NSE4 Firewall Policies and NAT Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator needs to block all traffic from a specific geographic region (country) from accessing the internal network. Which type of address object should be used in the firewall policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Geography object. A Geography object is specifically designed to represent a geographic region (such as a country) based on IP address geolocation data. When used in a firewall policy, it allows the FortiGate to match traffic sources or destinations by country, enabling the administrator to block all traffic from that region. This is the correct and only address object type that supports country-based filtering.

Answer

FQDN object

Answer

Wildcard FQDN object

Answer

Subnet object

Question 2

A FortiGate has multiple VDOMs. The administrator needs to allow traffic from VDOM A (port1) to VDOM B (port2). What type of firewall policy is required?

Accepted Answer

An inter-VDOM policy on the inter-VDOM link interface. When traffic must cross from one VDOM to another on a FortiGate, an inter-VDOM policy is required. This policy is applied to the inter-VDOM link interface, which acts as the logical boundary between VDOMs. It allows the firewall to enforce separate routing and security contexts while forwarding traffic between VDOMs.

Answer

A policy using a virtual wire pair

Answer

A regular intra-VDOM policy on VDOM A with destination interface port2

Answer

A policy on each VDOM with the same source/destination

Question 3

A FortiGate is configured with two policies: Policy A allows traffic from trust to untrust with schedule 'WorkHours' (Mon-Fri 9-17). Policy B allows traffic from trust to untrust with schedule 'Always'. A user sends traffic at 8:00 AM on Saturday. Which policy matches?

Accepted Answer

Policy B because Policy A's schedule is not active. Policy B is correct because at 8:00 AM on Saturday, the 'WorkHours' schedule (Mon-Fri 9-17) is not active. FortiGate evaluates policies sequentially; when the first matching policy's schedule is inactive, the firewall skips it and continues to the next policy. Policy B with schedule 'Always' matches and permits the traffic.

Answer

Policy A because schedules are evaluated after policy order

Answer

Both policies match and the first one in order is used

Answer

No policy matches because Policy A is first but schedule inactive

Question 4

A FortiGate administrator wants to create a firewall policy that matches traffic based on the destination domain name (e.g., *.example.com). Which type of address object should be used?

Accepted Answer

Wildcard FQDN object. A Wildcard FQDN object (option B) is the correct choice because it allows pattern matching with a leading asterisk (e.g., *.example.com) to match any subdomain of example.com. Standard FQDN objects require an exact, fully qualified domain name and do not support wildcard patterns, making them unsuitable for matching traffic based on a domain pattern like *.example.com.

Answer

FQDN object

Answer

Subnet object

Answer

Geography object

Question 5

A FortiGate administrator is troubleshooting a connectivity issue where internal clients cannot reach a public web server. The administrator has confirmed that routing is correct and there are no security profiles blocking traffic. Which TWO debugging steps should the administrator take? (Choose two.)

Accepted Answer

Run a packet capture on the internal interface. Running a packet capture on the internal interface (Option B) allows the administrator to verify whether the client's request is actually reaching the FortiGate and whether the firewall is processing the traffic correctly. This step isolates whether the issue is before, at, or after the FortiGate, which is essential when routing is already confirmed as correct.

Answer

Reboot the FortiGate

Answer

Change the NAT mode to Central SNAT

Answer

Disable the antivirus profile

Question 6

An administrator needs to configure destination NAT for multiple internal servers using a single public IP address by differentiating based on destination port. The public IP 203.0.113.10 should map to: (A) 10.0.0.1:80 for HTTP, (B) 10.0.0.2:443 for HTTPS. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a VIP for HTTP mapping port 80 to 10.0.0.1. A Virtual IP (VIP) is required to map the public IP 203.0.113.10 and destination port 80 to the internal server 10.0.0.1:80. This is the standard FortiGate method for destination NAT (port forwarding) when multiple internal servers share a single public IP, differentiated by destination port.

Answer

Create an IP pool for the public IP

Answer

Configure policy-based routing for each server

Answer

Use Central SNAT with port forwarding

Question 7

A FortiGate administrator is implementing a policy to allow outbound traffic from the internal network to the internet. The requirements are: (1) all traffic from internal users must be source NATed to the external interface IP, (2) traffic from a specific server must use a different public IP, (3) HTTP traffic must be shaped to 10 Mbps. Which THREE configuration elements should the administrator create? (Choose three.)

Accepted Answer

A traffic shaper for HTTP traffic. A traffic shaper is required to enforce bandwidth limits on HTTP traffic. In FortiGate, traffic shaping policies allow you to define per-policy bandwidth constraints, such as capping HTTP traffic to 10 Mbps, by applying a shaper to the firewall policy that matches HTTP traffic.

Answer

A VIP for the server

Answer

A policy-based routing rule for the server

Question 8

An admin needs to allow outbound HTTP and HTTPS traffic from the internal network to the internet. Which two built-in service objects can be used in a single firewall policy to achieve this?

Accepted Answer

HTTP and HTTPS. HTTP (TCP/80) and HTTPS (TCP/443) are the two built-in service objects that specifically match outbound web traffic. A single firewall policy can include both service objects to allow HTTP and HTTPS traffic from internal users to the internet, which is the most precise and secure way to permit web browsing without opening unnecessary ports.

Answer

WEB and SSL

Answer

ANY and HTTPS

Answer

ALL_TCP and ALL_UDP

Question 9

A FortiGate has a central SNAT policy that translates internal users to a single IP pool address. The admin wants specific traffic (e.g., from a particular subnet) to use a different IP pool. What is the correct approach?

Accepted Answer

Create a new central SNAT policy with the specific subnet as source and place it above the existing policy. Central SNAT policies are evaluated in sequential order, and the first matching policy is applied. By creating a new policy with the specific subnet as the source and placing it above the existing policy, the FortiGate will match the more specific traffic first and use the different IP pool, while all other traffic continues to match the original policy.

Answer

Create a policy-based NAT rule with the specific subnet and place it above the central SNAT policy

Answer

Use VIP to translate the source address

Answer

Modify the existing central SNAT policy to use a dynamic IP pool

Question 10

A FortiGate policy allows traffic from the internal network to a DMZ server. The admin wants to limit access to only specific hours. Which object type should be used in the policy?

Accepted Answer

Schedule. A schedule object is the correct choice because it defines time-based conditions (e.g., specific hours, days, or recurring intervals) that FortiGate applies to firewall policies. By attaching a schedule to a policy, the admin can restrict traffic to the DMZ server only during the permitted hours, such as business hours or maintenance windows.

Answer

Address group

Answer

Service group

Answer

Traffic shaper

Question 11

An admin needs to allow traffic from a specific IP to a web server on port 8080. The web server is behind a VIP that forwards port 80 to port 8080. When configuring the security policy, which destination should be used?

Accepted Answer

The VIP object. When a VIP is used to translate the destination IP and port (e.g., from public IP:80 to private server IP:8080), the security policy must reference the VIP object as the destination. FortiGate matches the policy using the original destination IP before destination NAT is applied. The VIP object represents the original destination (the external IP) that clients use, so referencing it ensures the policy correctly permits the traffic.

Answer

The virtual IP address of the FortiGate

Answer

The real server IP address

Answer

Any destination, because the VIP translates automatically

Question 12

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from a specific subnet out of a particular interface. The admin also has a firewall policy allowing that subnet to the internet. However, the traffic is not being routed as expected. What could be the issue?

Accepted Answer

The PBR rule uses an incorrect source or destination address. Policy-based routing (PBR) is evaluated before firewall policies. If the PBR rule specifies an incorrect source or destination address, traffic from the intended subnet will not match the PBR rule and will fall through to the default routing table, potentially exiting via a different interface. The firewall policy alone cannot override the routing decision; the PBR rule must correctly identify the traffic to steer it to the desired egress interface.

Answer

The firewall policy is placed above the PBR rule

Answer

The PBR rule does not have a matching protocol or service defined

Answer

The FortiGate is in transparent mode

Question 13

An admin wants to allow traffic only from specific countries to access a web server. Which type of address object should be used in the firewall policy?

Accepted Answer

Geography object. The Geography object (also known as a GeoIP object) in FortiGate allows firewall policies to permit or deny traffic based on the source or destination country. This is the correct choice because the requirement is to filter traffic by country, which is exactly what Geography objects are designed for, using IP-to-country mappings maintained by FortiGuard.

Answer

Subnet object

Answer

FQDN object

Answer

Wildcard FQDN object

Question 14

An admin needs to configure NAT for internal users accessing the internet. The requirements are: 1) All internal users must be translated to a single public IP. 2) The translation should use port address translation (PAT). 3) The configuration must allow tracking of which internal user initiated a connection. Which THREE settings must be configured? (Choose three.)

Accepted Answer

Enable NAT on the firewall policy and select the IP pool. Enabling NAT on the firewall policy and selecting the IP pool is the standard method to apply PAT (Overload) to traffic matching that policy. This configuration ensures all internal users are translated to the single public IP defined in the pool while using port multiplexing to differentiate sessions.

Answer

Set the policy's NAT to use the egress interface IP

Answer

Configure a central SNAT policy with the same pool

Question 15

An admin is configuring a firewall policy to allow FTP traffic from a client to a server. The server is behind a VIP that translates public IP 203.0.113.10 port 21 to private IP 10.0.0.10 port 21. The admin wants to ensure the FTP data channel works correctly. Which TWO additional configurations are required? (Choose two.)

Accepted Answer

Enable FTP ALG on the firewall policy. The FTP Application Layer Gateway (ALG) is required to dynamically inspect FTP control traffic on port 21, identify the negotiated data channel ports, and open corresponding pinholes in the firewall. Without the ALG, the firewall cannot track the ephemeral data ports used by FTP active or passive mode, causing the data channel to fail.

Answer

Enable NAT on the policy for return traffic

Answer

Create a separate policy for the data channel

Answer

Configure a service object for FTP data port (TCP 20)