NSE4 Firewall Policies and NAT Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting why traffic from a specific host (10.0.1.100) to a web server (203.0.113.50) is being denied. The administrator has confirmed that a firewall policy exists that should allow the traffic. Which TWO diagnostic commands would help identify the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose firewall policy list. 'diagnose firewall policy list' displays the effective policy table, including policy IDs, match criteria, and action (accept/deny). This helps verify whether the policy intended for the traffic is actually present and in the correct order. Option C is correct because 'diagnose debug flow' enables real-time packet flow tracing, showing exactly which policy is matched (or not) and why the traffic is denied, such as a policy hit with action 'deny' or a session table lookup failure.

Answer

get system performance status

Answer

execute ping-options source 10.0.1.100

Answer

diagnose sniffer packet any 'host 203.0.113.50' 4

Question 2

An organization requires that outbound HTTP and HTTPS traffic from the internal network be translated to a single public IP address (203.0.113.1) using overload NAT (PAT). Which TWO configurations are necessary?

Accepted Answer

Create an IP pool with type 'Overload' and specify the public IP address. Overload NAT (PAT) allows multiple internal hosts to share a single public IP by translating source ports. To achieve this, you must create an IP pool with type 'Overload' that specifies the public IP address (203.0.113.1) and then enable NAT on the firewall policy, selecting that IP pool. This configuration ensures outbound HTTP/HTTPS traffic is translated to the single public IP with unique source ports.

Answer

Disable 'Allow Traffic' on the implicit deny policy

Answer

Configure a one-to-one NAT IP pool

Answer

Configure a VIP for the public IP

Question 3

An administrator needs to allow inbound SSH access from the internet to a specific internal server (10.0.1.10) on port 22. The WAN IP is 203.0.113.10. Which THREE configuration steps are required?

Accepted Answer

Ensure the firewall policy allows the SSH service (port 22). The firewall policy must explicitly permit the SSH service (TCP port 22) from the WAN to the internal server. Without a policy allowing the traffic, the FortiGate will drop the packets even if the VIP is configured correctly. The policy acts as the security gatekeeper, and the service object for SSH ensures only port 22 traffic is allowed.

Answer

Configure a source NAT IP pool for outbound traffic

Answer

Enable SSL inspection on the policy

Question 4

A FortiGate administrator needs to allow inbound SSH access from the internet to a single internal server at IP 10.0.1.10. The public IP on the WAN interface is 203.0.113.5. Which type of object should be configured to map the public IP and port to the internal server?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) object is the correct choice because it specifically maps a public IP and port (203.0.113.5:22) to a private IP and port (10.0.1.10:22) for inbound destination NAT (DNAT). This allows external SSH traffic to reach the internal server by translating the destination address and port at the FortiGate WAN interface.

Answer

IP Pool

Answer

Central NAT policy

Answer

Address object

Question 5

A FortiGate has two firewall policies: Policy 1 (from port1 to port2, source all, destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (from port1 to port2, source all, destination all, schedule 'Business Hours', action accept). A user attempts to connect from port1 to 10.0.1.5 at 8 PM on a Saturday. The traffic is denied. What is the most likely reason?

Accepted Answer

Policy 1 is placed below Policy 2 in the policy order, so Policy 2 is evaluated first. Policy 2 is evaluated before Policy 1 because it is placed higher in the policy order. At 8 PM on a Saturday, the 'Business Hours' schedule of Policy 2 is inactive, so Policy 2 does not match. FortiGate then evaluates Policy 1, which matches the destination 10.0.1.0/24 and should accept the traffic. However, the traffic is denied, indicating that Policy 1 is actually below Policy 2, and due to the evaluation order, Policy 2's schedule inactivity causes a mismatch, but Policy 1 still matches. The denial likely results from an implicit deny after all policies are evaluated, but among the options, only option C correctly identifies the policy order as relevant to the scenario.

Answer

Policy 1 only matches destination 10.0.1.10, and Policy 2's schedule is not active at this time

Answer

The source address is not included in either policy

Answer

Policy 2 has an implicit deny action

Question 6

Which firewall policy matching parameter is evaluated FIRST when a packet arrives at a FortiGate interface?

Accepted Answer

Incoming interface. When a packet arrives at a FortiGate interface, the firewall policy lookup begins by matching the incoming interface. This is because the interface is the first parameter evaluated in the policy-matching sequence, as defined by FortiGate's session-based architecture. Only after the interface match is successful does the FortiGate proceed to evaluate source address, destination address, service, and schedule.

Answer

Source address

Answer

Service

Answer

Schedule

Question 7

A FortiGate has a policy-based NAT rule that translates source IPs from subnet 192.168.1.0/24 to 203.0.113.10 when accessing the internet. The admin also enables Central SNAT with a rule that translates the same subnet to 203.0.113.20. If both are configured, which translation will be applied to traffic from 192.168.1.0/24 to the internet?

Accepted Answer

Policy-based NAT because it is evaluated first. Policy-based NAT is evaluated before Central SNAT because it is directly tied to the firewall policy that matches the traffic. When a policy-based NAT rule exists for the same traffic, it takes precedence over Central SNAT rules, regardless of any global settings or rule IDs. Therefore, the source IPs from 192.168.1.0/24 will be translated to 203.0.113.10.

Answer

Both translations will be applied, causing an error

Answer

Central SNAT because it is a global setting

Answer

The FortiGate will use the translation from the policy with the highest ID

Question 8

Which type of address object allows a FortiGate to perform DNS resolution to match traffic based on a domain name?

Accepted Answer

Wildcard FQDN. Both FQDN and Wildcard FQDN address objects in FortiGate use DNS resolution to match traffic. An FQDN object resolves an exact domain name to IP addresses, while a Wildcard FQDN object resolves domains matching a wildcard pattern (e.g., *.example.com). Since the question asks which type allows DNS resolution for domain name matching, both A and C are correct.

Answer

Subnet

Answer

Geography

Question 9

A network admin needs to log all traffic from the sales VLAN to the internet. The firewall policy is configured with logging enabled. However, the admin notices that only session start logs are generated, not detailed traffic logs. What setting must be enabled to capture per-packet or per-session details?

Accepted Answer

Set the log generation to 'All sessions' in the policy. In FortiGate, the 'Log Generation' setting on a firewall policy controls whether logs are generated for session start only or for all sessions. By default, a policy may log only session start events; setting it to 'All sessions' ensures that per-session details (including traffic volume, duration, and packet counts) are recorded. This is distinct from enabling security profiles, which inspect traffic but do not change the logging verbosity.

Answer

Enable 'Log Memory' on the policy

Answer

Enable security profiles

Answer

Configure a traffic shaper

Question 10

A FortiGate admin configures a VIP to map 203.0.113.10:80 to 10.0.1.10:8080. However, when external users connect to http://203.0.113.10, they receive a connection timeout. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The firewall policy's destination is set to the real server IP (10.0.1.10) instead of the VIP object. The most likely cause is that the firewall policy's destination is set to the real server IP (10.0.1.10) instead of the VIP object (203.0.113.10:80). For a VIP to work correctly, the firewall policy must reference the VIP as the destination address. If the policy uses the real server IP, the traffic will not be translated and will be directed to the internal server without proper destination NAT, leading to a timeout. Option A is less likely because the VIP interface mismatch would typically cause a different behavior (e.g., traffic not hitting the policy at all). Option B (source NAT) is unrelated to incoming connections. Option D (server not listening on 8080) would cause a different error (e.g., connection refused) but not timeout, and the admin can verify server status.

Answer

The VIP is configured on the wrong interface

Answer

The source NAT is not configured

Answer

The internal server is not listening on port 8080

Question 11

An admin configures an IP Pool with type 'Overload' for outbound traffic from the 192.168.1.0/24 subnet. The pool uses a single public IP 203.0.113.10. After a few hours, users are unable to access external websites. The admin checks the session table and sees many sessions with the same public IP and different source ports. What is the most likely issue?

Accepted Answer

The IP Pool has run out of available source ports. The IP Pool is configured with type 'Overload' (Port Address Translation), which maps multiple internal hosts to a single public IP by using unique source ports. With a single public IP (203.0.113.10), the maximum number of concurrent sessions is limited by the available source ports (approximately 65,535 per IP, minus reserved ports). Once all source ports are consumed, new outbound sessions cannot be established, causing users to lose access to external websites.

Answer

The session helper is misconfigured

Answer

The IP Pool's public IP has been blacklisted by external websites

Answer

The firewall policy is not referencing the IP Pool

Question 12

A FortiGate has two policies for traffic from port1 to port3: Policy 1 (destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (destination 10.0.2.0/24, schedule 'Weekdays', action accept). A packet destined to 10.0.2.10 arrives on Wednesday at 2 PM. Which policy is applied?

Accepted Answer

Policy 2 because it matches the destination and the schedule is active. Policy 2 is applied because it matches the destination IP (10.0.2.10) and the schedule 'Weekdays' is active on Wednesday at 2 PM. FortiGate uses a first-match approach only when multiple policies have the same priority; here, Policy 1 does not match the destination, so Policy 2 is the only matching policy. Since the schedule is valid, the action 'accept' is executed.

Answer

Both policies are applied sequentially

Answer

Neither; the implicit deny applies

Answer

Policy 1 because it is listed first

Question 13

An admin configures a one-to-one IP Pool to map 10.0.1.0/28 to 203.0.113.16/28. A host with IP 10.0.1.5 initiates a connection to the internet. Which source IP will be used for the translated packet?

Accepted Answer

203.0.113.21. In a one-to-one IP Pool NAT configuration, the mapping is based on the subnet offset. The internal subnet 10.0.1.0/28 has 16 addresses (10.0.1.0–10.0.1.15), and the external pool 203.0.113.16/28 also has 16 addresses (203.0.113.16–203.0.113.31). The host 10.0.1.5 is the 6th usable IP (offset 5 from the network address), so it maps to the 6th IP in the external pool: 203.0.113.16 + 5 = 203.0.113.21.

Answer

203.0.113.20

Answer

203.0.113.5

Answer

203.0.113.16

Question 14

A FortiGate admin is troubleshooting an issue where traffic from VLAN 10 to the internet is not being NATed even though a policy-based NAT rule is configured. The admin verifies that the firewall policy uses the correct IP Pool. Which THREE steps should the admin take to diagnose the problem? (Choose three.)

Accepted Answer

Examine the IP Pool configuration for correct interface binding or port exhaustion. Policy-based NAT requires the IP Pool to be bound to the correct outgoing interface (the one the traffic egresses on). If the interface binding is wrong or the pool has exhausted its port range (e.g., all PAT ports are used), NAT will fail silently. Examining the IP Pool configuration directly reveals these misconfigurations.

Answer

Reboot the FortiGate to clear any session table issues

Answer

Disable all other firewall policies to isolate the issue

Question 15

A FortiGate admin needs to block all traffic from the 'Guest' VLAN (192.168.100.0/24) to the internal network (10.0.0.0/8) except for DNS traffic (UDP 53) to the internal DNS server at 10.0.0.10. Which TWO firewall policy configuration elements are required to achieve this? (Choose two.)

Accepted Answer

A firewall policy with source 'Guest' VLAN, destination 'Internal network', service 'ALL', action 'deny'. A deny policy with source 'Guest' VLAN (192.168.100.0/24), destination 'Internal network' (10.0.0.0/8), and service 'ALL' will block all traffic from the Guest VLAN to the internal network. Option C is correct because an explicit accept policy for DNS (UDP 53) to the internal DNS server (10.0.0.10) must be placed before the deny policy, as FortiGate firewall policies are evaluated in order from top to bottom, and the first matching policy determines the action.

Answer

An address group for the internal DNS server

Answer

A traffic shaper to limit DNS traffic

Answer

A schedule object to apply the policies only during business hours