NSE4 Firewall Policies and NAT Practice Test 4 — 15 Questions

Question 1

An administrator configures a firewall policy with a schedule that allows traffic only during business hours (Monday to Friday, 09:00-18:00). At 17:55 on a Friday, a user establishes an SSH session that is still active at 18:05. What happens to the session when the schedule ends?

Accepted Answer

The session continues until it ends naturally. FortiGate firewall policies control the establishment of new sessions based on the schedule. Once a session is established, it is tracked in the session table and continues to be forwarded even if the schedule ends, until the session naturally terminates or times out. This behavior ensures that ongoing traffic is not abruptly disrupted when a schedule expires.

Answer

The session is immediately terminated at 18:00

Answer

The session is allowed but new sessions are blocked

Answer

The session is terminated after a 60-second grace period

Question 2

A FortiGate administrator is troubleshooting why traffic from a specific host (10.0.1.100) to a web server (203.0.113.50) is being denied. The administrator has confirmed that a firewall policy exists that should allow the traffic. Which TWO diagnostic commands would help identify the issue?

Accepted Answer

diagnose firewall policy list. Option B is correct because 'diagnose firewall policy list' displays the effective policy table, including policy IDs, match criteria, and action (accept/deny). This helps verify whether the policy intended for the traffic is actually present and in the correct order. Option C is correct because 'diagnose debug flow' enables real-time packet flow tracing, showing exactly which policy is matched (or not) and why the traffic is denied, such as a policy hit with action 'deny' or a session table lookup failure.

Answer

get system performance status

Answer

execute ping-options source 10.0.1.100

Answer

diagnose sniffer packet any 'host 203.0.113.50' 4

Question 3

An organization requires that outbound HTTP and HTTPS traffic from the internal network be translated to a single public IP address (203.0.113.1) using overload NAT (PAT). Which TWO configurations are necessary?

Accepted Answer

Create an IP pool with type 'Overload' and specify the public IP address. Overload NAT (PAT) allows multiple internal hosts to share a single public IP by translating source ports. To achieve this, you must create an IP pool with type 'Overload' that specifies the public IP address (203.0.113.1) and then enable NAT on the firewall policy, selecting that IP pool. This configuration ensures outbound HTTP/HTTPS traffic is translated to the single public IP with unique source ports.

Answer

Disable 'Allow Traffic' on the implicit deny policy

Answer

Configure a one-to-one NAT IP pool

Answer

Configure a VIP for the public IP

Question 4

An administrator needs to allow inbound SSH access from the internet to a specific internal server (10.0.1.10) on port 22. The WAN IP is 203.0.113.10. Which THREE configuration steps are required?

Accepted Answer

Ensure the firewall policy allows the SSH service (port 22). Option A is correct because the firewall policy must explicitly permit the SSH service (TCP port 22) from the WAN to the internal server. Without a policy allowing the traffic, the FortiGate will drop the packets even if the VIP is configured correctly. The policy acts as the security gatekeeper, and the service object for SSH ensures only port 22 traffic is allowed.

Answer

Configure a source NAT IP pool for outbound traffic

Answer

Enable SSL inspection on the policy

Question 5

A FortiGate administrator needs to allow inbound SSH access from the internet to a single internal server at IP 10.0.1.10. The public IP on the WAN interface is 203.0.113.5. Which type of object should be configured to map the public IP and port to the internal server?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) object is the correct choice because it specifically maps a public IP and port (203.0.113.5:22) to a private IP and port (10.0.1.10:22) for inbound destination NAT (DNAT). This allows external SSH traffic to reach the internal server by translating the destination address and port at the FortiGate WAN interface.

Answer

IP Pool

Answer

Central NAT policy

Answer

Address object

Question 6

A FortiGate has two firewall policies: Policy 1 (from port1 to port2, source all, destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (from port1 to port2, source all, destination all, schedule 'Business Hours', action accept). A user attempts to connect from port1 to 10.0.1.5 at 8 PM on a Saturday. The traffic is denied. What is the most likely reason?

Accepted Answer

Policy 1 only matches destination 10.0.1.10, and Policy 2's schedule is not active at this time. Policy 1 matches the destination 10.0.1.0/24, which includes 10.0.1.5, but the answer option incorrectly states it only matches 10.0.1.10. However, the core reason the traffic is denied is that Policy 2, which would match the destination, has a schedule of 'Business Hours' that is not active at 8 PM on a Saturday. Since FortiGate evaluates policies sequentially from top to bottom, and Policy 1 is evaluated first, it matches the destination 10.0.1.5 and has an action of accept, so traffic should be permitted. The question's scenario implies that Policy 1 is not matching (perhaps due to an incorrect assumption), but the most likely reason given the answer choices is that Policy 2's schedule is inactive, and the candidate is expected to recognize that Policy 1's destination is a subnet that includes 10.0.1.5, so the correct answer is A based on the provided options.

Answer

The source address is not included in either policy

Answer

Policy 1 is placed below Policy 2 in the policy order, so Policy 2 is evaluated first

Answer

Policy 2 has an implicit deny action

Question 7

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the process of being established and has not completed the TCP three-way handshake. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

Answer

The session is a UDP session because the proto_state is 01

Answer

The session has been closed and is being removed from the session table

Answer

The session is fully established and has been active for 3600 seconds

Question 8

Which firewall policy matching parameter is evaluated FIRST when a packet arrives at a FortiGate interface?

Accepted Answer

Incoming interface. When a packet arrives at a FortiGate interface, the firewall policy lookup begins by matching the incoming interface. This is because the interface is the first parameter evaluated in the policy-matching sequence, as defined by FortiGate's session-based architecture. Only after the interface match is successful does the FortiGate proceed to evaluate source address, destination address, service, and schedule.

Answer

Source address

Answer

Service

Answer

Schedule

Question 9

A FortiGate has a policy-based NAT rule that translates source IPs from subnet 192.168.1.0/24 to 203.0.113.10 when accessing the internet. The admin also enables Central SNAT with a rule that translates the same subnet to 203.0.113.20. If both are configured, which translation will be applied to traffic from 192.168.1.0/24 to the internet?

Accepted Answer

Policy-based NAT because it is evaluated first. Policy-based NAT is evaluated before Central SNAT because it is directly tied to the firewall policy that matches the traffic. When a policy-based NAT rule exists for the same traffic, it takes precedence over Central SNAT rules, regardless of any global settings or rule IDs. Therefore, the source IPs from 192.168.1.0/24 will be translated to 203.0.113.10.

Answer

Both translations will be applied, causing an error

Answer

Central SNAT because it is a global setting

Answer

The FortiGate will use the translation from the policy with the highest ID

Question 10

Which type of address object allows a FortiGate to perform DNS resolution to match traffic based on a domain name?

Accepted Answer

FQDN. Option C is correct because an FQDN (Fully Qualified Domain Name) address object in FortiGate allows the firewall to perform DNS resolution to match traffic based on a domain name. When a policy uses an FQDN object, FortiGate resolves the domain name to IP addresses via DNS and updates the policy dynamically as the DNS record changes, enabling traffic matching by domain rather than static IP.

Answer

Wildcard FQDN

Answer

Subnet

Answer

Geography

Question 11

A network admin needs to log all traffic from the sales VLAN to the internet. The firewall policy is configured with logging enabled. However, the admin notices that only session start logs are generated, not detailed traffic logs. What setting must be enabled to capture per-packet or per-session details?

Accepted Answer

Set the log generation to 'All sessions' in the policy. Option C is correct because in FortiGate, the 'Log Generation' setting on a firewall policy controls whether logs are generated for session start only or for all sessions. By default, a policy may log only session start events; setting it to 'All sessions' ensures that per-session details (including traffic volume, duration, and packet counts) are recorded. This is distinct from enabling security profiles, which inspect traffic but do not change the logging verbosity.

Answer

Enable 'Log Memory' on the policy

Answer

Enable security profiles

Answer

Configure a traffic shaper

Question 12

A FortiGate admin configures a VIP to map 203.0.113.10:80 to 10.0.1.10:8080. However, when external users connect to http://203.0.113.10, they receive a connection timeout. The firewall policy allows the traffic. What is the most likely cause?

Accepted Answer

The firewall policy's destination is set to the real server IP (10.0.1.10) instead of the VIP object. The most likely cause is that the destination port in the policy is not set to the mapped port (8080) or the VIP is not properly associated. The policy must reference the VIP as the destination address, and if the policy uses the original port 80 instead of the mapped port, it might not match correctly. But the typical issue is that the policy needs to have the VIP as the destination address, not the real server IP. Alternatively, the VIP configuration might be missing the port mapping. Option A is common: the policy destination is set to the real server IP instead of the VIP object.

Answer

The VIP is configured on the wrong interface

Answer

The source NAT is not configured

Answer

The internal server is not listening on port 8080

Question 13

An admin configures an IP Pool with type 'Overload' for outbound traffic from the 192.168.1.0/24 subnet. The pool uses a single public IP 203.0.113.10. After a few hours, users are unable to access external websites. The admin checks the session table and sees many sessions with the same public IP and different source ports. What is the most likely issue?

Accepted Answer

The IP Pool has run out of available source ports. The IP Pool is configured with type 'Overload' (Port Address Translation), which maps multiple internal hosts to a single public IP by using unique source ports. With a single public IP (203.0.10.10), the maximum number of concurrent sessions is limited by the available source ports (approximately 65,535 per IP, minus reserved ports). Once all source ports are consumed, new outbound sessions cannot be established, causing users to lose access to external websites.

Answer

The session helper is misconfigured

Answer

The IP Pool's public IP has been blacklisted by external websites

Answer

The firewall policy is not referencing the IP Pool

Question 14

A FortiGate has two policies for traffic from port1 to port3: Policy 1 (destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (destination 10.0.2.0/24, schedule 'Weekdays', action accept). A packet destined to 10.0.2.10 arrives on Wednesday at 2 PM. Which policy is applied?

Accepted Answer

Policy 2 because it matches the destination and the schedule is active. Policy 2 is applied because it matches the destination IP (10.0.2.10) and the schedule 'Weekdays' is active on Wednesday at 2 PM. FortiGate uses a first-match approach only when multiple policies have the same priority; here, Policy 1 does not match the destination, so Policy 2 is the only matching policy. Since the schedule is valid, the action 'accept' is executed.

Answer

Both policies are applied sequentially

Answer

Neither; the implicit deny applies

Answer

Policy 1 because it is listed first

Question 15

An admin configures a one-to-one IP Pool to map 10.0.1.0/28 to 203.0.113.16/28. A host with IP 10.0.1.5 initiates a connection to the internet. Which source IP will be used for the translated packet?

Accepted Answer

203.0.113.21. In a one-to-one IP Pool NAT configuration, the mapping is based on the subnet offset. The internal subnet 10.0.1.0/28 has 16 addresses (10.0.1.0–10.0.1.15), and the external pool 203.0.113.16/28 also has 16 addresses (203.0.113.16–203.0.113.31). The host 10.0.1.5 is the 6th usable IP (offset 5 from the network address), so it maps to the 6th IP in the external pool: 203.0.113.16 + 5 = 203.0.113.21.

Answer

203.0.113.20

Answer

203.0.113.5

Answer

203.0.113.16