NSE4 Firewall Policies and NAT Practice Test 3 — 15 Questions

Question 1

An admin needs to allow inbound SMTP traffic from the internet to a mail server in the DMZ. The public IP is 203.0.113.10, and the mail server's private IP is 10.0.0.5. Which VIP configuration is correct?

Accepted Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 25. Option A is correct because it configures a Virtual IP (VIP) that maps the public IP 203.0.113.10 on TCP port 25 (SMTP) to the internal mail server IP 10.0.0.5 on port 25. This allows inbound SMTP traffic from the internet to reach the mail server in the DMZ, performing both destination NAT (DNAT) and port forwarding for the specific SMTP service.

Answer

VIP: external IP 203.0.113.10 port 25 -> internal IP 10.0.0.5 port 80

Answer

VIP: external IP 203.0.113.10 all ports -> internal IP 10.0.0.5 all ports

Answer

VIP: external IP 203.0.113.10 port 80 -> internal IP 10.0.0.5 port 80

Question 2

A FortiGate admin is troubleshooting a policy that should allow VoIP traffic. The admin suspects that the SIP ALG is interfering. Which TWO actions should the admin take to verify or resolve the issue?

Accepted Answer

Disable the SIP ALG on the firewall policy. Option A is correct because disabling the SIP ALG on the firewall policy stops the FortiGate from inspecting and modifying SIP traffic at the application layer. This is a common troubleshooting step when the SIP ALG interferes with VoIP traffic, as it can alter SIP headers or signaling in ways that break compatibility with certain VoIP providers or endpoints.

Answer

Enable 'set sip-nat-trace' on the policy

Answer

Enable 'set ssl-ssh-profile' on the policy

Answer

Increase the session TTL for SIP

Question 3

An admin is configuring a policy-based NAT (central SNAT) to translate internal users to a pool of public IPs using overload. The admin wants to ensure that specific applications using non-standard ports are not affected by NAT. Which THREE steps should the admin consider?

Accepted Answer

Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'. Option A is correct because adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation. This ensures that applications using non-standard ports are not affected by the overload behavior of the IP pool, which could otherwise cause port conflicts or session failures. The policy-based NAT (central SNAT) processes policies sequentially, so a higher-priority match with NAT disabled overrides any subsequent NAT rules.

Answer

Use central SNAT with a VIP for source NAT

Answer

Enable 'set nat enable' on the policy

Question 4

A FortiGate admin needs to allow inbound HTTPS traffic to a web server while also applying an application control profile to block certain web applications. The web server has a VIP configured. Which TWO components are necessary for this configuration?

Accepted Answer

A VIP configured to map the public IP to the web server's private IP. Option B is correct because a Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

Answer

A central SNAT rule to translate the server's response

Answer

A security profile group containing only the antivirus profile

Answer

A traffic shaping policy to prioritize HTTPS

Question 5

A network administrator configures a firewall policy allowing HTTP traffic from the internal network (10.0.0.0/8) to the internet. After applying the policy, users report they can browse the web, but the FortiGate logs show that all sessions are using the 'implicit deny' policy ID 0. What is the most likely cause?

Accepted Answer

The source interface on the policy is set to the WAN interface instead of the internal interface. Option A is correct because if the source interface on the firewall policy is set to the WAN interface instead of the internal interface, traffic arriving from the internal network (10.0.0.0/8) on the internal interface will not match that policy. The FortiGate then falls through to the implicit deny policy (ID 0), which logs and drops the session. Since HTTP traffic is still reaching the internet, it suggests that another mechanism (such as a default route or NAT) is allowing the traffic, but the policy matching fails due to the interface mismatch.

Answer

Central NAT is enabled and overriding the policy-based NAT

Answer

The policy has a schedule applied that is currently inactive

Answer

The policy is placed after the implicit deny rule

Question 6

An administrator creates a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network to the internet. The policy uses a dynamic IP pool for SNAT. Users report that some websites load slowly or fail to load intermittently. The administrator checks the firewall logs and sees 'session helper' warnings. What is the most likely cause?

Accepted Answer

The IP pool is configured with fixed port range, limiting the number of available ports. The 'session helper' warnings indicate that the firewall is struggling to allocate NAT sessions for the dynamic IP pool. When the IP pool uses a fixed port range, the number of available source ports per IP is limited, leading to port exhaustion under heavy HTTP/HTTPS traffic. This causes intermittent failures and slow loads as new connections are dropped or queued.

Answer

The policy has traffic shaping enabled that is throttling the bandwidth

Answer

The firewall policy is configured for proxy-based inspection, causing high latency

Answer

The DNS server on the internal network is misconfigured

Question 7

During a security audit, the administrator runs the command 'diagnose firewall policy list' and sees the following output:
policy id=1: allow from port1 to port2, src=10.0.0.0/8, dst=any, action=accept
policy id=2: deny from port1 to port2, src=10.0.0.0/8, dst=172.16.0.0/12, action=deny
policy id=3: allow from port1 to port2, src=any, dst=any, action=accept
A host with IP 10.0.1.5 sends traffic to 172.16.0.1. Which policy will match?

Accepted Answer

Policy 1. Policy 1 matches because the source IP 10.0.1.5 falls within the 10.0.0.0/8 range, the destination IP 172.16.0.1 is not explicitly matched by policy 2's destination of 172.16.0.0/12 (since 172.16.0.1 is the network address itself and is included, but policy 2 is a deny and is evaluated before policy 3; however, policy 1 is evaluated first due to its lower ID, and since it matches both source and destination with action accept, the traffic is permitted by policy 1 before reaching policy 2). In FortiGate, policies are evaluated sequentially by ID, and the first match is applied.

Answer

Policy 3

Answer

Implicit deny

Answer

Policy 2

Question 8

An administrator needs to block all traffic from a specific geographic region. Which object type should be used as the source in the firewall policy?

Accepted Answer

Geography address. A geography address object (also known as a geolocation object) allows the firewall to match traffic based on the source IP's registered country or region using GeoIP databases. This is the correct object type when the requirement is to block all traffic from a specific geographic region, as it evaluates the source IP against the FortiGate's built-in geolocation mapping.

Answer

FQDN address

Answer

IP range address

Answer

Wildcard FQDN address

Question 9

A company has a web server in the DMZ that needs to be accessible from the internet on port 443 (HTTPS). The administrator configures a Virtual IP (VIP) mapping the public IP 203.0.113.10 to the private IP 10.0.1.10 port 443. Which firewall policy is required to allow inbound traffic?

Accepted Answer

A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT. Option B is correct because when a Virtual IP (VIP) is configured in FortiGate, the firewall policy must reference the VIP object as the destination, not the actual private IP. The VIP translates the public IP (203.0.113.10) to the private IP (10.0.1.10), and the policy from WAN to DMZ with destination VIP ensures that inbound traffic is matched and permitted before NAT translation occurs. Without this policy, the VIP alone does not allow traffic; it only defines the translation rule.

Answer

A policy from WAN to DMZ with source any, destination IP of the server (10.0.1.10), and action ACCEPT

Answer

No firewall policy is needed; the VIP automatically allows traffic

Answer

A policy from DMZ to WAN with source VIP, destination any, and action ACCEPT

Question 10

An administrator configures a Central SNAT policy to translate traffic from the internal network (10.0.0.0/8) to the internet using the IP pool 'pool1'. The administrator also has a firewall policy that uses policy-based NAT with an IP pool 'pool2'. Both policies match the same traffic. Which NAT will be applied?

Accepted Answer

Central SNAT using pool1. When Central SNAT is enabled, it overrides policy-based NAT for matching traffic. The firewall policies are still used for access control, but the NAT is determined by the central NAT rules. Central NAT has higher precedence than policy-based NAT.

Answer

Both NAT rules are applied in sequence

Answer

The traffic is dropped due to conflicting NAT configurations

Answer

Policy-based NAT using pool2

Question 11

Which of the following statements about firewall policy ordering in FortiGate is correct?

Accepted Answer

Policies are evaluated from top to bottom, and the first match is applied. FortiGate firewall policies are evaluated sequentially from top to bottom in the policy list. The first policy that matches the source, destination, service, and other criteria is applied, and no further policies are evaluated. This is the fundamental 'first-match' behavior that governs traffic processing in FortiGate.

Answer

Policies are evaluated from bottom to top

Answer

The most specific policy always takes precedence regardless of order

Answer

The implicit permit rule at the end allows all traffic not explicitly denied

Question 12

An administrator wants to ensure that traffic from the engineering department (subnet 192.168.10.0/24) to the internet uses a specific public IP address for source NAT. Additionally, traffic from the marketing department (192.168.20.0/24) should use a different public IP. Which method should be used?

Accepted Answer

Create two firewall policies, each with its own IP pool, for the respective subnets. Option B is correct because the requirement is to map specific source subnets to different public IP addresses. In FortiGate, this is achieved by creating separate firewall policies for each subnet, each with its own IP pool configured for source NAT. A single Central SNAT rule with one IP pool cannot differentiate between subnets to assign different public IPs.

Answer

Configure a single Central SNAT rule with multiple source subnets and a single IP pool

Answer

Use VIP for source NAT

Answer

Use a single policy with a dynamic IP pool that randomly assigns IPs

Question 13

An administrator uses 'diagnose sys session list' and sees the following output for a session: 'proto=6 proto_state=01 duration=3600 expire=3599'. The session is for HTTPS traffic. What does 'proto_state=01' typically indicate in FortiGate?

Accepted Answer

The session is in the initial connection setup phase (SYN_SENT). In FortiGate, 'proto_state=01' for TCP (proto=6) indicates the session is in the SYN_SENT phase, meaning the initial SYN packet has been sent but the three-way handshake is not yet complete. For HTTPS traffic, this shows the session is still in the connection setup stage, not fully established. The 'duration' and 'expire' values reflect the time since the session was created and the remaining timeout, which is typical for an incomplete handshake.

Answer

The session is being NATted

Answer

The session is fully established and active

Answer

The session is being inspected by a security profile

Question 14

An organization has multiple remote sites connected via IPsec VPN. The administrator needs to ensure that traffic from the internal network (10.0.0.0/8) to the VPN destination (10.10.0.0/16) uses a specific interface (port2) instead of the default route. Which feature should be configured?

Accepted Answer

Policy-based routing. Policy-based routing (PBR) allows you to override the default routing table by matching traffic based on source/destination addresses and directing it to a specific egress interface (port2). This is the correct feature because the requirement is to force traffic from 10.0.0.0/8 to 10.10.0.0/16 out port2, bypassing the default route.

Answer

Central NAT

Answer

Static route with higher distance

Answer

Traffic shaping

Question 15

Which of the following is NOT a valid address object type in FortiGate?

Accepted Answer

MAC address. FortiGate address objects support Subnet, Wildcard FQDN, and Geography types, but MAC addresses are not a valid address object type. MAC addresses are used in other contexts like static ARP entries or DHCP reservations, not as firewall address objects.

Answer

Subnet

Answer

Wildcard FQDN

Answer

Geography