NSE4 Firewall Policies and NAT Practice Test 2 — 15 Questions

Question 1

An admin configures a one-to-one IP Pool to map 10.0.1.0/28 to 203.0.113.16/28. A host with IP 10.0.1.5 initiates a connection to the internet. Which source IP will be used for the translated packet?

Accepted Answer

203.0.113.21. In a one-to-one IP Pool NAT configuration, the mapping is based on the subnet offset. The internal subnet 10.0.1.0/28 has 16 addresses (10.0.1.0–10.0.1.15), and the external pool 203.0.113.16/28 also has 16 addresses (203.0.113.16–203.0.113.31). The host 10.0.1.5 is the 6th usable IP (offset 5 from the network address), so it maps to the 6th IP in the external pool: 203.0.113.16 + 5 = 203.0.113.21.

Answer

203.0.113.20

Answer

203.0.113.5

Answer

203.0.113.16

Question 2

Which of the following is the default action of a FortiGate firewall policy if no policy matches the traffic?

Accepted Answer

Deny. FortiGate firewall policies operate on a 'first-match' basis, and if no policy matches the traffic, the default action is to deny the traffic. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall. The implicit deny rule is automatically applied at the end of the policy list and cannot be removed or modified.

Answer

Log and drop

Answer

Redirect to authentication

Answer

Accept

Question 3

A FortiGate admin wants to ensure that traffic from the internal network (192.168.1.0/24) to the internet uses a specific public IP (203.0.113.10) for source NAT, and that the same public IP is also used for inbound connections to an internal web server (10.0.1.10) on port 443. Which TWO configurations are required? (Choose two.)

Accepted Answer

Configure an IP Pool with type Overload using 203.0.113.10. An IP Pool with type Overload allows multiple internal hosts to share a single public IP (203.0.113.10) for source NAT when traffic goes to the internet. This is the standard method for PAT (Port Address Translation) in FortiGate, enabling many-to-one NAT.

Answer

Create a firewall policy with source NAT enabled and the IP Pool selected

Answer

Configure Central SNAT with the same public IP

Question 4

An administrator configures a VIP for inbound HTTP traffic to an internal server (192.168.1.10:80). External users can reach the server via the VIP, but internal users on the same subnet as the server cannot access the server using its public IP. What is the most likely cause?

Accepted Answer

NAT reflection (hairpin NAT) is not enabled. Internal users on the same subnet as the server (192.168.1.10) attempting to reach the server via its public VIP (e.g., 203.0.113.10) will send packets to the FortiGate, which performs destination NAT (DNAT) to the private IP. Without NAT reflection (also called hairpin NAT or NAT loopback), the FortiGate does not translate the source IP for traffic that enters and leaves the same interface, so the server sees the source as the internal user's private IP and replies directly, bypassing the FortiGate. This breaks the return path because the internal user's packet was destined for the VIP but the reply comes from the private IP, causing asymmetric routing and connection failure.

Answer

The internal users do not have a route to the VIP's public IP

Answer

The firewall policy for internal-to-DMZ traffic has NAT disabled

Answer

The VIP is configured on the wrong interface

Question 5

An administrator needs to allow traffic from a guest network (192.168.100.0/24) to the internet only during business hours (Mon-Fri, 08:00-18:00). The administrator creates a schedule object and applies it to the firewall policy. However, guests can still access the internet outside of the schedule. What is the most likely cause?

Accepted Answer

The schedule is not selected in the firewall policy. If the schedule is not actually selected in the firewall policy configuration, the policy will apply without any time restriction, allowing traffic at all times. The administrator may have created the schedule object but forgotten to assign it to the policy's schedule field, which is a common oversight.

Answer

The guest network is also allowed by another policy without a schedule

Answer

The schedule object is configured as a group but not applied

Answer

The FortiGate clock is not synchronized with an NTP server

Question 6

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'duration=3600' and 'expire=3599', which directly indicate the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds. The 'proto=6' confirms TCP (protocol 6), and 'proto_state=01' indicates an established TCP session. This is a standard FortiGate session diagnostic display.

Answer

The session is experiencing packet loss

Answer

The session is a UDP connection

Answer

The session is blocked by a firewall policy

Question 7

A FortiGate is configured with multiple VDOMs. The administrator creates a firewall policy in VDOM A that allows traffic from VDOM A to VDOM B using inter-VDOM links. Users in VDOM A can initiate traffic, but return traffic from VDOM B is not reaching them. What is the MOST likely cause?

Accepted Answer

The reverse path forwarding (RPF) check is blocking return traffic. In a multi-VDOM FortiGate, inter-VDOM traffic requires firewall policies in both involved VDOMs to establish a session. Once the initial session is successfully established, return traffic is handled by the session table and does not require a separate policy. If users in VDOM A can initiate traffic, the policies in both VDOMs for the forward direction must exist. The failure of return traffic is therefore more likely due to a reverse path forwarding (RPF) check, which validates that the source address of a packet is reachable via the interface on which the packet arrived. If the return path uses an asymmetric route, the RPF check may drop the packets.

Answer

The inter-VDOM link is down

Answer

The session helper is not configured for the application

Answer

A firewall policy is missing in VDOM B to allow return traffic

Question 8

A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?

Accepted Answer

Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10. Option A is correct because a Virtual IP (VIP) is the FortiGate object that performs destination NAT, mapping the public IP 203.0.113.5 to the internal web server 192.168.1.10 so inbound HTTPS reaches the correct host. Option B is correct because the VIP alone does nothing until a firewall policy from the WAN interface to the DMZ (where 192.168.1.10 resides) permits HTTPS and references the VIP as the destination address, which triggers the DNAT. Option D is correct because an IP pool configured with a fixed port range provides the source NAT (SNAT) translation the administrator wants for logging, allowing outbound/return traffic to be identified by a predictable port range. Option C is not needed because Central SNAT is a global mode used for centralized source NAT management, not a requirement for this VIP-based inbound scenario. Option E is not a valid FortiGate VIP setting; source port translation is controlled through the IP pool/firewall policy configuration, not an 'allow source port translation' toggle on the VIP.

Answer

Configure Central SNAT to translate the server's source IP for return traffic

Answer

Enable 'allow source port translation' on the VIP

Question 9

A company wants to allow FTP (TCP ports 20-21) from their internal network (192.168.1.0/24) to a specific external server (203.0.113.50). They also need to inspect FTP traffic for viruses. What should the admin configure?

Accepted Answer

Create a policy from internal to external with service FTP and enable antivirus. To allow FTP from the internal network to a specific external server and inspect it for viruses, the administrator creates a firewall policy from internal to external with the FTP service and attaches an antivirus security profile. FortiGate performs proxy-based or flow-based antivirus inspection on the FTP traffic within that policy, satisfying both the access and inspection requirements.

Answer

Configure an explicit proxy policy for FTP and apply antivirus

Answer

Enable NAT on the policy and use a custom service for FTP

Answer

Use a policy with service ALL and rely on the antivirus profile

Question 10

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

Accepted Answer

Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ. To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Answer

Use policy-based routing to forward SSH traffic

Answer

Configure source NAT on the outbound policy from DMZ to WAN

Answer

Enable NAT on the WAN interface

Question 11

A FortiGate admin needs to configure source NAT for traffic from the internal network (10.0.0.0/8) to the internet. The requirement is to translate all internal IPs to a range of public IPs (203.0.113.1-203.0.113.10) while preserving the source port for specific applications. Which TWO configurations can achieve this? (Choose two.)

Accepted Answer

Use a One-to-One IP Pool. Option A (One-to-One IP Pool) is correct because a one-to-one pool maps each internal source IP to a single public IP from the range, and when the pool size is smaller than the number of internal hosts, FortiGate can still perform NAT while preserving the source port for the translated sessions, satisfying the requirement to translate 10.0.0.0/8 to 203.0.113.1-203.0.113.10 with source-port preservation. Option E (Fixed Port Range IP Pool) is correct because it lets the admin define a specific range of public IPs and a fixed source port range, which explicitly preserves the source port for the specified applications while translating internal addresses to the public range. Option B (Dynamic IP Pool with Overload) is not correct here because overload (PAT) translates multiple internal IPs to a single public IP and rewrites source ports, which does not preserve the original source port. Option C (Enable NAT on the policy without an IP pool) is not correct because it uses the outgoing interface address for NAT and does not provide the specified public IP range or source-port preservation. Option D (Central SNAT with Overload) is not correct because overload again performs port address translation and does not preserve the source port as required.

Answer

Use a Dynamic IP Pool with Overload

Answer

Enable NAT on the policy without an IP pool

Answer

Configure Central SNAT with Overload

Question 12

An admin needs to ensure that all traffic from the 10.0.1.0/24 network to the internet uses a specific public IP address (203.0.113.10) as the source IP, with port translation enabled. The FortiGate has multiple WAN interfaces. Which NAT configuration should the admin use on the firewall policy?

Accepted Answer

Create an IP pool of type Overload with the range 203.0.113.10 and select it in the policy. An IP Pool of type Overload allows you to specify a single public IP address (203.0.113.10) as the translated source IP for all traffic from 10.0.1.0/24, with port address translation (PAT) enabled. This ensures that all outbound traffic uses that specific IP as the source, regardless of which WAN interface the traffic egresses, and the 'Overload' type automatically performs port translation to multiplex multiple internal hosts behind that single IP.

Answer

Enable NAT on the policy and set the IP pool configuration to use the interface address

Answer

Configure a Central SNAT rule that matches the source subnet and set the translated address to 203.0.113.10

Answer

Use a VIP to perform destination NAT and set the source IP in the VIP configuration

Question 13

An admin runs 'diagnose sys session filter saddr 10.0.1.10' and 'diagnose sys session list' to check sessions from a specific internal host. The output shows multiple sessions with destination IP 203.0.113.50 using source port 12345. The admin then checks the firewall policy and sees that the policy uses an IP pool for source NAT. What does the source port 12345 indicate?

Accepted Answer

The internal host's original source port is 12345. The 'diagnose sys session list' output shows both pre-NAT and post-NAT session details. The 'src' field displays the original source IP and port before NAT. Since the session filter is set to saddr 10.0.1.10, the source port 12345 shown in the session's 'src' line is the internal host's original source port. The translated source port would be displayed in the separate 'nat' field if PAT changes it.

Answer

The IP pool is configured for one-to-one NAT (no port translation)

Answer

The IP pool is using port range 12345-12345

Answer

This is the translated source port after PAT

Question 14

A company has a FortiGate with two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to ensure that traffic from a specific internal server (10.0.1.100) destined to the internet always exits via port2, while all other traffic uses port1. Which feature should the admin configure on the firewall policy for that server?

Accepted Answer

Enable policy-based routing on the policy and specify port2 as the egress interface. Policy-based routing (PBR) allows you to override the routing table for specific traffic based on criteria such as source IP, destination, or application. By creating a policy route that matches source 10.0.1.100 and setting port2 as the outgoing interface, the admin ensures that all traffic from that server exits via port2, while the routing table continues to direct all other traffic via port1. This is the correct approach because PBR operates at the routing level, not the firewall policy level.

Answer

Create a VIP to redirect the traffic to port2

Answer

Configure a static route with a higher distance for port2

Answer

Set the outgoing interface to port2 in the firewall policy

Question 15

A FortiGate has a firewall policy with NAT enabled using an IP pool of type 'Fixed Port Range'. The pool range is 203.0.113.10-203.0.113.20 with port range 10000-20000. A user initiates a connection to an external server. Which of the following describes how the FortiGate will assign the source address and port?

Accepted Answer

The FortiGate assigns a fixed IP and port mapping based on the original source IP and port, so the same internal host always gets the same public IP and port range. Fixed Port Range NAT (also known as NAT with fixed port range) creates a deterministic mapping between an internal host's source IP address and a specific public IP and port range from the pool. This mapping is based on a hash of the original source IP address only; the original source port number is not used in the selection. All sessions from the same internal host will use the same public IP and dedicated port range (10000-20000), which is essential for protocols that require consistent source addressing, such as SIP or H.323. The FortiGate does not round-robin, randomly assign, or sequentially assign IPs/ports; it hashes the source IP to select the fixed public IP and port range.

Answer

The FortiGate uses the pool IPs in round-robin and assigns the same port number as the original source port

Answer

The FortiGate randomly selects an IP from the pool and a random port from 10000-20000 for each session

Answer

The FortiGate uses the first available IP in the pool and assigns a port sequentially from 10000 upward