NSE4 Firewall Policies and NAT Practice Test 16 — 15 Questions

Question 1

A network admin has configured a firewall policy allowing traffic from the 'internal' zone to the 'external' zone. The policy uses a service object 'HTTP' (TCP/80). Users report they can access HTTP websites but not HTTPS. The admin confirms no other policies block HTTPS. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HTTPS traffic is being dropped by implicit deny because no policy matches it. The firewall policy explicitly allows only HTTP (TCP/80) traffic from the internal zone to the external zone. HTTPS uses TCP/443, which is not included in the service object 'HTTP'. Since no other policy permits HTTPS, the traffic hits the implicit deny rule at the end of the policy list, which drops all unmatched traffic. This is the default behavior on FortiGate firewalls.

Answer

The FortiGate needs to perform SSL inspection on HTTPS traffic

Answer

There is a policy ordering issue; a later policy might block HTTPS

Answer

The service object 'HTTP' also includes TCP/443 by default

Question 2

A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?

Accepted Answer

Policy ID 2, because it matches the source interface and destination. Policy ID 2 is matched because it allows all traffic from the DMZ interface to the WAN destination interface without any service restriction. The packet originates from the DMZ interface and is destined to the internet (WAN), so the source and destination interfaces match Policy ID 2. Since Policy ID 2 does not specify a service, it implicitly permits all protocols, including HTTPS.

Answer

Policy ID 1, because it is first in order

Answer

Policy ID 2, but only if it has a service allowing HTTPS

Answer

Implicit deny, because no policy matches HTTPS traffic

Question 3

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

Accepted Answer

The firewall policy for HTTPS traffic is missing or has incorrect destination. The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.

Answer

The server's HTTPS service is not running

Answer

VIPs cannot share the same public IP address

Answer

The HTTPS VIP is configured with the wrong internal port

Question 4

Which of the following is a characteristic of policy-based NAT on a FortiGate?

Accepted Answer

NAT is configured directly in the firewall policy using the 'set nat' option. Policy-based NAT on a FortiGate is configured directly within a firewall policy using the 'set nat' command. This allows NAT to be applied selectively based on the policy's matching criteria (source, destination, service, etc.), rather than being defined as a separate rule. This approach is the traditional method on FortiGate and is distinct from Central NAT, which decouples NAT rules from firewall policies.

Answer

NAT is configured separately from firewall policies using Central NAT rules

Answer

NAT is applied to all traffic regardless of policy

Answer

NAT can only be used with IP pools

Question 5

An administrator needs to allow internal users to access a public web server using the server's private IP address, while external users access it via a public IP. Which TWO components are required?

Accepted Answer

A VIP (Virtual IP) mapping the public IP to the private IP. A VIP (Virtual IP) is required to map the public IP address to the private IP address of the web server, enabling external users to reach the server via the public IP while the FortiGate performs destination NAT (DNAT). A firewall policy must allow traffic from internal users to the server's private IP, as internal traffic does not traverse the VIP and must be permitted directly to the private address.

Answer

Central SNAT policy

Answer

An IP pool for source NAT

Answer

A static route on the FortiGate for the public IP

Question 6

A FortiGate is configured with policy-based NAT and multiple IP pools. The administrator wants traffic from the 192.168.1.0/24 subnet to use IP pool 'POOL1' (203.0.113.1-203.0.113.10) and traffic from 192.168.2.0/24 to use IP pool 'POOL2' (203.0.113.11-203.0.113.20). Which THREE steps are necessary?

Accepted Answer

Create two firewall policies, one for each subnet. Policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Answer

Configure a single firewall policy with both subnets in the source address group

Answer

Enable Central NAT and define two NAT policies

Question 7

Which TWO statements about firewall policy order are true?

Accepted Answer

Policies are evaluated in the order they appear (top-down). FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Answer

If a packet does not match any policy, it is allowed by default

Answer

A more specific policy should be placed below a less specific one to avoid shadowing

Answer

Once a policy is matched, subsequent policies are still evaluated for logging purposes

Question 8

An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?

Accepted Answer

A traffic shaper object that defines bandwidth limits. A traffic shaper object is a fundamental component that defines the bandwidth limits (e.g., guaranteed bandwidth, maximum bandwidth, priority) that will be applied to traffic. Without this object, the firewall has no parameters to enforce rate limiting. In FortiGate, the traffic shaper object is created under 'Traffic Shapers' and can be per-policy or per-IP.

Answer

A static route for the YouTube subnet

Answer

A schedule object to apply the shaper only during business hours

Question 9

An administrator needs to block access to a specific website using FQDN address objects. Which TWO steps are necessary?

Accepted Answer

Create an FQDN address object for the website. Creating an FQDN address object (Option A) is necessary because it allows the firewall to resolve the fully qualified domain name to an IP address dynamically, enabling policy enforcement based on the domain rather than a static IP. Adding a firewall policy with destination set to that FQDN object and action DENY (Option B) is required to actually block traffic to the website by matching the resolved IP addresses against the policy. Without both steps, the firewall cannot identify and deny traffic to the specific website using FQDN-based control.

Answer

Create a wildcard FQDN address object

Answer

Configure a DNS filter to block the FQDN

Answer

Create a VIP for the website

Question 10

A FortiGate administrator has configured a firewall policy allowing HTTP traffic from the internal network (10.0.1.0/24) to the DMZ server (192.168.1.10). The policy is placed after a deny-all policy that blocks traffic from internal to DMZ. Even though the allow policy is more specific, traffic is still being denied. What is the most likely cause?

Accepted Answer

The deny-all policy is placed above the allow policy in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom. The first matching policy is applied, and subsequent policies are ignored. Since the deny-all policy is placed above the more specific allow policy, traffic from 10.0.1.0/24 to 192.168.1.10 matches the deny-all first and is dropped, never reaching the allow rule.

Answer

The deny-all policy has a higher policy ID than the allow policy

Answer

The allow policy is configured with the wrong source interface

Answer

The allow policy uses a schedule that is not active at the current time

Question 11

A FortiGate administrator needs to allow all internal users (10.0.0.0/8) to access a web server in the DMZ (192.168.1.100) using HTTPS. The administrator wants to apply a web filter profile to block malicious URLs while allowing legitimate traffic. Which of the following is the correct policy configuration?

Accepted Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=ACCEPT, web filter profile=default. The policy must match the HTTPS service (TCP/443) to allow encrypted web traffic to the DMZ web server, and the web filter profile is applied to inspect the HTTPS traffic for malicious URLs. The default web filter profile can block malicious URLs while allowing legitimate HTTPS traffic, provided SSL inspection is configured to enable content filtering.

Answer

Policy: source=internal, destination=DMZ, service=ALL, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTP, action=ACCEPT, web filter profile=default

Answer

Policy: source=internal, destination=DMZ, service=HTTPS, action=DENY, web filter profile=default

Question 12

A FortiGate administrator is configuring a firewall policy to allow inbound HTTPS traffic from the internet to an internal web server. The web server has a private IP address 10.0.0.10. The administrator wants to translate the destination IP to the internal server using a Virtual IP (VIP). Which TWO of the following must be configured for the VIP to work correctly? (Choose two.)

Accepted Answer

The VIP must have the external IP set to a public IP address assigned to the FortiGate's WAN interface. A Virtual IP (VIP) must map a public IP address (typically assigned to the FortiGate's WAN interface) to the internal private IP of the web server. Without setting the external IP to a public address, the VIP cannot receive inbound traffic from the internet. Option D is correct because the firewall policy must reference the VIP as the destination address object; this triggers the destination NAT translation from the public IP to the private IP 10.0.0.10.

Answer

An IP Pool must be configured for the web server's return traffic

Answer

The VIP must have port forwarding enabled with the external and internal ports set to 443

Answer

The firewall policy must have NAT enabled

Question 13

An administrator is troubleshooting why traffic from a specific VLAN (192.168.10.0/24) to the internet is not being NATed correctly. The firewall policy allows the traffic with NAT enabled and uses an IP Pool (overload) for the source translation. The IP Pool is configured with the address 203.0.113.10. However, the traffic still shows the original source IP. Which THREE of the following could cause this issue? (Choose three.)

Accepted Answer

The firewall policy does not have the IP Pool selected in the NAT section. The IP Pool must be explicitly selected in the NAT section of the firewall policy for the pool to be used for source translation. Without this selection, the firewall will use the default NAT behavior (typically the outgoing interface IP) or no NAT at all, even if NAT is enabled on the policy.

Answer

There is a Central SNAT rule with higher priority that does not match the traffic

Answer

The IP Pool uses one-to-one NAT instead of overload

Question 14

A FortiGate administrator needs to block all traffic from a specific IP address (10.0.0.100) to the internet, but allow all other internal users. The administrator has created a firewall policy with source=10.0.0.100, destination=all, service=all, action=DENY, and placed it at the top of the policy list. Which TWO additional steps should the administrator take to ensure the block is effective? (Choose two.)

Accepted Answer

Enable the policy. A newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

Answer

Configure an IP Pool for the deny policy

Answer

Add a schedule to the policy for business hours

Answer

Set the action to ACCEPT

Question 15

An administrator is configuring policy-based routing (PBR) on a FortiGate to route traffic from a specific subnet (172.16.1.0/24) through a different internet connection (wan2) instead of the default route via wan1. The administrator has created a PBR rule matching source 172.16.1.0/24 and set the gateway to the next-hop IP on wan2. The traffic is still using wan1. Which THREE of the following could be causing the issue? (Choose three.)

Accepted Answer

The PBR rule's gateway is not reachable from the FortiGate. PBR requires the specified next-hop gateway to be reachable via a directly connected route or a static route; if the gateway IP on wan2 is not reachable (e.g., due to a missing ARP entry or link failure), the FortiGate will fall back to the routing table and use the default route via wan1. The FortiGate performs a reachability check on the PBR gateway before applying the rule.

Answer

The PBR rule's priority is set too high (e.g., 100) and a static route with lower priority is used instead

Answer

The PBR rule's destination is set to 'all' but the traffic's destination is not covered