NSE4 Firewall Policies and NAT Practice Question
A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?
⚠ Common exam trap
A common mix-up: candidates assume the firewall policy is the issue, but the VIP itself must be configured to forward the specific ports; a policy allowing all traffic is useless if the VIP does not translate the destination port for HTTPS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VIP is configured for port forwarding only for HTTP (port 80)
The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VIP is configured for port forwarding only for HTTP (port 80)
Why this is correct
The virtual IP (VIP) object on a FortiGate is responsible for destination NAT, mapping an external address and port to an internal server. When a VIP is defined with only the HTTP service (port 80), the FortiGate will only translate traffic destined to that external IP:port pair. Incoming HTTPS connections to port 443 are not matched by the VIP, so they are dropped or not forwarded, precisely matching the symptom that external users cannot reach the web server over HTTPS.
- ✗
The web server is not listening on HTTPS
Why it's wrong here
If the web server itself is not listening on HTTPS (port 443), then even if the VIP correctly forwards both HTTP and HTTPS traffic, the server will never respond on 443, causing connection failures. However, in this scenario the VIP is explicitly configured for port forwarding only for HTTP, so the failure occurs before traffic ever reaches the server. The server may well be configured correctly for HTTPS; the root cause is the missing port mapping in the VIP, not the server's listening state.
- ✗
The VIP is using overload mode instead of one-to-one
Why it's wrong here
Overload mode, also known as Port Address Translation (PAT), is a source NAT method used to allow multiple internal hosts to share a single external IP address by multiplexing on source ports. It does not apply to inbound destination NAT, which is what a VIP provides. The VIP configuration only affects how incoming traffic is mapped; overload mode neither enables nor disables HTTPS access, so this setting cannot explain why HTTPS is unreachable while HTTP works.
- ✗
The firewall policy allowing traffic to the VIP only permits HTTP
Why it's wrong here
A firewall policy controls which traffic is allowed to traverse the FortiGate, including traffic destined to a VIP. If the policy that references the VIP only permits HTTP, then HTTPS traffic would be denied by the policy, even if the VIP itself forwarded both ports. However, the VIP is configured for port forwarding only for HTTP, meaning HTTPS traffic is not matched by the VIP and would be discarded before any policy check. Thus, the policy is not the cause in this case; the VIP configuration is the direct reason HTTPS fails.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.