NSE4 Firewall Policies and NAT Practice Test 5 — 15 Questions

Question 1

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 3600 seconds and will expire in 3599 seconds. The output shows 'duration=3600' and 'expire=3599', which directly indicate the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds. The 'proto=6' confirms TCP (protocol 6), and 'proto_state=01' indicates an established TCP session. This is a standard FortiGate session diagnostic display.

Answer

The session is experiencing packet loss

Answer

The session is a UDP connection

Answer

The session is blocked by a firewall policy

Question 2

A FortiGate is configured with multiple VDOMs. The administrator creates a firewall policy in VDOM A that allows traffic from VDOM A to VDOM B using inter-VDOM links. Users in VDOM A can initiate traffic, but return traffic from VDOM B is not reaching them. What is the MOST likely cause?

Accepted Answer

The reverse path forwarding (RPF) check is blocking return traffic. In a multi-VDOM FortiGate, inter-VDOM traffic requires firewall policies in both involved VDOMs to establish a session. Once the initial session is successfully established, return traffic is handled by the session table and does not require a separate policy. If users in VDOM A can initiate traffic, the policies in both VDOMs for the forward direction must exist. The failure of return traffic is therefore more likely due to a reverse path forwarding (RPF) check, which validates that the source address of a packet is reachable via the interface on which the packet arrived. If the return path uses an asymmetric route, the RPF check may drop the packets.

Answer

The inter-VDOM link is down

Answer

The session helper is not configured for the application

Answer

A firewall policy is missing in VDOM B to allow return traffic

Question 3

What is the purpose of policy-based routing (PBR) in FortiGate?

Accepted Answer

To route traffic based on source address, destination, or other attributes instead of the routing table. Policy-based routing (PBR) in FortiGate allows you to override the default routing table lookup by forwarding traffic based on criteria such as source IP address, destination IP address, protocol, or even application. This is configured under the 'policy route' feature and is evaluated before the routing table, enabling granular control over traffic paths that static or dynamic routes cannot provide.

Answer

To load balance traffic across multiple WAN links

Answer

To filter traffic based on application signatures

Answer

To authenticate users before allowing traffic

Question 4

An administrator is troubleshooting why traffic from a specific subnet (192.168.10.0/24) to the internet is not being matched by the expected firewall policy. The policy list shows an allow policy for this traffic at ID 10, but there is a deny policy at ID 5 for any traffic from 192.168.0.0/16. Which TWO statements are correct?

Accepted Answer

The deny policy at ID 5 is matching the traffic before the allow policy at ID 10. FortiGate firewall policies are evaluated sequentially from top to bottom based on their policy ID. Since policy ID 5 (deny for 192.168.0.0/16) appears before policy ID 10 (allow for 192.168.10.0/24), traffic from 192.168.10.0/24 is matched by the broader deny policy first, and the allow policy is never reached. This is a fundamental behavior of FortiGate's policy lookup order.

Answer

The allow policy at ID 10 will override the deny policy because it is more specific

Answer

The traffic will be matched by the implicit deny at the end of the policy list

Answer

The administrator should enable 'policy override' on the allow policy

Question 5

A network admin configures a firewall policy allowing HTTP traffic from internal users to an external web server. The policy uses a service object 'HTTP' defined as TCP/80. However, users cannot reach the server. What is the MOST likely cause?

Accepted Answer

The external web server is using HTTPS (TCP/443) instead of HTTP. The firewall policy explicitly allows TCP/80 (HTTP), but the external web server is using TCP/443 (HTTPS). Since the service object does not match the actual traffic, the firewall will drop or reject the packets, preventing connectivity. This is a classic service mismatch issue in FortiGate firewall policies.

Answer

The source address object does not include the users' subnet

Answer

The policy order is wrong; the policy is placed after a deny-all policy

Answer

The interface is set to the wrong zone

Question 6

A company wants to allow FTP (TCP ports 20-21) from their internal network (192.168.1.0/24) to a specific external server (203.0.113.50). They also need to inspect FTP traffic for viruses. What should the admin configure?

Accepted Answer

Create a policy from internal to external with service FTP and enable antivirus. FTP traffic can be inspected by applying an antivirus profile directly to a regular firewall policy. An explicit proxy policy is not required; a simple policy from internal to external with FTP service and antivirus enabled is sufficient. Therefore, option A is correct.

Answer

Configure an explicit proxy policy for FTP and apply antivirus

Answer

Enable NAT on the policy and use a custom service for FTP

Answer

Use a policy with service ALL and rely on the antivirus profile

Question 7

A FortiGate is configured with multiple policies. The first policy allows traffic from 10.0.0.0/8 to any destination. The second policy denies traffic from 10.0.1.0/24 to any destination. What happens when a packet from 10.0.1.5 to 8.8.8.8 arrives?

Accepted Answer

The packet is allowed by the first policy. FortiGate firewall policies are evaluated in sequential order from top to bottom. The first policy matches source 10.0.0.0/8, which includes 10.0.1.5, and allows the traffic to any destination. Since the packet matches this policy first, it is accepted and the second policy is never evaluated. Therefore, the packet is allowed by the first policy.

Answer

The packet is denied by implicit deny

Answer

The packet matches both policies and is allowed

Answer

The packet is denied by the second policy

Question 8

A FortiGate admin runs 'diagnose sys session filter src 10.0.0.10' and gets no output. What does this indicate?

Accepted Answer

The source IP 10.0.0.10 is not currently active in any session table. The 'diagnose sys session filter' command in FortiGate is used to filter and display active session entries in the session table. When the command 'diagnose sys session filter src 10.0.0.10' returns no output, it means that no session in the session table matches the source IP address 10.0.0.10, indicating that this IP is not currently involved in any active session. This does not imply the session table is full, a policy block, or a syntax error.

Answer

The session table is full

Answer

The firewall policy is blocking traffic from 10.0.0.10

Answer

The diagnose command syntax is incorrect

Question 9

An organization needs to restrict internet access for employees to business hours only (Monday to Friday, 8:00 to 18:00). Which object should the admin use in the firewall policy?

Accepted Answer

A schedule object with recurring time. A schedule object with recurring time is the correct choice because FortiGate firewall policies use schedule objects to define time-based access control. A recurring schedule allows you to specify days of the week and a time range (e.g., Monday to Friday, 8:00-18:00) that repeats weekly, which perfectly matches the requirement for business hours only.

Answer

A time-range object

Answer

An on-time schedule

Answer

A calendar object

Question 10

A FortiGate has a policy that allows traffic from 10.0.0.0/8 to any destination with NAT enabled using an IP pool 'Pool1' (203.0.113.10-203.0.113.20). The admin notices that internal servers using fixed ports (e.g., SIP) are failing. What is the likely cause?

Accepted Answer

The IP pool is configured with overload (PAT), which changes source ports. When an IP pool is configured with overload (PAT), the FortiGate translates the source IP address and also changes the source port to a random high port. For protocols like SIP that rely on fixed source ports (e.g., UDP 5060), this port remapping breaks the application because the SIP server expects traffic from a specific port. Option D correctly identifies this as the root cause.

Answer

The policy order is incorrect

Answer

The IP pool is configured with one-to-one NAT

Answer

The IP pool uses fixed port range, which should work

Question 11

An admin needs to create a firewall policy that matches traffic based on the destination being a specific geographic location (e.g., France). Which address object should be used?

Accepted Answer

A geography object. A geography object is specifically designed to match traffic based on geographic location (country, continent, or region) using the GeoIP database integrated into FortiOS. When a firewall policy needs to allow or deny traffic to or from a specific country like France, a geography object is the correct address object type because it dynamically resolves IP ranges assigned to that country by IANA/RIRs.

Answer

An FQDN object

Answer

A subnet object

Answer

A wildcard FQDN object

Question 12

A FortiGate admin is troubleshooting an issue where internal users cannot access a specific external service over TCP/443. The admin confirms that the firewall policy allows HTTP/HTTPS. Which TWO CLI commands should the admin use to diagnose? (Choose two.)

Accepted Answer

diagnose firewall iprope list. 'diagnose firewall iprope list' displays the kernel's internal firewall rule chains, allowing the admin to verify whether the policy lookup is matching the expected rule for TCP/443 traffic. This command helps confirm that the policy is installed and active in the kernel, which is essential for troubleshooting policy-based access issues.

Answer

diagnose sys session filter dport 443

Answer

get system performance status

Answer

execute ping 8.8.8.8

Question 13

An organization wants to implement least privilege for firewall policies. Which THREE best practices should be followed? (Choose three.)

Accepted Answer

Specify the exact services required (e.g., TCP/443, TCP/22). Specifying exact services (e.g., TCP/443, TCP/22) enforces least privilege by allowing only the necessary protocols and ports, reducing the attack surface. In FortiGate firewall policies, this is configured under the 'Service' field, where you can select predefined services or create custom ones to match specific TCP/UDP port numbers. This prevents overly permissive rules that could expose services like SMB (TCP/445) or RDP (TCP/3389) unintentionally.

Answer

Use a single schedule covering all days

Answer

Use any any for source and destination to simplify management

Question 14

A FortiGate admin needs to configure source NAT for traffic from the internal network (10.0.0.0/8) to the internet. The requirement is to translate all internal IPs to a range of public IPs (203.0.113.1-203.0.113.10) while preserving the source port for specific applications. Which TWO configurations can achieve this? (Choose two.)

Accepted Answer

Use a One-to-One IP Pool. A One-to-One IP Pool maps each internal IP to a unique public IP from the range 203.0.113.1-203.0.113.10, preserving the original source port for each session. Option E is also correct because a Fixed Port Range IP Pool uses a range of ports for each public IP and does not perform port overloading, thereby preserving the original source port. Both methods meet the requirement to translate all internal IPs while keeping the source port unchanged for specific applications. The pool of 10 public IPs is sufficient for both methods, but Fixed Port Range requires a port range to be specified.

Answer

Use a Dynamic IP Pool with Overload

Answer

Enable NAT on the policy without an IP pool

Answer

Configure Central SNAT with Overload

Question 15

An admin needs to ensure that all traffic from the 10.0.1.0/24 network to the internet uses a specific public IP address (203.0.113.10) as the source IP, with port translation enabled. The FortiGate has multiple WAN interfaces. Which NAT configuration should the admin use on the firewall policy?

Accepted Answer

Create an IP pool of type Overload with the range 203.0.113.10 and select it in the policy. An IP Pool of type Overload allows you to specify a single public IP address (203.0.113.10) as the translated source IP for all traffic from 10.0.1.0/24, with port address translation (PAT) enabled. This ensures that all outbound traffic uses that specific IP as the source, regardless of which WAN interface the traffic egresses, and the 'Overload' type automatically performs port translation to multiplex multiple internal hosts behind that single IP.

Answer

Enable NAT on the policy and set the IP pool configuration to use the interface address

Answer

Configure a Central SNAT rule that matches the source subnet and set the translated address to 203.0.113.10

Answer

Use a VIP to perform destination NAT and set the source IP in the VIP configuration