NSE4 Firewall Policies and NAT Practice Test 3 — 15 Questions

Question 1

A FortiGate admin is troubleshooting an issue where traffic from a specific internal host (10.0.1.50) to the internet is not being NATed as expected. The firewall policy has NAT enabled with an IP pool of type Overload. Which TWO conditions could cause the traffic to bypass the IP pool?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A policy with a lower policy ID matches the traffic and has NAT enabled with a different IP pool or no pool. Option D is correct because FortiGate evaluates firewall policies in order of policy ID (top-down), so if a lower-ID policy matches the traffic first, that policy's NAT configuration — a different IP pool or no pool at all — is applied instead of the intended Overload pool, causing the traffic to bypass the expected pool. Option E is correct because an IP pool of type Overload can be configured with a source filter (a subnet or range), and if 10.0.1.50 is not included in that filter, the pool is not eligible for that source and NAT falls back to the outgoing interface address or another pool. Option A is not applicable because the scenario states the policy already has NAT enabled, so the NAT setting is not 'disable'. Option B is incorrect because the pool is explicitly of type Overload, not one-to-one, and the question asks about bypassing the configured pool. Option C is incorrect because a non-standard source port does not cause a FortiGate to skip an Overload IP pool; PAT handles arbitrary source ports normally.

Answer

The firewall policy's NAT setting is set to 'disable'

Answer

The IP pool is configured for one-to-one NAT

Answer

The internal host is using a non-standard source port

Question 2

A FortiGate administrator needs to create a firewall policy that allows outbound traffic to the internet but denies access to a specific list of malicious IP addresses. The malicious IP list is updated frequently. Which address object type should be used for the destination addresses to block?

Accepted Answer

FQDN address object. FQDN address objects can resolve to a list of IP addresses that change dynamically, making them suitable for frequently updated IP lists. Subnet objects are static.

Answer

IP Range address object

Answer

Geography address object

Answer

Subnet address object

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been established for 1 hour and will expire in about 1 hour. The output shows `proto=6`, which indicates TCP (protocol number 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. The `duration=3600` means the session has been active for 3600 seconds (1 hour), and `expire=3599` indicates the session will expire in 3599 seconds (approximately 1 hour). This matches the description of a TCP session established for 1 hour with about 1 hour remaining before expiry.

Answer

The session is a UDP session with destination port 443

Answer

The session will expire in 3600 seconds

Answer

The session is a TCP session in SYN_SENT state

Question 4

Which THREE of the following are valid address object types in FortiGate? (Choose three.)

Accepted Answer

Subnet. In FortiGate, address objects can be defined as a Subnet (A), which stores an IPv4/IPv6 network with a netmask or prefix length (e.g., 10.0.0.0/24), making it a core address object type. FQDN (D) is also a valid address object type, resolving a fully qualified domain name to IP addresses dynamically for use in policies. Wildcard (E) is valid as well, letting you define an address using an IP and wildcard mask (e.g., 10.0.0.0 0.0.0.255) to match non-contiguous or partial ranges. MAC address (B) is not an address object type; MAC-based matching is handled by separate features such as MAC address objects/devices or firewall address groups referencing devices, not standard address objects. Geography (C) is not an address object type either; geographic/region-based matching is implemented through ISDB (Internet Service Database) or geo-based address/ISDB objects rather than the standard address object types.

Answer

MAC address

Answer

Geography

Question 5

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Accepted Answer

diagnose firewall iprope list. Option D, diagnose firewall iprope list, is correct because it dumps the compiled IP-route/CMDB policy table (the iprope) that the FortiGate kernel actually uses for policy lookup, letting the administrator see the policy IDs, source/destination addresses, and order in which the kernel evaluates policies — so they can identify whether the host's traffic is hitting a different policy than the one they expect. Option E, diagnose debug flow, is correct because enabling flow debugging (diagnose debug enable followed by diagnose debug flow filter and diagnose debug flow show) traces a packet through the kernel and prints which policy ID it matched, the NAT decision, and the final allow/deny result, directly revealing if another policy is intercepting the traffic. Option A, get system performance status, only reports CPU, memory, uptime, and session counts, so it cannot show policy matching. Option B, config system ha, is for configuring HA parameters such as priority, group name, and heartbeat interfaces, not for policy diagnostics. Option C, execute ping options, only configures ping parameters like source interface and repeat count, so it does not reveal which firewall policy a flow matches.

Answer

get system performance status

Answer

config system ha

Answer

execute ping options

Question 6

A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?

Accepted Answer

A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP. Option E is correct because a Virtual IP (VIP) is the FortiGate object that performs destination NAT, mapping the public address 203.0.113.10 on port 443 to the internal server 192.168.1.10 on port 443, which is the fundamental requirement for publishing an internal web server. Option A is correct because the VIP alone does nothing until a firewall policy referencing it is created; the policy must be an inbound policy from the WAN interface to the DMZ interface (where the web server resides) permitting HTTPS and using the VIP as the destination object. Option B is correct because the requirement that the server see the original client source IP means the policy must not apply source NAT; disabling NAT on the policy (set nat enable disable) preserves the client's source address instead of translating it to the FortiGate's interface IP. Option C is not required because 203.0.113.10 is the company's public address on the WAN interface, not a remote network, so no static route pointing it to the ISP gateway is needed. Option D is incorrect because a Central SNAT policy would translate the client source address to the FortiGate's IP, which directly violates the requirement to preserve the original source IP.

Answer

A static route for 203.0.113.10 pointing to the ISP gateway

Answer

A Central SNAT policy to translate the source to the FortiGate's IP

Question 7

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

Accepted Answer

Policy ID 2 because it matches the source and service. Policy ID 2 matches because the source IP 10.0.1.50 falls within the 10.0.1.0/24 subnet, and the service is set to ALL, which includes HTTP. FortiGate uses a top-down policy lookup and selects the first match based on source, destination, and service; since Policy ID 2 matches all criteria, it is applied.

Answer

Both policies, and the traffic is load-balanced

Answer

No policy matches, traffic is denied by implicit deny

Answer

Policy ID 1 because it is first in order and matches the service HTTP

Question 8

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Accepted Answer

diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80. Option B, `diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80`, is correct because it performs a policy route lookup for the exact 5-tuple (source 10.0.1.10, destination 203.0.113.50, protocol TCP, port 80) and reports the policy ID that would match the session, which directly answers which policy is being hit. Option D, `diagnose firewall policy list`, is correct because it dumps the compiled policy table with policy IDs, sequence numbers, and match criteria, letting the admin correlate the lookup result and verify the ordering of policies that could match the traffic. Option A, `execute ping 203.0.113.50`, only tests ICMP reachability and does not reveal policy matching for TCP port 80. Option C, `diagnose debug flow`, shows packet flow and drop reasons but does not by itself identify the matching policy ID as directly as the iprope lookup. Option E, `get firewall policy`, is not a valid FortiGate CLI command for inspecting the policy table.

Answer

execute ping 203.0.113.50

Answer

diagnose debug flow

Answer

get firewall policy

Question 9

An admin needs to configure NAT for internal users accessing the internet. The requirements are: 1) All internal users must be translated to a single public IP. 2) The translation should use port address translation (PAT). 3) The configuration must allow tracking of which internal user initiated a connection. Which THREE settings must be configured? (Choose three.)

Accepted Answer

Enable NAT on the firewall policy and select the IP pool. Option E is correct because creating an IP pool containing the single public IP with type Overload enables PAT, allowing many internal hosts to share one address by multiplexing source ports. Option C is correct because NAT must be enabled on the firewall policy and that policy must reference the overload IP pool so matching traffic is translated to the public IP. Option D is correct because enabling logging on the firewall policy records the user and session details, satisfying the requirement to track which internal user initiated a connection. Option A is not correct because using the egress interface IP does not meet the requirement of translating to a specific single public IP pool and does not provide the same explicit pool-based PAT configuration. Option B is not correct because a central SNAT policy with the same pool is an alternative NAT method, not a required setting when NAT is already enabled on the firewall policy with the IP pool.

Answer

Set the policy's NAT to use the egress interface IP

Answer

Configure a central SNAT policy with the same pool

Question 10

An admin is configuring a firewall policy to allow FTP traffic from a client to a server. The server is behind a VIP that translates public IP 203.0.113.10 port 21 to private IP 10.0.0.10 port 21. The admin wants to ensure the FTP data channel works correctly. Which TWO additional configurations are required? (Choose two.)

Accepted Answer

Enable FTP ALG on the firewall policy. Option A is correct because FTP uses a separate data channel, and enabling the FTP ALG (Application Layer Gateway) on the firewall policy lets the firewall inspect the control connection, learn the negotiated data port, and dynamically open the required pinhole for the data session. Option E is correct because the predefined FTP service in most firewall platforms includes the control channel (TCP 21) and the associated FTP data handling, so the policy can properly permit both the control and data connections when combined with ALG inspection. Option B is not required because NAT for return traffic is already handled by the VIP translation and the firewall's session table, not by a separate NAT enablement on the policy. Option C is not required because the FTP ALG dynamically creates the data-channel pinhole, so a separate static policy for the data channel is unnecessary. Option D is not required because FTP active-mode data originates from TCP port 20 on the server, but the client-side policy typically does not need a service object for TCP 20 when the FTP ALG and predefined FTP service are used.

Answer

Enable NAT on the policy for return traffic

Answer

Create a separate policy for the data channel

Answer

Configure a service object for FTP data port (TCP 20)

Question 11

An admin troubleshoots an issue where internal users cannot access an internal server using its public IP address. The server is published via a VIP. The admin has already verified that the firewall policy allows traffic from internal to the VIP. Which THREE checks should the admin perform to resolve the issue? (Choose three.)

Accepted Answer

Enable NAT reflection on the VIP. Option A is correct because when internal users access an internal server through its public IP (the VIP), the traffic must be hairpinned/reflected back inside; enabling NAT reflection on the VIP allows the firewall to translate and route this internal-to-VIP traffic correctly. Option B is correct because after the VIP performs destination NAT, the traffic is delivered to the server's mapped (private) IP, so a firewall policy permitting internal-to-VIP alone is insufficient — a policy allowing internal to the VIP's mapped IP is also required. Option D is correct because even with correct NAT and policies, the server must actually be listening on the interface/address that receives the translated traffic; if it only listens on another interface, the connection will fail. Option C is not a valid troubleshooting check because forcing users to use the private IP bypasses the VIP rather than resolving the public-IP access issue. Option E is not appropriate because changing the VIP to port forwarding alters the design and does not address the NAT reflection or policy requirements for internal access via the public IP.

Answer

Configure the internal users to use the private IP directly

Answer

Change the VIP to use port forwarding

Question 12

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

Accepted Answer

The firewall policy action is set to DENY. The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).

Answer

The interface is not configured as a WAN interface

Answer

The policy is disabled

Answer

The traffic is being processed by a higher priority deny policy

Question 13

An admin configures a VIP to map public IP 203.0.113.10:80 to internal server 10.0.0.10:8080. Users on the internet can reach the server. However, internal users trying to access the public IP from inside the network fail. What is the MOST likely reason?

Accepted Answer

The VIP is configured with port forwarding only for external interface. For internal users to reach a VIP, the VIP must be available on the internal interface (or set to 'any') and a firewall policy must allow the traffic. Option A indicates the VIP is only on the external interface, so packets from internal users are not destination-translated and get routed out. When hairpin NAT is configured correctly, the policy must have NAT enabled (source NAT) to ensure return traffic goes back through the FortiGate. Disabling NAT would cause the server to reply directly to the client, which the client would drop because the reply source does not match the public IP.

Answer

The firewall policy for internal users does not have NAT disabled

Answer

The internal server is not configured to respond to requests on port 8080

Answer

The internal users are using a different DNS server

Question 14

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from subnet 10.0.0.0/24 through port1 and 10.0.1.0/24 through port2. However, traffic from 10.0.0.0/24 is still using port2. The PBR rule appears correctly configured. What is the MOST likely issue?

Accepted Answer

The firewall policy for that traffic has a route override setting that bypasses PBR. The 'route override' setting in a firewall policy allows the FortiGate to ignore policy-based routing (PBR) rules for matching traffic. When enabled, the firewall policy uses the routing table (e.g., static or dynamic routes) instead of PBR, which explains why traffic from 10.0.0.0/24 is still using port2 despite a correctly configured PBR rule. This is a common misconfiguration where PBR appears correct but is overridden by the firewall policy's route override option.

Answer

The source subnet in the PBR rule is incorrectly specified as 10.0.1.0/24

Answer

The static route for 0.0.0.0/0 has a higher administrative distance than the PBR rule

Answer

The PBR rule has a higher priority number than other rules

Question 15

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'proto=6' which indicates TCP (protocol number 6), 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means the session will expire in 3599 seconds. This is a standard session table entry from the FortiGate 'diagnose sys session' command, showing an established TCP session with its remaining lifetime.

Answer

The session is a UDP session for DNS

Answer

The session is an ICMP echo request

Answer

The session is blocked by a firewall policy