NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator needs to ensure that all internal users (10.0.0.0/8) accessing the internet use a single public IP address 203.0.113.10 for source NAT. Which NAT configuration should be used?
⚠ Common exam trap
A common mix-up: candidates confuse enabling NAT on the interface policy (Option B) with using a specific IP pool, not realizing that interface NAT uses the interface's own IP and cannot force a different public address without an explicit IP pool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Central SNAT rule with a Dynamic IP Pool using overload
Central SNAT with a Dynamic IP Pool using overload (Port Address Translation) allows all internal users in 10.0.0.0/8 to share a single public IP (203.0.113.10) by dynamically mapping multiple private source IPs and ports to unique source ports on the public IP. This is the standard method for many-to-one NAT, ensuring all outbound internet traffic appears from the same public address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Central SNAT rule with a Dynamic IP Pool using overload
Why this is correct
A Central SNAT rule with a Dynamic IP Pool in overload mode references a configured pool of public addresses and applies source network address translation independently of firewall policies. Overload (PAT) creates a unique mapping of internal IP:port to the selected public IP:port, allowing many internal users to share a single public address. This is the appropriate method when the required public IP is not the interface IP and must be shared by all internal clients.
- ✗
Enable NAT on the outgoing interface policy without an IP pool
Why it's wrong here
Enabling NAT on the outgoing interface policy simply translates the source address to the IP address physically assigned to that interface. If the required public IP is a different address from the interface IP, the traffic will not present the needed source address. Moreover, this method does not use an IP pool, so it cannot select a specific or dynamic set of public addresses for load sharing or overload.
- ✗
Create a policy-based NAT rule with fixed port range
Why it's wrong here
A policy-based NAT rule with a fixed port range allocates a contiguous block of ports to a specific session, typically used for protocols like SIP that require predictable port mapping. It does not support the dynamic port-sharing behavior of overload, and it is not designed to map many internal clients to one public IP. Using a fixed port range would exhaust ports quickly and fail to provide the intended IP sharing.
- ✗
Configure a VIP with port forwarding
Why it's wrong here
A Virtual IP (VIP) is a destination NAT construct: it maps an external public IP and port to an internal server's private IP and port. It applies to inbound traffic, not to outbound source translation. Configuring a VIP would not change the source address of internal users' outbound traffic, so it cannot satisfy the requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.