied by a firewall policy rule, not by a routing or resource issue. In a multi-VDOM setup, traffic from VDOM A to VDOM B must be permitted by a policy in VDOM B (the destination VDOM) that allows traffic from the inter-VDOM link or from VDOM A. If that policy is missing or misconfigured, the FortiGate will drop the traffic and log this exact denial.

Answer

The inter-VDOM link is down

Answer

NAT is required for inter-VDOM traffic

Answer

The source VDOM has exceeded its session limit

Question 2

What is the purpose of a schedule object in a firewall policy?

Accepted Answer

To specify the time of day when the policy is effective. A schedule object in a FortiGate firewall policy defines the time range (e.g., specific hours, days of the week, or recurring intervals) during which the policy is active. When the current time falls outside the schedule, the policy is automatically disabled, allowing administrators to enforce time-based access control without manual intervention. This is distinct from other policy attributes like bandwidth shaping or session limits.

Answer

To set the bandwidth limit for the policy

Answer

To prioritize traffic based on application

Answer

To limit the number of concurrent sessions

Question 3

An admin needs to configure NAT so that internal users (10.0.0.0/24) accessing the internet (any destination) are translated using an IP pool (203.0.113.10-203.0.113.20) with overload. The admin also needs to ensure that traffic from a specific server (10.0.0.100) always uses a fixed source port range (10000-20000) when translated. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a central SNAT rule for 10.0.0.0/24 using the IP pool with overload enabled. Central SNAT allows you to translate traffic from the entire 10.0.0.0/24 subnet using an IP pool (203.0.113.10-203.0.113.20) with overload (PAT), which is the standard method for enabling many internal users to share a smaller pool of public IPs. Option E is correct because you need a separate, more specific central SNAT rule for the server 10.0.0.100 that uses the same IP pool but with a fixed port range (10000-20000) enabled, ensuring its translated source ports always fall within that range.

Answer

Configure the IP pool with one-to-one NAT

Answer

Use policy-based NAT instead of central SNAT

Answer

Disable NAT on the firewall policy for the server

Question 4

A FortiGate has two firewall policies for HTTP traffic to the internet: Policy A (source: 10.0.1.0/24) and Policy B (source: 10.0.2.0/24). Both policies have the same destination and service. The admin wants to apply a traffic shaper to limit bandwidth for Policy B. Which TWO actions are correct? (Choose two.)

Accepted Answer

Create a traffic shaping policy that matches Policy B's source and apply the shaper. A traffic shaping policy can match the source address of Policy B (10.0.2.0/24) and apply a specific shaper, allowing granular bandwidth control without affecting Policy A. Option E is correct because FortiGate allows a traffic shaper to be applied directly within a firewall policy's 'Traffic Shaping' settings, which overrides any default or VDOM-level shaping. Both methods achieve the goal of limiting bandwidth for Policy B only.

Answer

Apply the shaper to both policies and use a different shaper for Policy B

Answer

Use a QoS queue on the outgoing interface

Answer

Enable traffic shaping on the VDOM

Question 5

Which of the following best describes the policy lookup order on a FortiGate firewall?

Accepted Answer

Policies are evaluated in the order they appear in the policy list, from top to bottom. FortiGate firewalls evaluate firewall policies sequentially from the top of the policy list downward. The first policy that matches the source, destination, service, and other attributes of a packet is applied, and no further policies are checked. This top-down evaluation ensures deterministic traffic handling and is fundamental to FortiGate's stateful inspection engine.

Answer

Policies are evaluated based on the number of hits, least-hit first

Answer

Policies are evaluated randomly to balance load

Answer

The policy with the highest priority number is evaluated first

Question 6

An admin configures a Central SNAT rule to translate internal 192.168.1.0/24 to 203.0.113.10 when accessing the internet. However, traffic from 192.168.1.100 to 8.8.8.8 shows source IP 192.168.1.100 in logs. What is the MOST likely cause?

Accepted Answer

The Central SNAT rule is applied to the wrong outgoing interface. The Central SNAT rule is not being applied to the traffic. The most likely cause is that the rule specifies an outgoing interface different from the one used to reach 8.8.8.8, so the rule does not match and no source translation occurs.

Answer

The Central SNAT rule is disabled

Answer

The firewall policy has an IP pool configured, overriding Central SNAT

Answer

The destination address in the Central SNAT rule is incorrect

Question 7

When creating a firewall policy, an admin wants to ensure that traffic from a specific user group is allowed only during business hours (Monday to Friday, 09:00-18:00). Which object type must be configured and applied to the policy?

Accepted Answer

A schedule object with a recurring schedule. To restrict traffic based on time, a firewall policy must reference a schedule object. A recurring schedule defines specific days and hours (e.g., Monday–Friday, 09:00–18:00) and is applied directly to the policy. This allows the FortiGate to permit or deny traffic based on the current time without additional profiles or user group modifications.

Answer

A security profile with time-based filtering

Answer

A user group object with time restrictions

Answer

A traffic shaping policy with a time-based rule

Question 8

An admin wants to block traffic from a specific geographic region (e.g., North Korea) from reaching the FortiGate's external interface. Which address object type should be used in the firewall policy?

Accepted Answer

Geography address object. A geography address object allows the firewall to match traffic based on the source or destination IP address's registered country. FortiGate uses a built-in GeoIP database to map IP addresses to geographic regions, making it the correct choice for blocking traffic from a specific country like North Korea.

Answer

Subnet address object

Answer

FQDN address object

Answer

Wildcard FQDN address object

Question 9

Which statement about the implicit deny policy on a FortiGate is true?

Accepted Answer

It is always at the bottom of the policy list and denies all unmatched traffic. The implicit deny policy is a built-in, non-configurable security policy that resides at the very bottom of the FortiGate policy list. It automatically denies all traffic that does not match any explicit user-defined policy, ensuring that only explicitly permitted traffic is allowed through the firewall.

Answer

It is a user-configurable policy that can be deleted

Answer

It allows traffic that matches no other policy

Answer

It can be moved to a different position in the policy list

Question 10

An admin needs to translate the source IP of traffic from multiple internal hosts to a single public IP when accessing the internet, while keeping track of each session. Which NAT method should be used?

Accepted Answer

Overload NAT (Port Address Translation). Overload NAT, also known as Port Address Translation (PAT), allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is the correct method for translating source IPs from multiple internal hosts to one public IP while maintaining session tracking, as it uses the transport-layer port number to differentiate between concurrent connections.

Answer

Fixed port range NAT

Answer

One-to-one NAT

Answer

Central SNAT without overload

Question 11

An admin wants to ensure that VoIP traffic (UDP ports 5060-5061) from the internal network to the internet is prioritized over other traffic when the WAN link is congested. Which feature should be configured on the firewall policy?

Accepted Answer

Traffic shaping policy with a guaranteed bandwidth allocation and high priority. A traffic shaping policy with guaranteed bandwidth allocation and high priority ensures that VoIP traffic (UDP ports 5060-5061) receives the necessary bandwidth and is prioritized over other traffic during WAN congestion. Traffic shaping policies on FortiGate allow you to set guaranteed bandwidth, maximum bandwidth, and priority levels, which directly address congestion by reserving resources for critical traffic like VoIP.

Answer

Enable NAT on the policy

Answer

QoS marking only (DSCP)

Answer

Configure a security profile with QoS settings

Question 12

A FortiGate admin configures an IP pool with type 'Fixed Port Range' to translate source IPs from 192.168.1.0/24 to 203.0.113.0/28 using port range 10000-20000. After applying the IP pool to a policy, some users cannot establish connections while others work. What is the MOST likely cause?

Accepted Answer

The IP pool's port range is exhausted because the number of internal hosts exceeds the number of available port ranges. Fixed Port Range NAT uses a one-to-one mapping of source IPs to unique port ranges. With a /28 pool (16 IPs) and port range 10000-20000 (10,001 ports), each internal host gets a dedicated port block. If more than 16 concurrent internal hosts attempt NAT, the pool is exhausted, causing connection failures for excess hosts. This matches the symptom where some users work and others do not.

Answer

The internal subnet is using RFC 1918 addresses that cannot be NATed

Answer

The IP pool is configured with overload enabled, causing conflicts

Answer

The firewall policy has NAT disabled

Question 13

A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)

Accepted Answer

An address object for the web server 192.168.2.10. The firewall policy must specify the destination address of the traffic, which is the web server at 192.168.2.10. Without an address object for this server, the policy cannot match the destination IP of the VPN users' HTTP requests.

Answer

A service object for HTTP (TCP/80)

Answer

A user group object for VPN authentication

Answer

A schedule object for business hours

Question 14

An admin needs to create a firewall policy that allows SMTP traffic (TCP/25) from the internal network (10.0.0.0/24) to a mail server in the DMZ (172.16.1.10). Additionally, the admin wants to ensure that the mail server can only be accessed by the internal network, not from the internet. Which THREE settings must be configured in the firewall policy? (Choose three.)

Accepted Answer

Source interface set to 'internal'. The source interface must be set to 'internal' to restrict the firewall policy to traffic originating from the internal network (10.0.0.0/24). This ensures that only hosts on the internal interface can reach the mail server, effectively blocking any internet traffic that would arrive on a different interface like 'wan'.

Answer

Set schedule to 'always'

Answer

Enable NAT to translate source IP

Question 15

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

Accepted Answer

Overload NAT. Overload NAT (also known as Port Address Translation or PAT) is the correct method because it allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is exactly what the administrator needs: translating all internal-to-internet traffic to one public IP.

Answer

Central SNAT

Answer

One-to-one NAT

Answer

Fixed port range NAT