NSE4 Firewall Policies and NAT Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Question 2

Drag and drop the steps to configure SSL VPN on FortiGate into the correct order.

Question 3

Match each Fortinet product to its primary role.

Question 4

Match each FortiGate logging destination to its description.

Question 5

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Accepted Answer

Create a traffic shaping policy and apply it to the firewall policy. Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

Answer

Increase the bandwidth of the internet link

Answer

Configure policy-based routing for HTTPS traffic

Answer

Enable QoS on the outgoing interface

Question 6

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

Accepted Answer

The implicit deny rule. The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Answer

The security profile group

Answer

The default route

Answer

The last explicit deny policy in the policy list

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP handshake is incomplete; the SYN-ACK has not been received. The output shows a TCP session (proto=6) with proto_state=01, which in Fortinet's session table indicates the session is in the SYN-SENT state (TCP state 1). This means the initial SYN has been sent but the SYN-ACK has not yet been received, so the TCP three-way handshake is incomplete. The duration and expire values reflect the session's age and remaining lifetime, not its establishment status.

Answer

The session is a UDP session

Answer

The session has been idle for 3600 seconds

Answer

The session is fully established and will expire in 3599 seconds

Question 8

An admin is configuring a policy-based NAT rule (central NAT) to translate internal users' source IPs to the external IP of the FortiGate interface. However, users complain that some applications fail. The admin notices that the NAT rule is using 'dynamic IP pool' with overload. What is the MOST likely cause of the application failures?

Accepted Answer

The applications are sensitive to NAT and require a fixed port range. Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.

Answer

The IP pool is exhausted and no more translations are available

Answer

The route to the destination is missing

Answer

The firewall policy does not have NAT enabled

Question 9

A FortiGate admin wants to create a firewall policy that allows traffic from the internal network to the internet. The source is a subnet 192.168.1.0/24, and the destination is 'all'. The admin wants to apply NAT to hide internal IPs. Which NAT configuration is BEST suited for this scenario?

Accepted Answer

Enable 'NAT' on the firewall policy and use the outgoing interface address. Option C is correct because enabling NAT on the firewall policy with the outgoing interface address is the standard method for source NAT (masquerading) in FortiGate. This configuration translates all internal source IPs (192.168.1.0/24) to the single IP address of the egress interface, hiding the internal subnet from the internet. It is the simplest and most efficient approach for typical internet-bound traffic, requiring no additional objects like IP pools or VIPs.

Answer

Configure a VIP for source NAT

Answer

Use policy-based routing to send traffic through a NAT device

Answer

Create a one-to-one IP pool and apply it to the policy

Question 10

An admin notices that a firewall policy allowing inbound HTTPS to a server is not matching traffic. The policy has source set to 'all', destination to the server's IP, and service to HTTPS. The admin checks the policy list and sees that policy ID 1 matches the traffic. What is the MOST likely reason the intended policy (ID 10) is not matching?

Accepted Answer

Policy ID 1 has a higher priority and matches before policy ID 10. Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

Answer

The firewall policy is disabled

Answer

The service object for HTTPS is misconfigured in policy ID 10

Answer

The destination address is incorrect in policy ID 10

Question 11

Which of the following is a valid address object type in FortiGate that can be used to match traffic based on the domain name of the destination?

Accepted Answer

FQDN. FQDN address objects allow matching traffic based on fully qualified domain names, which are resolved to IP addresses dynamically.

Answer

Wildcard FQDN

Answer

Subnet

Answer

Geography

Question 12

An admin wants to block all traffic from a specific geographic region. Which address object type should be used in the firewall policy source?

Accepted Answer

Geography. Option D is correct because FortiGate firewalls include a built-in Geography address object type that allows policies to match traffic based on the source or destination IP address's registered country or region. This object uses GeoIP databases to classify IP addresses, enabling administrators to block or allow traffic from entire geographic areas without needing to manually list individual subnets or ranges.

Answer

FQDN

Answer

Subnet

Answer

IP range

Question 13

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

Accepted Answer

The VIP is configured for port forwarding only for HTTP (port 80). The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Answer

The web server is not listening on HTTPS

Answer

The VIP is using overload mode instead of one-to-one

Answer

The firewall policy allowing traffic to the VIP only permits HTTP

Question 14

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

Accepted Answer

The port range for each IP in the pool is exhausted. With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Answer

The firewall policy has 'set nat enable' disabled

Answer

The route to the internet is missing

Answer

The pool does not have enough IPs to cover all users

Question 15

A FortiGate admin wants to ensure that traffic destined to a specific web server is inspected by an IPS profile. Which configuration is necessary?

Accepted Answer

Create a security profile group containing the IPS profile and apply it to the policy. Option C is correct because in FortiGate, IPS inspection is applied via a security profile group that includes the IPS profile, which is then attached to a firewall policy. The firewall policy itself does not have a direct 'enable IPS' toggle; instead, IPS profiles are part of the security profiles that must be explicitly assigned to the policy to inspect traffic.

Answer

Enable IPS on the firewall policy directly

Answer

Set the policy's action to 'IPS'

Answer

Configure a VIP for the web server