NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator needs to allow SMTP traffic (TCP port 25) from the internal network (10.0.0.0/8) to a mail server in the DMZ (172.16.0.10). The administrator wants to apply an antivirus profile and log all sessions. Which THREE configuration steps are required?
⚠ Common exam trap
Watch out — candidates often assume NAT is required for any traffic leaving a private network, but in FortiGate, NAT is only needed when the destination is on a different network segment that requires source address translation, such as the internet, not for internal-to-DMZ traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a firewall policy with source: 10.0.0.0/8, destination: 172.16.0.10, service: SMTP, action: ACCEPT
A firewall policy must be created to allow SMTP traffic from the internal network (10.0.0.0/8) to the DMZ mail server (172.16.0.10) on TCP port 25. The policy must specify the source, destination, service (SMTP), and action (ACCEPT) to permit the traffic. Without this policy, the traffic would be blocked by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a schedule object and apply it to the policy
Why it's wrong here
A schedule object restricts when a firewall policy is valid, for example only during business hours. Since the requirement is to allow SMTP traffic without specifying a time constraint, applying an access schedule is unnecessary and would either deny traffic outside the schedule window or add needless complexity. A schedule object cannot by itself match SMTP packets or define an ACCEPT action, so it is not the correct primary step.
- ✓
Create a firewall policy with source: 10.0.0.0/8, destination: 172.16.0.10, service: SMTP, action: ACCEPT
Why this is correct
A firewall policy with source 10.0.0.0/8, destination 172.16.0.10, service SMTP, and action ACCEPT is the fundamental permit rule needed to allow the SMTP traffic. FortiGate evaluates policies from top to bottom, and this tuple uniquely identifies the SMTP session directed to the mail server. Without such an explicit ACCEPT policy, the implicit deny rule would silently drop the traffic, so this is the correct baseline configuration.
- ✓
Create an antivirus profile and apply it to the policy
Why this is correct
An antivirus profile enables FortiGate to inspect the SMTP payload for malware, phishing, or malicious attachments before they reach the mail server. While a security profile alone does not permit traffic, applying an antivirus profile to the SMTP policy is a correct and important security measure. It works in conjunction with the ACCEPT policy to both allow and protect the SMTP flow, making it a necessary component for a secure deployment.
- ✗
Configure NAT on the policy to translate source IPs
Why it's wrong here
Configuring NAT on the policy will translate source IP addresses (or destination IPs) in the packet header, typically used for internet egress or overlapping network routing. In this scenario, the internal source 10.0.0.0/8 and destination 172.16.0.10 are both private, and if the mail server is directly reachable without address translation, NAT is neither required nor helpful. NAT does not affect the permit decision; it only modifies addressing after the policy lookup, so it cannot be used to 'allow' SMTP traffic.
- ✓
Enable logging on the firewall policy
Why this is correct
Enabling logging on the firewall policy records session information such as source/destination IP, port, bytes transferred, and the action taken by the policy. This is essential for auditing, troubleshooting mail flow, and security forensics, and it is considered a best practice when deploying any firewall policy. Although logging itself does not allow SMTP traffic, it is a correct operational step that provides visibility into sessions matching the ACCEPT policy and helps confirm that SMTP is being properly handled.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.