NSE4 Firewall Policies and NAT Practice Test 2 — 15 Questions

Question 1

Match each FortiGate logging destination to its description.

Accepted Answer

Local memory: Logs are stored on the FortiGate's hard disk or memory.. The correct matches: Local memory (local storage), Syslog (remote syslog server), FortiAnalyzer (centralized analysis), FortiCloud (cloud logging). Common confusions involve swapping Syslog with FortiAnalyzer or misdescribing local storage.

Answer

Syslog: Logs are sent to FortiAnalyzer for logging and analysis.

Answer

Local memory: Logs are sent to an external server.

Question 2

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Accepted Answer

Create a traffic shaping policy and apply it to the firewall policy. Traffic shaping is the correct mechanism to enforce fair bandwidth distribution for HTTPS traffic. By creating a traffic shaping policy and applying it to the firewall policy, the admin can allocate a specific bandwidth guarantee or limit for HTTPS sessions, preventing them from starving other traffic. Without shaping, HTTPS traffic can consume all available bandwidth, causing slow performance for other users.

Answer

Increase the bandwidth of the internet link

Answer

Configure policy-based routing for HTTPS traffic

Answer

Enable QoS on the outgoing interface

Question 3

A FortiGate admin wants to create a firewall policy that allows traffic from the internal network to the internet. The source is a subnet 192.168.1.0/24, and the destination is 'all'. The admin wants to apply NAT to hide internal IPs. Which NAT configuration is BEST suited for this scenario?

Accepted Answer

Enable 'NAT' on the firewall policy and use the outgoing interface address. Enabling NAT on the firewall policy with the outgoing interface address is the standard method for source NAT (masquerading) in FortiGate. This configuration translates all internal source IPs (192.168.1.0/24) to the single IP address of the egress interface, hiding the internal subnet from the internet. It is the simplest and most efficient approach for typical internet-bound traffic, requiring no additional objects like IP pools or VIPs.

Answer

Configure a VIP for source NAT

Answer

Use policy-based routing to send traffic through a NAT device

Answer

Create a one-to-one IP pool and apply it to the policy

Question 4

An admin notices that a firewall policy allowing inbound HTTPS to a server is not matching traffic. The policy has source set to 'all', destination to the server's IP, and service to HTTPS. The admin checks the policy list and sees that policy ID 1 matches the traffic. What is the MOST likely reason the intended policy (ID 10) is not matching?

Accepted Answer

Policy ID 1 has a higher priority and matches before policy ID 10. Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

Answer

The firewall policy is disabled

Answer

The service object for HTTPS is misconfigured in policy ID 10

Answer

The destination address is incorrect in policy ID 10

Question 5

Which of the following is a valid address object type in FortiGate that can be used to match traffic based on the domain name of the destination?

Accepted Answer

FQDN. FortiGate supports FQDN (Fully Qualified Domain Name) address objects, which allow firewall policies to match traffic based on the destination domain name. When an FQDN object is used, FortiGate performs DNS resolution to obtain the IP addresses and updates the policy dynamically, enabling domain-based traffic filtering.

Answer

Wildcard FQDN

Answer

Subnet

Answer

Geography

Question 6

A FortiGate admin wants to ensure that traffic destined to a specific web server is inspected by an IPS profile. Which configuration is necessary?

Accepted Answer

Create a security profile group containing the IPS profile and apply it to the policy. In FortiGate, IPS inspection is applied via a security profile group that includes the IPS profile, which is then attached to a firewall policy. The firewall policy itself does not have a direct 'enable IPS' toggle; instead, IPS profiles are part of the security profiles that must be explicitly assigned to the policy to inspect traffic.

Answer

Enable IPS on the firewall policy directly

Answer

Set the policy's action to 'IPS'

Answer

Configure a VIP for the web server

Question 7

An admin needs to allow inbound SMTP traffic from the internet to a mail server in the DMZ. The public IP is 203.0.113.10, and the mail server's private IP is 10.0.0.5. Which VIP configuration is correct?

Accepted Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 25. It configures a Virtual IP (VIP) that maps the public IP 203.0.113.10 on TCP port 25 (SMTP) to the internal mail server IP 10.0.0.5 on port 25. This allows inbound SMTP traffic from the internet to reach the mail server in the DMZ, performing both destination NAT (DNAT) and port forwarding for the specific SMTP service.

Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 80

Answer

VIP: external IP 203.0.113.10 all ports -> internal IP 10.0.0.5 all ports

Answer

VIP: external IP 203.0.113.10 port 80 -> internal IP 10.0.0.5 port 80

Question 8

A FortiGate admin is troubleshooting a policy that should allow VoIP traffic. The admin suspects that the SIP ALG is interfering. Which TWO actions should the admin take to verify or resolve the issue?

Accepted Answer

Disable the SIP ALG on the firewall policy. Disabling the SIP ALG on the firewall policy stops the FortiGate from inspecting and modifying SIP traffic at the application layer. This is a common troubleshooting step when the SIP ALG interferes with VoIP traffic, as it can alter SIP headers or signaling in ways that break compatibility with certain VoIP providers or endpoints.

Answer

Enable 'set sip-nat-trace' on the policy

Answer

Enable 'set ssl-ssh-profile' on the policy

Answer

Increase the session TTL for SIP

Question 9

An administrator creates a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network to the internet. The policy uses a dynamic IP pool for SNAT. Users report that some websites load slowly or fail to load intermittently. The administrator checks the firewall logs and sees 'session helper' warnings. What is the most likely cause?

Accepted Answer

The IP pool is configured with fixed port range, limiting the number of available ports. The 'session helper' warnings indicate that the firewall is struggling to allocate NAT sessions for the dynamic IP pool. When the IP pool uses a fixed port range, the number of available source ports per IP is limited, leading to port exhaustion under heavy HTTP/HTTPS traffic. This causes intermittent failures and slow loads as new connections are dropped or queued.

Answer

The policy has traffic shaping enabled that is throttling the bandwidth

Answer

The firewall policy is configured for proxy-based inspection, causing high latency

Answer

The DNS server on the internal network is misconfigured

Question 10

During a security audit, the administrator runs the command 'diagnose firewall policy list' and sees the following output:
policy id=1: allow from port1 to port2, src=10.0.0.0/8, dst=any, action=accept
policy id=2: deny from port1 to port2, src=10.0.0.0/8, dst=172.16.0.0/12, action=deny
policy id=3: allow from port1 to port2, src=any, dst=any, action=accept
A host with IP 10.0.1.5 sends traffic to 172.16.0.1. Which policy will match?

Accepted Answer

Policy 1. Policy 1 matches first because FortiGate evaluates policies sequentially by ID. The source 10.0.1.5 is within 10.0.0.0/8 and the destination is any, so policy 1 matches and accepts the traffic. Although policy 2 would also match (172.16.0.1 is within 172.16.0.0/12), it is not evaluated because the first matching policy is applied.

Answer

Policy 3

Answer

Implicit deny

Answer

Policy 2

Question 11

An administrator needs to block all traffic from a specific geographic region. Which object type should be used as the source in the firewall policy?

Accepted Answer

Geography address. A geography address object (also known as a geolocation object) allows the firewall to match traffic based on the source IP's registered country or region using GeoIP databases. This is the correct object type when the requirement is to block all traffic from a specific geographic region, as it evaluates the source IP against the FortiGate's built-in geolocation mapping.

Answer

FQDN address

Answer

IP range address

Answer

Wildcard FQDN address

Question 12

Which of the following statements about firewall policy ordering in FortiGate is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first match is applied. FortiGate firewall policies are evaluated sequentially from top to bottom in the policy list. The first policy that matches the source, destination, service, and other criteria is applied, and no further policies are evaluated. This is the fundamental 'first-match' behavior that governs traffic processing in FortiGate.

Answer

Policies are evaluated from bottom to top

Answer

The most specific policy always takes precedence regardless of order

Answer

The implicit permit rule at the end allows all traffic not explicitly denied

Question 13

An administrator uses 'diagnose sys session list' and sees the following output for a session: 'proto=6 proto_state=01 duration=3600 expire=3599'. The session is for HTTPS traffic. What does 'proto_state=01' typically indicate in FortiGate?

Accepted Answer

The session is in the initial connection setup phase (SYN_SENT). In FortiGate, 'proto_state=01' for TCP (proto=6) indicates the session is in the SYN_SENT phase, meaning the initial SYN packet has been sent but the three-way handshake is not yet complete. For HTTPS traffic, this shows the session is still in the connection setup stage, not fully established. The 'duration' and 'expire' values reflect the time since the session was created and the remaining timeout, which is typical for an incomplete handshake.

Answer

The session is being NATted

Answer

The session is fully established and active

Answer

The session is being inspected by a security profile

Question 14

An organization has multiple remote sites connected via IPsec VPN. The administrator needs to ensure that traffic from the internal network (10.0.0.0/8) to the VPN destination (10.10.0.0/16) uses a specific interface (port2) instead of the default route. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) allows you to override the default routing table by matching traffic based on source/destination addresses and directing it to a specific egress interface (port2). This is the correct feature because the requirement is to force traffic from 10.0.0.0/8 to 10.10.0.0/16 out port2, bypassing the default route.

Answer

Central NAT

Answer

Static route with higher distance

Answer

Traffic shaping

Question 15

Which of the following is NOT a valid address object type in FortiGate?

Accepted Answer

MAC address. FortiGate address objects support Subnet, Wildcard FQDN, and Geography types, but MAC addresses are not a valid address object type. MAC addresses are used in other contexts like static ARP entries or DHCP reservations, not as firewall address objects.

Answer

Subnet

Answer

Wildcard FQDN

Answer

Geography