NSE4 Firewall Policies and NAT Practice Test 4 — 15 Questions

Question 1

A network administrator needs to allow only HTTPS traffic from the internal network (10.0.0.0/8) to the public DNS server (8.8.8.8). Which firewall policy configuration BEST enforces this restriction?

Accepted Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: HTTPS, Action: Accept. It specifies the internal network (10.0.0.0/8) as the source, the public DNS server (8.8.8.8) as the destination, and HTTPS (TCP/443) as the service, with an Accept action. This precisely matches the requirement to allow only HTTPS traffic from the internal network to that specific destination, blocking all other traffic by default via the implicit deny rule.

Answer

Source: ALL, Destination: 8.8.8.8, Service: HTTPS, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: 8.8.8.8, Service: ALL, Action: Accept

Answer

Source: 10.0.0.0/8, Destination: ALL, Service: HTTPS, Action: Accept

Question 2

An administrator configures a firewall policy allowing traffic from the internal network to the internet with NAT enabled. Users report that some outbound connections fail intermittently. The administrator runs 'diagnose sys session list' and sees many sessions in 'proto_state=01' with a short TTL. What is the most likely cause?

Accepted Answer

The IP pool used for SNAT has exhausted its address range. The 'diagnose sys session list' output showing many sessions in 'proto_state=01' with a short TTL indicates that sessions are failing to establish properly. When the IP pool used for Source NAT (SNAT) exhausts its address range, new outbound connections cannot obtain a translated source IP, causing them to fail intermittently. This matches the symptom of intermittent failures as the pool becomes temporarily depleted.

Answer

The firewall policy has the wrong source interface

Answer

The destination port is blocked by an implicit deny rule

Answer

The antivirus profile is blocking the connections

Question 3

A FortiGate administrator needs to ensure that traffic from the LAN (192.168.1.0/24) to the DMZ (10.0.0.0/24) uses a specific outbound interface (port3) instead of the default route. Which feature should be configured to achieve this?

Accepted Answer

Policy-based routing (PBR) in the firewall policy. Policy-based routing (PBR) allows the FortiGate to override the routing table for specific traffic based on criteria defined in a firewall policy, such as source and destination addresses. By configuring a PBR rule that matches traffic from 192.168.1.0/24 to 10.0.0.0/24 and setting the outbound interface to port3, the administrator can force this traffic to use port3 instead of the default route. This is the correct feature for interface-based path selection that is not based on destination prefix alone.

Answer

Static route with a higher distance

Answer

Virtual IP (VIP) with port forwarding

Answer

SD-WAN rule to force traffic to port3

Question 4

An administrator configures a VIP for inbound HTTP traffic to an internal server (192.168.1.10:80). External users can reach the server via the VIP, but internal users on the same subnet as the server cannot access the server using its public IP. What is the most likely cause?

Accepted Answer

NAT reflection (hairpin NAT) is not enabled. Internal users on the same subnet as the server (192.168.1.10) attempting to reach the server via its public VIP (e.g., 203.0.113.10) will send packets to the FortiGate, which performs destination NAT (DNAT) to the private IP. Without NAT reflection (also called hairpin NAT or NAT loopback), the FortiGate does not translate the source IP for traffic that enters and leaves the same interface, so the server sees the source as the internal user's private IP and replies directly, bypassing the FortiGate. This breaks the return path because the internal user's packet was destined for the VIP but the reply comes from the private IP, causing asymmetric routing and connection failure.

Answer

The internal users do not have a route to the VIP's public IP

Answer

The firewall policy for internal-to-DMZ traffic has NAT disabled

Answer

The VIP is configured on the wrong interface

Question 5

A FortiGate has two firewall policies: Policy 1 (ID 1) allows HTTP from any to 10.0.0.0/8, and Policy 2 (ID 2) denies all traffic from 192.168.1.0/24 to any. Traffic from 192.168.1.10 to 10.0.0.5 on port 80 is received. Which policy will match first?

Accepted Answer

Policy 1 (ID 1) will match and accept the traffic. Policy 1 (ID 1) matches first because FortiGate evaluates firewall policies in sequential order from top to bottom (lowest ID to highest ID) until a match is found. The source IP 192.168.1.10 falls within the 'any' source of Policy 1, and the destination 10.0.0.5 is within 10.0.0.0/8, with HTTP (port 80) matching the service. Since Policy 1 matches, it is applied and the traffic is accepted, even though Policy 2 would also match if reached.

Answer

Both policies will match, and the traffic will be denied

Answer

Policy 2 (ID 2) will match and deny the traffic

Answer

Neither policy matches, so the traffic is dropped by default deny

Question 6

An administrator needs to allow VoIP traffic from a remote branch (192.168.2.0/24) to the main office (10.0.0.0/8) using UDP ports 5060 and 10000-20000. What is the most efficient way to define the service in the firewall policy?

Accepted Answer

Create a service group containing both service objects. Creating a service group allows you to combine two separate service objects (one for UDP 5060 and one for UDP 10000-20000) into a single logical group, which can then be applied in one firewall policy. This is the most efficient method as it avoids duplicating policies or using an overly broad port range, and it leverages FortiGate's service group feature for clean, manageable rule sets.

Answer

Use a custom service object with port range 5060-20000

Answer

Create two separate firewall policies, one for each port range

Answer

Use the predefined 'VoIP' service object

Question 7

An administrator configures Central SNAT with a dynamic IP pool for internet-bound traffic. Some users report that certain applications fail when they should be translated to a specific public IP. The administrator checks the policy-based NAT rules and finds none. What is the most likely reason for the failure?

Accepted Answer

A higher priority Central SNAT rule matches the traffic first. Central SNAT rules are evaluated in order of priority, and the first matching rule is applied. If a higher-priority Central SNAT rule matches the traffic before the intended rule with the specific public IP, the traffic will be translated to the IP defined in that higher-priority rule, causing the applications to fail. Since no policy-based NAT rules exist, the issue lies in the Central SNAT rule priority order.

Answer

The traffic is being dropped by a security profile

Answer

The firewall policy has NAT disabled

Answer

The IP pool is configured on the wrong interface

Question 8

Which statement about the implicit deny policy at the bottom of the firewall policy list is true?

Accepted Answer

It drops all traffic that does not match any explicit policy. The implicit deny policy is a built-in, unchangeable rule at the bottom of the FortiGate firewall policy list that drops all traffic not matching any explicit policy. It ensures that only explicitly permitted traffic is allowed, enforcing a default-deny security posture. This policy cannot be edited, removed, or reordered, and it applies to all traffic regardless of source.

Answer

It only applies to traffic from the internet

Answer

It can be edited to change the action to accept

Answer

It is optional and can be removed

Question 9

An administrator wants to log all traffic that is denied by the implicit deny rule. How can this be achieved?

Accepted Answer

Create a firewall policy with action DENY and enable logging, placed above the implicit deny. The implicit deny rule at the bottom of the firewall policy list cannot be modified to enable logging. To log traffic denied by the implicit deny, you must create an explicit firewall policy with action DENY and logging enabled, placed above the implicit deny rule. This explicit deny policy will match traffic that would otherwise hit the implicit deny, and because it is an explicit policy, logging can be enabled on it.

Answer

Configure a firewall policy with action ACCEPT and enable logging

Answer

Enable logging on the implicit deny rule

Answer

Use the 'diagnose debug flow' command to capture all traffic

Question 10

An administrator needs to translate a single internal server (192.168.1.10:8080) to a public IP (203.0.113.10:80) so that external users can access it via HTTP. Which type of VIP should be configured?

Accepted Answer

Port Forwarding VIP. Port Forwarding VIP (also called DNAT or destination NAT) is the correct choice because it translates a single internal server's IP and port (192.168.1.10:8080) to a specific public IP and port (203.0.113.10:80), allowing external HTTP users to reach the internal server. This is a one-to-one mapping of a public IP:port to a private IP:port, which is the exact definition of port forwarding in FortiGate.

Answer

Server Load Balancing VIP

Answer

Virtual IP (VIP) with no port forwarding

Answer

Static NAT (one-to-one VIP)

Question 11

An administrator runs 'diagnose firewall iprope list 100000' and sees 'action=deny' entries for traffic that should be allowed. The policy list shows an allow policy with ID 1 for that traffic. What is the most likely cause of the deny?

Accepted Answer

The firewall policy is not installed in the kernel due to an error. The 'diagnose firewall iprope list 100000' command displays the kernel-level firewall policy list. If the policy list shows an allow policy (ID 1) but the kernel entries show 'action=deny', it indicates that the policy was not successfully installed into the kernel's connection tracking or firewall engine. This typically occurs due to a policy installation error, such as a configuration inconsistency or a failure during the commit process, causing the kernel to fall back to a default deny action for that traffic.

Answer

The traffic is being blocked by a local-in policy

Answer

The implicit deny rule is being triggered because the policy is disabled

Answer

A security profile is dropping the traffic after the policy matches

Question 12

A FortiGate administrator needs to allow SMTP traffic (TCP port 25) from the internal network (10.0.0.0/8) to a mail server in the DMZ (172.16.0.10). The administrator wants to apply an antivirus profile and log all sessions. Which THREE configuration steps are required?

Accepted Answer

Create a firewall policy with source: 10.0.0.0/8, destination: 172.16.0.10, service: SMTP, action: ACCEPT. A firewall policy must be created to allow SMTP traffic from the internal network (10.0.0.0/8) to the DMZ mail server (172.16.0.10) on TCP port 25. The policy must specify the source, destination, service (SMTP), and action (ACCEPT) to permit the traffic. Without this policy, the traffic would be blocked by default.

Answer

Create a schedule object and apply it to the policy

Answer

Configure NAT on the policy to translate source IPs

Question 13

An administrator needs to configure outbound NAT for 200 internal users using a single public IP (203.0.113.1). The public IP provides 2000 ports. Some applications require a deterministic source port range for logging. Which TWO NAT settings should be used?

Accepted Answer

IP Pool type: Overload. (IP Pool type: Overload) is correct because it enables Port Address Translation (PAT), allowing 200 internal users to share a single public IP (203.0.113.1) by multiplexing sessions across the 2000 available ports. Option E (Set 'Fixed Port Range' on the IP Pool) is correct because it assigns a deterministic source port range to each user, which is required for logging and auditing applications that expect consistent port mappings.

Answer

IP Pool type: One-to-One

Answer

Configure a VIP for the public IP

Answer

Enable session helper for application

Question 14

A company has two internet connections (WAN1 and WAN2). The administrator wants to route HTTP traffic from the internal network through WAN1, and all other traffic through WAN2. Which TWO configurations are needed?

Accepted Answer

Define an SD-WAN rule that matches HTTP and sets WAN1 as preferred. SD-WAN rules allow you to define application-based routing policies. By creating an SD-WAN rule that matches HTTP traffic and sets WAN1 as the preferred interface, the FortiGate will automatically steer HTTP sessions out through WAN1 while using the default routing table (which points to WAN2) for all other traffic. This leverages the SD-WAN feature's ability to perform per-application load balancing and failover without requiring policy-based routing.

Answer

Apply NAT with IP pool on the firewall policy

Answer

Add a static route with a lower priority to WAN1

Answer

Configure load balancing between WAN1 and WAN2

Question 15

What is the default action of the implicit deny policy at the end of the firewall policy list?

Accepted Answer

Deny. In FortiGate firewalls, the implicit deny policy at the end of the firewall policy list has a default action of 'Deny'. This means any traffic that does not match an explicit firewall policy is automatically dropped. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall.

Answer

Monitor (log only)

Answer

Allow

Answer

Redirect to authentication