NSE4 Firewall Policies and NAT Practice Test 9 — 15 Questions

Question 1

An admin configures a firewall policy with a schedule object that restricts access to Monday to Friday from 9:00 to 17:00. A user attempts to connect on Saturday at 10:00. Which of the following best describes what happens?

Accepted Answer

The FortiGate skips this policy and tries the next policy; if no match, implicit deny blocks the traffic. If the schedule does not match the current time, the firewall policy is not evaluated for that traffic. The FortiGate continues to check subsequent policies. If no other policy matches, the implicit deny rule blocks the traffic.

Answer

The traffic is allowed because the schedule is only used for logging

Answer

The traffic is allowed because the schedule is optional

Answer

The traffic is denied because the schedule is not valid

Question 2

A FortiGate admin is troubleshooting an issue where traffic from a specific internal host (10.0.1.50) to the internet is not being NATed as expected. The firewall policy has NAT enabled with an IP pool of type Overload. Which TWO conditions could cause the traffic to bypass the IP pool?

Accepted Answer

A policy with a lower policy ID matches the traffic and has NAT enabled with a different IP pool or no pool. Traffic may bypass the IP pool if a higher-priority policy matches first (policy ordering) or if the IP pool is incorrectly configured (e.g., the pool's source filter does not include the internal host).

Answer

The firewall policy's NAT setting is set to 'disable'

Answer

The IP pool is configured for one-to-one NAT

Answer

The internal host is using a non-standard source port

Question 3

An admin needs to configure a FortiGate to allow multiple internal servers to be accessible from the internet using the same public IP but different ports. For example, internal server A (192.168.1.10:80) should be reachable via 203.0.113.10:8080, and internal server B (192.168.1.20:443) via 203.0.113.10:8443. Which TWO configuration steps are required?

Accepted Answer

Create two separate VIPs, one for each server, and add them to a VIP group. Option A is correct because each internal server requires a unique Virtual IP (VIP) to map a specific external port to a specific internal IP and port. Adding these VIPs to a VIP group allows a single firewall policy to reference all of them, enabling the FortiGate to differentiate traffic based on the destination port and forward it to the correct internal server.

Answer

Disable NAT on the policy to preserve the source IP

Answer

Configure Central SNAT to translate the source IP

Answer

Create a single VIP with port forwarding that maps multiple ports

Question 4

A FortiGate admin is creating a firewall policy to allow outbound HTTP and HTTPS traffic from the internal network. The admin wants to ensure that traffic is inspected by security profiles (antivirus, web filter). Which THREE of the following must be configured on the firewall policy to achieve this?

Accepted Answer

Set the action to ACCEPT. To inspect traffic with security profiles, the admin must enable inspection mode (proxy-based or flow-based), select the appropriate security profiles, and ensure that traffic matches the policy (correct source/destination). The service object for HTTP and HTTPS is needed to match the traffic.

Answer

Set the schedule to always

Answer

Enable NAT on the policy

Question 5

A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?

Accepted Answer

Policy 5 has a higher priority because it is above policy 10 in the policy list. FortiGate matches firewall policies from top to bottom. Policy 5 is higher in the policy list order than policy 10, so traffic matches policy 5 first and never reaches policy 10.

Answer

Policy 10 is configured with an expired security certificate

Answer

The source address object 'internal_subnet' is incorrectly configured

Answer

Policy 10 has a schedule that is not active

Question 6

A FortiGate administrator needs to create a firewall policy that allows outbound traffic to the internet but denies access to a specific list of malicious IP addresses. The malicious IP list is updated frequently. Which address object type should be used for the destination addresses to block?

Accepted Answer

FQDN address object. FQDN address objects can resolve to a list of IP addresses that change dynamically, making them suitable for frequently updated IP lists. Subnet objects are static.

Answer

IP Range address object

Answer

Geography address object

Answer

Subnet address object

Question 7

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is a TCP session that has been established for 1 hour and will expire in about 1 hour. Option A is correct because the output shows `proto=6`, which indicates TCP (protocol number 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. The `duration=3600` means the session has been active for 3600 seconds (1 hour), and `expire=3599` indicates the session will expire in 3599 seconds (approximately 1 hour). This matches the description of a TCP session established for 1 hour with about 1 hour remaining before expiry.

Answer

The session is a UDP session with destination port 443

Answer

The session will expire in 3600 seconds

Answer

The session is a TCP session in SYN_SENT state

Question 8

A FortiGate administrator configures a Central SNAT policy to translate internal IPs to a single public IP for internet access. However, traffic from a specific internal server (10.0.1.100) must use a different public IP. The administrator also creates a policy-based NAT rule in the firewall policy for that server. Which NAT method takes precedence?

Accepted Answer

Central SNAT takes precedence over policy-based NAT. In FortiGate, when both Central SNAT and policy-based NAT (configured within a firewall policy) are present, Central SNAT takes precedence. This is because Central SNAT is evaluated before policy-based NAT in the NAT processing order, and once a match is found in Central SNAT, the system applies it and does not proceed to policy-based NAT. The specific server's traffic (10.0.1.100) would still be subject to the Central SNAT rule unless a more specific Central SNAT rule is created for that IP.

Answer

Policy-based NAT takes precedence because it is more specific

Answer

Central SNAT takes precedence because it is evaluated after policy-based NAT

Answer

The most recently created rule takes precedence

Question 9

An administrator wants to restrict access to a web server from only specific countries. The FortiGate is located at the network edge. Which address object type should be used in the source field of the firewall policy?

Accepted Answer

Geography address object. Option C is correct because a Geography address object allows the FortiGate to match traffic based on the source IP's country of origin, using the built-in GeoIP database. This is the only address object type that can restrict access by country without requiring manual IP range updates.

Answer

FQDN address object

Answer

Wildcard FQDN address object

Answer

Subnet address object

Question 10

A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?

Accepted Answer

Use policy-based routing (PBR) to route traffic based on destination. Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.

Answer

Create a VIP for the cloud service

Answer

Configure static routes with different distances

Answer

Use SD-WAN rules to load balance

Question 11

An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?

Accepted Answer

The destination interface should be the internal interface, not wan1. For inbound DNAT, the firewall policy must have the incoming interface as source interface and internal interface as destination interface. If both are set to wan1, the traffic is not forwarded to the internal network.

Answer

The policy needs NAT enabled

Answer

The source interface should be the internal interface

Answer

The VIP is not associated with the policy

Question 12

An administrator needs to ensure that a firewall policy applies only during business hours (Monday to Friday, 9:00 AM to 6:00 PM). What object should be configured and applied to the policy?

Accepted Answer

Schedule object. A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

Answer

Service group

Answer

Address group

Answer

Traffic shaper

Question 13

Which of the following describes the implicit deny action in FortiGate firewall policies?

Accepted Answer

A default policy that denies all traffic unless explicitly allowed. The implicit deny is a default rule at the end of the policy list that denies all traffic not explicitly allowed. It cannot be moved or deleted.

Answer

A policy that is automatically created when the first policy is added

Answer

A policy that denies traffic based on the source IP

Answer

A policy that denies all traffic and can be moved to any position

Question 14

An administrator configures a firewall policy with source address 'internal_net' (10.0.0.0/16) and destination address 'server_farm' (10.10.10.0/24). The action is set to ACCEPT with NAT enabled. However, traffic from 10.0.1.100 to 10.10.10.50 is being denied. What is the most likely cause?

Accepted Answer

There is a deny policy above this policy that matches the traffic. Policy order must be checked; another policy higher in the list with a DENY action might match before this policy. Also, the source/destination must match exactly.

Answer

The destination address 'server_farm' does not include 10.10.10.50

Answer

The NAT translation is causing the traffic to be dropped

Answer

The source address 'internal_net' does not include 10.0.1.100

Question 15

An administrator configures a VIP for port forwarding: public IP 203.0.113.10 port 8080 to internal server 10.0.1.10 port 80. External users can connect to http://203.0.113.10:8080 but receive a timeout. The firewall policy allows traffic from any to the VIP on destination port 8080. The internal server is reachable from internal hosts. What is the most likely problem?

Accepted Answer

The policy destination service is set to HTTP (port 80) instead of port 8080. Option C is correct because the firewall policy must match the destination port of the incoming traffic. External users connect to port 8080 on the VIP, but if the policy's destination service is set to HTTP (port 80), the policy will not match traffic destined for port 8080. Even though the VIP translates the destination to port 80 on the internal server, the firewall policy evaluation occurs before NAT translation, so the policy must match the original destination port (8080).

Answer

The internal server is not running a web server

Answer

The VIP is not associated with the policy

Answer

The source NAT is not configured