NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?
⚠ Common exam trap
A common mix-up: candidates confuse 'one-to-one NAT' (Option B) with PAT, thinking it can overload a single IP, but one-to-one NAT requires a dedicated public IP per internal host and does not perform port translation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Central SNAT with a dynamic IP pool using overload
Central SNAT with a dynamic IP pool using overload (PAT) is the correct method to translate all traffic from the 192.168.1.0/24 network to a single public IP address. The 'overload' option enables port address translation (PAT), allowing multiple internal hosts to share one public IP by using unique source port numbers, which is exactly what the administrator needs for internet-bound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Policy-based NAT with a fixed port range
Why it's wrong here
Policy-based NAT with a fixed port range applies a static, limited set of source ports to all traffic matching the policy, which is intended for applications like SIP or online gaming that require a predictable port window. For general outbound internet access from many internal users, this approach artificially caps the number of simultaneous NAT sessions and can lead to port exhaustion, making it unsuitable for typical many-to-one internet egress.
- ✗
One-to-one NAT IP Pool
Why it's wrong here
One-to-one NAT IP Pool statically maps each internal private IP address to a unique public IP address, so a network with hundreds of users would require hundreds of public addresses. It does not perform overload/PAT, meaning it cannot multiplex multiple internal hosts onto a single public IP, which is the core requirement for conserving address space when providing internet access to a large user base.
- ✗
Virtual IP (VIP) with port forwarding
Why it's wrong here
Virtual IP (VIP) with port forwarding is an inbound Destination NAT (DNAT) mechanism: it translates the destination address and port of packets arriving at a public VIP and forwards them to an internal server. It never modifies the source address of outbound traffic generated by internal clients, so it cannot provide the source NAT needed for internal users to reach the internet through a shared public address.
- ✓
Central SNAT with a dynamic IP pool using overload
Why this is correct
Central SNAT with a dynamic IP pool using overload is the correct approach because it implements many-to-one Source NAT: the FortiGate dynamically selects a public IP from the pool and rewrites each internal source IP to that public IP while also changing the source port to a unique value, enabling thousands of internal connections to share a single public address. Central NAT is the recommended method for outbound internet traffic because it cleanly separates NAT configuration from firewall policies and directly supports overload/PAT, matching the requirement for general internet egress.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.