NSE4 Firewall Policies and NAT Practice Question
A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume a policy allowing a service with NAT disabled is sufficient for reachability, overlooking that security profiles can independently block traffic at a higher layer, especially for HTTPS where inspection is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security profile applied to the policy is blocking the HTTPS traffic.
Security profiles (such as web filtering, application control, or SSL inspection) applied to a firewall policy can inspect and block HTTPS traffic even when the policy itself allows the service. Since the server is reachable from other VLANs and the policy explicitly permits HTTPS with NAT disabled and logging enabled, the most likely cause is that a security profile is dropping or denying the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NAT is disabled, so the server cannot send replies back.
Why it's wrong here
NAT is not required for traffic between internal VLANs because the FortiGate simply routes packets based on the destination IP, and the server's reply goes directly back to the source IP using the existing routing table. Disabling NAT would affect source address translation for egress to external networks, not internal reachability, so this is not the reason HTTPS is blocked.
- ✗
The policy order is incorrect; a deny policy above is blocking traffic.
Why it's wrong here
The administrator already verified there are no overlapping or conflicting policies, so a deny policy above would be a separate explicit rule. If a deny policy above were blocking traffic, it would deny all traffic from VLAN10 to VLAN20, not selectively HTTPS; since only HTTPS fails, a policy-order issue is not the cause.
- ✓
A security profile applied to the policy is blocking the HTTPS traffic.
Why this is correct
A security profile (e.g., SSL inspection or application control) applied to the firewall policy can intercept HTTPS sessions and enforce actions like blocking based on certificate validation failure, URL category, or application signature. If the server presents an untrusted or expired certificate, the SSL inspection profile may block the HTTPS handshake while allowing other traffic, which matches the symptom of only HTTPS being affected.
- ✗
The schedule is configured incorrectly and the policy is inactive during the current time.
Why it's wrong here
The schedule is set to Always, meaning the policy is active 24/7; a schedule-based denial would make the policy inactive at specific times, causing all traffic to fail, not just HTTPS. Since the policy is active and the issue is protocol-specific, the schedule configuration is not the cause.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.