NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?
⚠ Common exam trap
A common mix-up: candidates confuse VIPs (destination NAT) with IP pools (source NAT) or Central SNAT, mistakenly thinking source translation is needed for inbound traffic, when the question specifically requires destination translation and fixed port mapping for logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10
To allow inbound HTTPS to an internal server with destination NAT, a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10 is required. A firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination permits the traffic and applies the NAT. Additionally, to translate the source port to a fixed range for logging, an IP pool with fixed port range is needed. Thus, options A, B, and D are all required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10
Why this is correct
A VIP is necessary for destination NAT (DNAT) to forward public IP to internal server.
- ✓
Create a firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination
Why this is correct
A firewall policy must permit the traffic; the VIP object is used as the destination in the policy.
- ✗
Configure Central SNAT to translate the server's source IP for return traffic
Why it's wrong here
Central SNAT translates source IP for outbound traffic, not required for inbound translation with fixed port range.
- ✓
Create an IP pool with fixed port range for source translation
Why this is correct
An IP pool with fixed port range provides the source port translation to a fixed range, meeting the logging requirement.
- ✗
Enable 'allow source port translation' on the VIP
Why it's wrong here
The VIP does not have an option for source port translation; that is handled by an IP pool or Central SNAT.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.