NSE4 Firewall Policies and NAT Practice Test 9 — 15 Questions

Question 1

An admin creates a firewall policy allowing HTTP traffic from internal users to the internet. Users complain that they cannot access HTTPS websites. The admin checks and sees that the policy only has HTTP service. What is the BEST course of action to allow HTTPS while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the HTTPS service to the existing policy. Adding the HTTPS service (TCP/443) to the existing policy allows HTTPS traffic without creating a separate rule, which could introduce complexity or misordering issues. This approach maintains security by explicitly permitting only the required service rather than opening all traffic. FortiGate policies evaluate services as part of the match criteria, so modifying the existing policy is the most efficient and secure method.

Answer

Create a new policy above the existing one with HTTPS service

Answer

Use a security policy that automatically adds HTTPS

Answer

Change the HTTP service to ALL services

Question 2

You run the following CLI command on a FortiGate:
# diagnose debug flow filter saddr 192.168.1.10
# diagnose debug flow show function enable
# diagnose debug enable
You then initiate a ping from 192.168.1.10 to 8.8.8.8. The output shows 'no matching policy'. What does this indicate?

Accepted Answer

The traffic is dropped by the implicit deny rule. The 'no matching policy' output from the debug flow indicates that the FortiGate evaluated the packet against its firewall policy table and found no explicit policy permitting the traffic from source 192.168.1.10 to destination 8.8.8.8. Since no matching policy exists, the packet is implicitly denied by the default deny-all rule at the end of the policy table, which drops the traffic without logging unless explicitly configured. This is the expected behavior when no permit policy is configured for the traffic flow.

Answer

The traffic is being NAT'd but not logged

Answer

The debug filter is incorrectly configured

Answer

There is a routing issue preventing the traffic

Question 3

An admin configures a central SNAT rule to translate source IP 10.0.0.0/24 to IP pool 203.0.113.1-203.0.113.10 using overload (PAT). A policy-based NAT on a specific policy also translates the same source to the interface IP. Traffic from 10.0.0.0/24 to the internet shows source IP as the interface IP, not from the IP pool. What is the reason?

Accepted Answer

Policy-based NAT overrides central SNAT rules. Policy-based NAT (PBNAT) takes precedence over central SNAT rules because it is applied directly to a specific firewall policy. When a policy matches traffic, its NAT configuration (including translation to the interface IP) is evaluated before any central SNAT rules. This override occurs regardless of the central SNAT rule's order or status, as PBNAT is considered more specific and thus higher priority in FortiOS.

Answer

The central SNAT rule is disabled

Answer

The policy is using fixed port range

Answer

The IP pool is out of addresses

Question 4

Which address object type allows you to match traffic based on the domain name in the HTTPS SNI field?

Accepted Answer

Wildcard FQDN. The Wildcard FQDN address object type in FortiGate allows you to match traffic based on the domain name in the HTTPS Server Name Indication (SNI) field. Unlike a standard FQDN, which matches the exact domain, the Wildcard FQDN supports patterns like *.example.com, enabling policy enforcement for subdomains and dynamic hostnames within a domain.

Answer

Geography

Answer

Subnet

Answer

FQDN

Question 5

An admin wants to apply different QoS markings to traffic from two different departments. The admin creates two firewall policies: one for Sales (policy ID 1) and one for Engineering (policy ID 2). Both policies have traffic shaping enabled. However, traffic from both departments receives the same QoS marking. What is the MOST likely mistake?

Accepted Answer

The admin applied the same traffic shaper to both policies. If the same traffic shaper is applied to both firewall policies, the QoS marking defined in that shaper will be identical for all matched traffic, regardless of the policy. Each policy must reference a distinct traffic shaper with the desired DSCP or 802.1p marking to differentiate the departments.

Answer

The policies are in the wrong order

Answer

QoS marking is only applied at the interface level

Answer

The traffic shaping policy is applied globally

Question 6

A FortiGate with multiple VDOMs has a policy that allows traffic from VDOM A to VDOM B. The admin notices that traffic from VDOM A to a specific server in VDOM B is being dropped. The session log shows 'deny by forward policy check'. What is the MOST likely cause?

Accepted Answer

The policy in VDOM B to allow traffic from VDOM A is missing or misconfigured. The session log message 'deny by forward policy check' indicates that the traffic was explicitly denied by a firewall policy rule, not by a routing or resource issue. In a multi-VDOM setup, traffic from VDOM A to VDOM B must be permitted by a policy in VDOM B (the destination VDOM) that allows traffic from the inter-VDOM link or from VDOM A. If that policy is missing or misconfigured, the FortiGate will drop the traffic and log this exact denial.

Answer

The inter-VDOM link is down

Answer

NAT is required for inter-VDOM traffic

Answer

The source VDOM has exceeded its session limit

Question 7

What is the purpose of a schedule object in a firewall policy?

Accepted Answer

To specify the time of day when the policy is effective. A schedule object in a FortiGate firewall policy defines the time range (e.g., specific hours, days of the week, or recurring intervals) during which the policy is active. When the current time falls outside the schedule, the policy is automatically disabled, allowing administrators to enforce time-based access control without manual intervention. This is distinct from other policy attributes like bandwidth shaping or session limits.

Answer

To set the bandwidth limit for the policy

Answer

To prioritize traffic based on application

Answer

To limit the number of concurrent sessions

Question 8

An admin needs to configure NAT so that internal users (10.0.0.0/24) accessing the internet (any destination) are translated using an IP pool (203.0.113.10-203.0.113.20) with overload. The admin also needs to ensure that traffic from a specific server (10.0.0.100) always uses a fixed source port range (10000-20000) when translated. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create a central SNAT rule for 10.0.0.0/24 using the IP pool with overload enabled. Central SNAT allows you to translate traffic from the entire 10.0.0.0/24 subnet using an IP pool (203.0.113.10-203.0.113.20) with overload (PAT), which is the standard method for enabling many internal users to share a smaller pool of public IPs. Option E is correct because you need a separate, more specific central SNAT rule for the server 10.0.0.100 that uses the same IP pool but with a fixed port range (10000-20000) enabled, ensuring its translated source ports always fall within that range.

Answer

Configure the IP pool with one-to-one NAT

Answer

Use policy-based NAT instead of central SNAT

Answer

Disable NAT on the firewall policy for the server

Question 9

An admin troubleshoots an issue where internal users cannot access an internal server using its public IP address. The server is published via a VIP. The admin has already verified that the firewall policy allows traffic from internal to the VIP. Which THREE checks should the admin perform to resolve the issue? (Choose three.)

Accepted Answer

Enable NAT reflection on the VIP. NAT reflection (also known as hairpin NAT or NAT loopback) is required when internal users attempt to reach an internal server via its public IP address. Without NAT reflection, the firewall sees the traffic as coming from the same internal network and destined for the VIP's public IP, but it does not translate the source IP back to the internal network, causing the return traffic to be dropped or misrouted. Enabling NAT reflection on the VIP ensures that the firewall performs source NAT on the traffic from internal users, allowing the server to reply directly to the firewall, which then forwards the response back to the internal client.

Answer

Configure the internal users to use the private IP directly

Answer

Change the VIP to use port forwarding

Question 10

A FortiGate has two firewall policies for HTTP traffic to the internet: Policy A (source: 10.0.1.0/24) and Policy B (source: 10.0.2.0/24). Both policies have the same destination and service. The admin wants to apply a traffic shaper to limit bandwidth for Policy B. Which TWO actions are correct? (Choose two.)

Accepted Answer

Create a traffic shaping policy that matches Policy B's source and apply the shaper. A traffic shaping policy can match the source address of Policy B (10.0.2.0/24) and apply a specific shaper, allowing granular bandwidth control without affecting Policy A. Option E is correct because FortiGate allows a traffic shaper to be applied directly within a firewall policy's 'Traffic Shaping' settings, which overrides any default or VDOM-level shaping. Both methods achieve the goal of limiting bandwidth for Policy B only.

Answer

Apply the shaper to both policies and use a different shaper for Policy B

Answer

Use a QoS queue on the outgoing interface

Answer

Enable traffic shaping on the VDOM

Question 11

Which of the following best describes the policy lookup order on a FortiGate firewall?

Accepted Answer

Policies are evaluated in the order they appear in the policy list, from top to bottom. FortiGate firewalls evaluate firewall policies sequentially from the top of the policy list downward. The first policy that matches the source, destination, service, and other attributes of a packet is applied, and no further policies are checked. This top-down evaluation ensures deterministic traffic handling and is fundamental to FortiGate's stateful inspection engine.

Answer

Policies are evaluated based on the number of hits, least-hit first

Answer

Policies are evaluated randomly to balance load

Answer

The policy with the highest priority number is evaluated first

Question 12

An admin configures a Central SNAT rule to translate internal 192.168.1.0/24 to 203.0.113.10 when accessing the internet. However, traffic from 192.168.1.100 to 8.8.8.8 shows source IP 192.168.1.100 in logs. What is the MOST likely cause?

Accepted Answer

The Central SNAT rule is applied to the wrong outgoing interface. The Central SNAT rule is not being applied to the traffic. The most likely cause is that the rule specifies an outgoing interface different from the one used to reach 8.8.8.8, so the rule does not match and no source translation occurs.

Answer

The Central SNAT rule is disabled

Answer

The firewall policy has an IP pool configured, overriding Central SNAT

Answer

The destination address in the Central SNAT rule is incorrect

Question 13

When creating a firewall policy, an admin wants to ensure that traffic from a specific user group is allowed only during business hours (Monday to Friday, 09:00-18:00). Which object type must be configured and applied to the policy?

Accepted Answer

A schedule object with a recurring schedule. To restrict traffic based on time, a firewall policy must reference a schedule object. A recurring schedule defines specific days and hours (e.g., Monday–Friday, 09:00–18:00) and is applied directly to the policy. This allows the FortiGate to permit or deny traffic based on the current time without additional profiles or user group modifications.

Answer

A security profile with time-based filtering

Answer

A user group object with time restrictions

Answer

A traffic shaping policy with a time-based rule

Question 14

An admin configures a VIP to map public IP 203.0.113.10:80 to internal server 10.0.0.10:8080. Users on the internet can reach the server. However, internal users trying to access the public IP from inside the network fail. What is the MOST likely reason?

Accepted Answer

The VIP is configured with port forwarding only for external interface. For internal users to reach a VIP, the VIP must be available on the internal interface (or set to 'any') and a firewall policy must allow the traffic. Option A indicates the VIP is only on the external interface, so packets from internal users are not destination-translated and get routed out. When hairpin NAT is configured correctly, the policy must have NAT enabled (source NAT) to ensure return traffic goes back through the FortiGate. Disabling NAT would cause the server to reply directly to the client, which the client would drop because the reply source does not match the public IP.

Answer

The firewall policy for internal users does not have NAT disabled

Answer

The internal server is not configured to respond to requests on port 8080

Answer

The internal users are using a different DNS server

Question 15

An admin wants to block traffic from a specific geographic region (e.g., North Korea) from reaching the FortiGate's external interface. Which address object type should be used in the firewall policy?

Accepted Answer

Geography address object. A geography address object allows the firewall to match traffic based on the source or destination IP address's registered country. FortiGate uses a built-in GeoIP database to map IP addresses to geographic regions, making it the correct choice for blocking traffic from a specific country like North Korea.

Answer

Subnet address object

Answer

FQDN address object

Answer

Wildcard FQDN address object