NSE4 Firewall Policies and NAT Practice Test 7 — 15 Questions

Question 1

Which of the following describes the implicit deny action in FortiGate firewall policies?

Accepted Answer

A default policy that denies all traffic unless explicitly allowed. In FortiGate firewall policies, the implicit deny is a default, system-generated rule that denies all traffic not explicitly permitted by any configured policy. It is always present at the end of the policy list and cannot be moved, modified, or deleted. This ensures that any traffic not matching an explicit 'accept' policy is automatically dropped, enforcing a default-deny security posture.

Answer

A policy that is automatically created when the first policy is added

Answer

A policy that denies traffic based on the source IP

Answer

A policy that denies all traffic and can be moved to any position

Question 2

An administrator configures a firewall policy with source address 'internal_net' (10.0.0.0/16) and destination address 'server_farm' (10.10.10.0/24). The action is set to ACCEPT with NAT enabled. However, traffic from 10.0.1.100 to 10.10.10.50 is being denied. What is the most likely cause?

Accepted Answer

There is a deny policy above this policy that matches the traffic. The most likely cause is that a deny policy with a higher priority (lower sequence number) exists above the ACCEPT policy in the firewall policy list. FortiGate evaluates policies sequentially from top to bottom, and the first matching policy determines the action. If a deny policy matches the traffic (source 10.0.1.100, destination 10.10.10.50) before the ACCEPT policy is reached, the traffic will be denied regardless of the ACCEPT policy below it.

Answer

The destination address 'server_farm' does not include 10.10.10.50

Answer

The NAT translation is causing the traffic to be dropped

Answer

The source address 'internal_net' does not include 10.0.1.100

Question 3

An administrator configures a VIP for port forwarding: public IP 203.0.113.10 port 8080 to internal server 10.0.1.10 port 80. External users can connect to http://203.0.113.10:8080 but receive a timeout. The firewall policy allows traffic from any to the VIP on destination port 8080. The internal server is reachable from internal hosts. What is the most likely problem?

Accepted Answer

The policy destination service is set to HTTP (port 80) instead of port 8080. The firewall policy must match the destination port of the incoming traffic. External users connect to port 8080 on the VIP, but if the policy's destination service is set to HTTP (port 80), the policy will not match traffic destined for port 8080. Even though the VIP translates the destination to port 80 on the internal server, the firewall policy evaluation occurs before NAT translation, so the policy must match the original destination port (8080).

Answer

The internal server is not running a web server

Answer

The VIP is not associated with the policy

Answer

The source NAT is not configured

Question 4

An administrator wants to limit the bandwidth for a specific application (e.g., YouTube) across all users. The administrator creates a traffic shaper and applies it to the firewall policy. What additional configuration is needed to identify YouTube traffic?

Accepted Answer

Apply an Application Control profile to the policy. Application Control profiles are specifically designed to identify and control traffic based on application signatures, such as YouTube. A traffic shaper limits bandwidth, but it requires an Application Control profile to classify the traffic as YouTube before the shaping can be applied. Without this profile, the firewall cannot distinguish YouTube from other web traffic.

Answer

Enable deep inspection and create a URL filter

Answer

Create a custom service object for YouTube

Answer

Use a geography object to block non-local traffic

Question 5

A FortiGate administrator needs to configure source NAT for a group of internal servers (10.0.1.100-10.0.1.110) so that each server uses a unique public IP from the range 203.0.113.20-203.0.113.30. The requirement is that each internal IP maps to a fixed external IP (one-to-one mapping) and not port overload. Which TWO settings should be configured in the IP Pool? (Choose two.)

Accepted Answer

External IP Range: 203.0.113.20-203.0.113.30. The External IP Range must be set to 203.0.113.20-203.0.113.30 to define the pool of public IPs that will be mapped one-to-one to the internal servers. Option D is correct because Type: One-to-One ensures each internal IP is permanently mapped to a unique external IP, without port address translation (PAT), meeting the requirement of fixed one-to-one mapping.

Answer

Type: Overload

Answer

Enable 'Fixed Port Range'

Answer

Use Central SNAT instead of IP Pool

Question 6

An administrator notices that VoIP traffic (SIP) is not being inspected by the IPS profile applied to the firewall policy. The administrator suspects the traffic is being accelerated by NPU offloading. Which TWO actions can prevent NPU offloading for SIP traffic to ensure IPS inspection? (Choose two.)

Accepted Answer

Change the policy inspection mode to 'Proxy-Based'. Changing the inspection mode to 'Proxy-Based' forces the firewall to reassemble and inspect the entire SIP session in software, bypassing NPU offloading. NPU offloading accelerates traffic by processing packets in hardware, which skips deep inspection like IPS. Proxy-based inspection ensures the firewall acts as a proxy for the SIP traffic, allowing IPS to inspect the payload.

Answer

Enable 'Set SNAT' on the policy

Answer

Enable 'Deep Inspection' on the policy

Answer

Create a separate VIP for SIP

Question 7

Which THREE of the following are valid address object types in FortiGate? (Choose three.)

Accepted Answer

Subnet. A is correct because Subnet defines an IP range using a network address and subnet mask. D is correct because FQDN objects resolve domain names to IP addresses dynamically. E is correct because Wildcard objects use a wildcard mask (e.g., 10.0.0.0 0.255.255.255) to define an IP range. Option C is incorrect because Geography is not a standalone address object type; it is a category. Option B is incorrect as MAC address is not a standard address object type.

Answer

MAC address

Answer

Geography

Question 8

You run the following command on a FortiGate: 'diagnose sys session filter dport 443' and see:
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate?

Accepted Answer

The session is in SYN_SENT state and the three-way handshake is not yet complete. The output shows `proto=6`, which indicates TCP, and `proto_state=01`, which corresponds to the TCP state SYN_SENT (0x01). This means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `duration=3600` and `expire=3599` indicate the session has been tracked for 3600 seconds and will expire in 3599 seconds, but the state confirms it is not yet established.

Answer

The session is using UDP and the duration is 3600 seconds

Answer

The session is being torn down and will expire in 3599 seconds

Answer

The session is fully established and has been active for 3600 seconds

Question 9

What is the purpose of the 'implicit deny' policy on a FortiGate?

Accepted Answer

It denies all traffic that does not match any explicit policy. The 'implicit deny' policy on a FortiGate is a default, last-resort rule that denies all traffic not matching any explicit firewall policy. It ensures that any packet that does not meet the source, destination, service, or schedule criteria of a configured policy is dropped, enforcing a default-deny security posture. This behavior is fundamental to stateful firewall operation and prevents unauthorized traffic from traversing the device.

Answer

It allows traffic from trusted internal networks

Answer

It logs all traffic that is denied

Answer

It allows all traffic that matches no other policy

Question 10

An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?

Accepted Answer

The destination in the firewall policy is set to the public IP directly instead of the VIP object. When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Answer

The VIP is configured with port forwarding disabled

Answer

The server's default gateway is not set to the FortiGate

Answer

The source NAT is not configured

Question 11

You execute 'get firewall policy 5' and see the following output:
policyid=5
name="test"
status=enable
schedule="always"
logtraffic=all
What does 'logtraffic=all' mean?

Accepted Answer

All traffic matching the policy will be logged, regardless of action. 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

Answer

Only the first packet of each session will be logged

Answer

Only traffic that triggers a security profile will be logged

Answer

Only traffic that is denied by the policy will be logged

Question 12

Which address object type can be used to match traffic based on the source country?

Accepted Answer

Geography. The Geography address object type in FortiGate allows you to match traffic based on the source or destination country by using the ISO 3166-1 alpha-2 country codes. This is configured within a firewall policy to enforce geo-blocking or geo-allowance, leveraging FortiGuard's GeoIP database to map IP addresses to countries.

Answer

Wildcard FQDN

Answer

FQDN

Answer

Subnet

Question 13

An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?

Accepted Answer

Traffic shaper (e.g., shared or per-IP shaper). A traffic shaper (shared or per-IP) defines the bandwidth limits (e.g., maximum rate, guaranteed rate) that will be enforced on the traffic. This shaper must be created first to control YouTube streaming bandwidth.

Answer

A DNS filter to block YouTube

Answer

A static route for YouTube's IP range

Question 14

An administrator wants to allow access to an internal web server from the internet using a public IP address 203.0.113.10. The internal server has IP 10.0.0.5. Which FortiGate feature should be configured to translate the destination IP?

Accepted Answer

Virtual IP (VIP). A Virtual IP (VIP) is the correct feature because it performs destination NAT (DNAT), translating the public destination IP 203.0.113.10 to the internal server IP 10.0.0.5. This allows inbound traffic from the internet to reach the internal web server by rewriting the destination IP address in the packet header as it traverses the FortiGate.

Answer

Central SNAT

Answer

Policy-based routing

Answer

IP Pool

Question 15

A FortiGate administrator runs the following command and sees output:
diagnose sys session filter dport 443
diagnose sys session list
...
proto=6 proto_state=01 duration=3600 expire=3599
What does this output indicate about the session?

Accepted Answer

The session is an active TCP connection that has been established for 1 hour. The output shows `proto=6`, which is the protocol number for TCP, and `proto_state=01`, which in FortiGate's session table indicates an established TCP connection (state ESTABLISHED). The `duration=3600` seconds means the session has been active for exactly 1 hour, and `expire=3599` seconds shows the remaining time before the session times out. This confirms the session is an active TCP connection that has been established for 1 hour, making option C correct.

Answer

The session has expired

Answer

The session is being blocked by a firewall policy

Answer

The session is using UDP