NSE4 System and Network Administration Practice Question
A FortiGate administrator is troubleshooting a problem where users cannot access the Internet. The FortiGate has a default route pointing to the ISP gateway. The administrator runs 'execute ping 8.8.8.8' from the FortiGate CLI and it succeeds. However, internal users behind NAT are unable to reach external servers. Which is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a successful ping from the FortiGate CLI proves end-to-end connectivity for all users, but they overlook that NAT translation is required for internal private IPs to reach the Internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No NAT policy is configured for internal users
The administrator confirmed that the FortiGate itself can reach the Internet (ping 8.8.8.8 succeeds), so the default route and basic connectivity are working. However, internal users behind NAT cannot reach external servers, which indicates that traffic from internal users is either not being translated or is being blocked. The most likely cause is that no NAT policy (or firewall policy with NAT enabled) exists to perform source NAT for internal users, so their private IP addresses are not translated to the FortiGate's public IP, and the ISP gateway drops the packets because private addresses are not routable on the Internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default route is incorrectly configured
Why it's wrong here
The default route on a FortiGate is used by the FortiGate itself to reach remote networks. Since the administrator's ping from the FortiGate to an external address succeeds, the default route is correctly installed and functional. The problem involves traffic sourced from internal users, which also requires proper NAT for return path, not just routing. Therefore, a default-route misconfiguration cannot explain why user traffic fails while the FortiGate's own traffic succeeds.
- ✗
An implicit deny policy is blocking traffic from internal to external
Why it's wrong here
An implicit deny policy would affect all sessions matching no explicit firewall policy, including the FortiGate's own outbound pings if they were processed by the same policy set. However, the FortiGate's ping succeeds, proving that either an explicit policy allows it or that local-out traffic bypasses the inter-zone policy engine. In FortiOS, the implicit deny is a final catch-all for traffic between zones, but local management traffic uses different handling. Thus, the symptom contradicts an implicit deny blocking all internal-to-external traffic.
- ✓
No NAT policy is configured for internal users
Why this is correct
If no NAT policy is configured for internal users' traffic, the FortiGate forwards packets with the original private source IP addresses (e.g., 10.0.0.0/8). The external server sends reply packets to that private address, which is not routable across the public internet, causing return traffic to be dropped or blackholed. The FortiGate's own ping works because it uses its interface's public IP as the source, so replies are routable. This mismatch—successful ping from the FortiGate but failures for internal users—is a classic symptom of missing source NAT.
- ✗
External access profile is set to read-only
Why it's wrong here
External access profiles in FortiOS are administrative-level permissions that control which admin accounts can access the device and what they can view or change via protocols like HTTPS or SSH. They are completely separate from the data-plane functions of the FortiGate, such as firewall policies, NAT, and routing. A read-only external access profile would restrict an admin's changes but would not block or alter user traffic through the device. Therefore, this setting is unrelated to the connectivity problem described.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.