NSE4 Firewall Policies and NAT Practice Test 6 — 15 Questions

Question 1

A FortiGate administrator wants to allow traffic from the internal network to a specific external server using its fully qualified domain name (FQDN) rather than an IP address, because the server's IP changes frequently. Which type of address object should the administrator create for the destination?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FQDN object. FQDN object. FortiGate FQDN objects resolve domain names to IP addresses dynamically, allowing the firewall to update the destination IP automatically when the server's IP changes. This is ideal for scenarios where the external server uses a fully qualified domain name and its IP address is not static.

Answer

Subnet object

Answer

Wildcard FQDN object

Answer

Geography object

Question 2

An admin runs 'diagnose sys session filter saddr 10.0.1.10' and 'diagnose sys session list' to check sessions from a specific internal host. The output shows multiple sessions with destination IP 203.0.113.50 using source port 12345. The admin then checks the firewall policy and sees that the policy uses an IP pool for source NAT. What does the source port 12345 indicate?

Accepted Answer

The internal host's original source port is 12345. The 'diagnose sys session list' output shows both pre-NAT and post-NAT session details. The 'src' field displays the original source IP and port before NAT. Since the session filter is set to saddr 10.0.1.10, the source port 12345 shown in the session's 'src' line is the internal host's original source port. The translated source port would be displayed in the separate 'nat' field if PAT changes it.

Answer

The IP pool is configured for one-to-one NAT (no port translation)

Answer

The IP pool is using port range 12345-12345

Answer

This is the translated source port after PAT

Question 3

A company has a FortiGate with two WAN interfaces (port1 and port2) connected to different ISPs. The admin wants to ensure that traffic from a specific internal server (10.0.1.100) destined to the internet always exits via port2, while all other traffic uses port1. Which feature should the admin configure on the firewall policy for that server?

Accepted Answer

Enable policy-based routing on the policy and specify port2 as the egress interface. Policy-based routing (PBR) allows you to override the routing table for specific traffic based on criteria such as source IP, destination, or application. By creating a policy route that matches source 10.0.1.100 and setting port2 as the outgoing interface, the admin ensures that all traffic from that server exits via port2, while the routing table continues to direct all other traffic via port1. This is the correct approach because PBR operates at the routing level, not the firewall policy level.

Answer

Create a VIP to redirect the traffic to port2

Answer

Configure a static route with a higher distance for port2

Answer

Set the outgoing interface to port2 in the firewall policy

Question 4

A FortiGate has a firewall policy with NAT enabled using an IP pool of type 'Fixed Port Range'. The pool range is 203.0.113.10-203.0.113.20 with port range 10000-20000. A user initiates a connection to an external server. Which of the following describes how the FortiGate will assign the source address and port?

Accepted Answer

The FortiGate assigns a fixed IP and port mapping based on the original source IP and port, so the same internal host always gets the same public IP and port range. Fixed Port Range NAT (also known as NAT with fixed port range) creates a deterministic mapping between an internal host's source IP address and a specific public IP and port range from the pool. This mapping is based on a hash of the original source IP address only; the original source port number is not used in the selection. All sessions from the same internal host will use the same public IP and dedicated port range (10000-20000), which is essential for protocols that require consistent source addressing, such as SIP or H.323. The FortiGate does not round-robin, randomly assign, or sequentially assign IPs/ports; it hashes the source IP to select the fixed public IP and port range.

Answer

The FortiGate uses the pool IPs in round-robin and assigns the same port number as the original source port

Answer

The FortiGate randomly selects an IP from the pool and a random port from 10000-20000 for each session

Answer

The FortiGate uses the first available IP in the pool and assigns a port sequentially from 10000 upward

Question 5

An administrator is creating firewall policies for a FortiGate that separates the internal network (10.0.1.0/24) from a DMZ (192.168.1.0/24). The goal is to allow HTTP traffic from the internal network to the DMZ web server (192.168.1.10) but deny all other traffic. What is the recommended security posture for the implicit deny policy?

Accepted Answer

Rely on the implicit deny policy at the end of the policy list, which will block all traffic not explicitly allowed. The implicit deny policy is a default, hidden policy at the end of the FortiGate policy list that denies all traffic not explicitly allowed by preceding policies. Since the administrator wants to allow only HTTP traffic from internal to the DMZ web server and deny all other traffic, relying on the implicit deny is the correct and recommended security posture. It automatically blocks everything else without requiring manual configuration, ensuring no unintended traffic is permitted.

Answer

Set the allow policy to also deny all other traffic using security profiles

Answer

Disable the implicit deny policy and create a catch-all deny policy

Answer

Create an explicit deny policy with logging enabled before the allow policy

Question 6

An admin configures a firewall policy with a schedule object that restricts access to Monday to Friday from 9:00 to 17:00. A user attempts to connect on Saturday at 10:00. Which of the following best describes what happens?

Accepted Answer

The FortiGate skips this policy and tries the next policy; if no match, implicit deny blocks the traffic. If the schedule does not match the current time, the firewall policy is not evaluated for that traffic. The FortiGate continues to check subsequent policies. If no other policy matches, the implicit deny rule blocks the traffic.

Answer

The traffic is allowed because the schedule is only used for logging

Answer

The traffic is allowed because the schedule is optional

Answer

The traffic is denied because the schedule is not valid

Question 7

An admin needs to configure a FortiGate to allow multiple internal servers to be accessible from the internet using the same public IP but different ports. For example, internal server A (192.168.1.10:80) should be reachable via 203.0.113.10:8080, and internal server B (192.168.1.20:443) via 203.0.113.10:8443. Which TWO configuration steps are required?

Accepted Answer

Create two separate VIPs, one for each server, and add them to a VIP group. Each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

Answer

Disable NAT on the policy to preserve the source IP

Answer

Configure Central SNAT to translate the source IP

Answer

Create a single VIP with port forwarding that maps multiple ports

Question 8

A FortiGate admin is creating a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network. The admin wants to ensure that traffic is inspected by security profiles (antivirus, web filter). Which THREE of the following must be configured on the firewall policy to achieve this?

Accepted Answer

Set the action to ACCEPT. Setting the action to ACCEPT is mandatory for the firewall policy to allow traffic through. Without ACCEPT, the policy would deny traffic by default, preventing any inspection by security profiles. The ACCEPT action enables the FortiGate to process the traffic through the configured security profiles.

Answer

Set the schedule to always

Answer

Enable NAT on the policy

Question 9

A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?

Accepted Answer

Policy 5 has a higher priority because it is above policy 10 in the policy list. FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. Since policy 5 with source 'all' and destination 'all' is listed above policy 10, traffic from 10.0.1.0/24 to the internet matches policy 5 first, preventing policy 10 from ever being evaluated. This is the most likely reason the intended policy is not being matched.

Answer

Policy 10 is configured with an expired security certificate

Answer

The source address object 'internal_subnet' is incorrectly configured

Answer

Policy 10 has a schedule that is not active

Question 10

A FortiGate administrator needs to create a firewall policy that allows outbound traffic to the internet but denies access to a specific list of malicious IP addresses. The malicious IP list is updated frequently. Which address object type should be used for the destination addresses to block?

Accepted Answer

FQDN address object. FQDN address objects can resolve to a list of IP addresses that change dynamically, making them suitable for frequently updated IP lists. Subnet objects are static.

Answer

IP Range address object

Answer

Geography address object

Answer

Subnet address object

Question 11

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been established for 1 hour and will expire in about 1 hour. The output shows `proto=6`, which indicates TCP (protocol number 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. The `duration=3600` means the session has been active for 3600 seconds (1 hour), and `expire=3599` indicates the session will expire in 3599 seconds (approximately 1 hour). This matches the description of a TCP session established for 1 hour with about 1 hour remaining before expiry.

Answer

The session is a UDP session with destination port 443

Answer

The session will expire in 3600 seconds

Answer

The session is a TCP session in SYN_SENT state

Question 12

A FortiGate administrator configures a Central SNAT policy to translate internal IPs to a single public IP for internet access. However, traffic from a specific internal server (10.0.1.100) must use a different public IP. The administrator also creates a policy-based NAT rule in the firewall policy for that server. Which NAT method takes precedence?

Accepted Answer

Central SNAT takes precedence over policy-based NAT. In FortiGate, when both Central SNAT and policy-based NAT (configured within a firewall policy) are present, Central SNAT takes precedence. This is because Central SNAT is evaluated before policy-based NAT in the NAT processing order, and once a match is found in Central SNAT, the system applies it and does not proceed to policy-based NAT. The specific server's traffic (10.0.1.100) would still be subject to the Central SNAT rule unless a more specific Central SNAT rule is created for that IP.

Answer

Policy-based NAT takes precedence because it is more specific

Answer

Central SNAT takes precedence because it is evaluated after policy-based NAT

Answer

The most recently created rule takes precedence

Question 13

An administrator wants to restrict access to a web server from only specific countries. The FortiGate is located at the network edge. Which address object type should be used in the source field of the firewall policy?

Accepted Answer

Geography address object. A Geography address object allows the FortiGate to match traffic based on the source IP's country of origin, using the built-in GeoIP database. This is the only address object type that can restrict access by country without requiring manual IP range updates.

Answer

FQDN address object

Answer

Wildcard FQDN address object

Answer

Subnet address object

Question 14

A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?

Accepted Answer

Use policy-based routing (PBR) to route traffic based on destination. Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.

Answer

Create a VIP for the cloud service

Answer

Configure static routes with different distances

Answer

Use SD-WAN rules to load balance

Question 15

An administrator needs to ensure that a firewall policy applies only during business hours (Monday to Friday, 9:00 AM to 6:00 PM). What object should be configured and applied to the policy?

Accepted Answer

Schedule object. A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

Answer

Service group

Answer

Address group

Answer

Traffic shaper