NSE4 Firewall Policies and NAT Practice Question
A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?
⚠ Common exam trap
A common mix-up: candidates think a static route for the public IP is needed, but the VIP is handled by the FortiGate's local routing, and the default route suffices for outbound traffic to the ISP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP
A firewall policy from WAN to DMZ is required to permit the inbound HTTPS traffic to the VIP. The policy must reference the VIP as the destination and allow HTTPS (TCP/443) to pass through the FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP
Why this is correct
The policy must permit the traffic to the VIP destination.
- ✓
Disabling source NAT on the firewall policy (set nat enable disable)
Why this is correct
Disabling SNAT ensures the original source IP is preserved.
- ✗
A static route for 203.0.113.10 pointing to the ISP gateway
Why it's wrong here
The VIP handles the IP mapping; routing for the public IP is required but typically done via default route.
- ✗
A Central SNAT policy to translate the source to the FortiGate's IP
Why it's wrong here
This would hide the original source IP, which is not desired.
- ✓
A Virtual IP (VIP) mapping 203.0.113.10:443 to 192.168.1.10:443
Why this is correct
VIP performs DNAT for inbound traffic.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.