NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?
⚠ Common exam trap
Many exam-takers confuse 'Central SNAT' (a FortiGate configuration method) with a specific NAT type, or think 'one-to-one NAT' is suitable for sharing a single IP, when it actually requires a dedicated public IP per internal host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Overload NAT
Overload NAT (also known as Port Address Translation or PAT) is the correct method because it allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is exactly what the administrator needs: translating all internal-to-internet traffic to one public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Central SNAT
Why it's wrong here
Central SNAT is a centralized NAT policy framework in FortiOS, not a translation mode. It allows you to define source NAT rules in a central table, but you still choose a method like Overload, one-to-one, or fixed port range within that rule. Because it is a configuration architecture rather than a many-to-one technique, it cannot by itself satisfy the requirement of mapping all internal users to a single public IP.
- ✗
One-to-one NAT
Why it's wrong here
One-to-one NAT creates a static mapping between a single private IP address and a single public IP address. It is typically used for bidirectional communication with a dedicated public address, and it does not multiplex multiple internal hosts onto one public IP. Therefore, it cannot handle traffic from all internal users when only one public IP is available.
- ✗
Fixed port range NAT
Why it's wrong here
Fixed port range NAT partitions the available ports on a public IP into pre-assigned blocks, with each internal host receiving a dedicated range of ports. While this does allow multiple internal addresses to share a single public IP, it lacks the dynamic port allocation of PAT, limits the number of sessions per host, and may exhaust its port range under heavy usage. Thus, it is not the general-purpose many-to-one method required for all internal traffic to the internet.
- ✓
Overload NAT
Why this is correct
Overload NAT, also known as Port Address Translation (PAT), is the correct method for this scenario. It translates the source IP address of all internal hosts to one public IP while dynamically assigning a unique source port for each connection, preserving the host identity through the port mapping. This provides scalable, concurrent internet access for many internal users using a single public address.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?
medium- A.Policy-based NAT with a fixed port range
- B.One-to-one NAT IP Pool
- C.Virtual IP (VIP) with port forwarding
- ✓ D.Central SNAT with a dynamic IP pool using overload
Why D: Central SNAT with a dynamic IP pool using overload (PAT) is the correct method to translate all traffic from the 192.168.1.0/24 network to a single public IP address. The 'overload' option enables port address translation (PAT), allowing multiple internal hosts to share one public IP by using unique source port numbers, which is exactly what the administrator needs for internet-bound traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.