NSE4 Firewall Policies and NAT Practice Question
A FortiGate has multiple WAN interfaces (port1, port2) connected to different ISPs. The administrator wants traffic from the internal network to use port1 for general internet access but use port2 for traffic to a specific cloud service (203.0.113.0/24). Which feature should be used to achieve this?
⚠ Common exam trap
Many candidates confuse SD-WAN load balancing with policy-based routing, assuming that SD-WAN rules can enforce a strict 'always use this interface for this destination' policy, when in fact SD-WAN is primarily for dynamic load balancing and failover, not for static, deterministic path selection based solely on destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use policy-based routing (PBR) to route traffic based on destination
Policy-based routing (PBR) allows you to override the default routing table based on criteria such as source/destination IP, protocol, or port. In this scenario, PBR can match traffic destined to 203.0.113.0/24 and force it out through port2, while all other internet traffic follows the default route via port1. This provides granular control without affecting the general routing behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VIP for the cloud service
Why it's wrong here
A Virtual IP (VIP) is an inbound destination NAT object that maps an external/public address to an internal server's private address. It does not participate in outbound path selection, so it cannot be used to force traffic destined to a cloud service out a specific WAN interface. Since the cloud service is external and the FortiGate is the source, VIP semantics are entirely inapplicable.
- ✗
Configure static routes with different distances
Why it's wrong here
Configuring static routes with different administrative distances for the same destination provides failover, not policy-based access. The routing table always prefers the route with the lowest distance, so only one route is active at a time unless equal-cost multipath is configured. Static routes cannot match on source IP, protocol, or specific destination port, so they cannot steer a particular cloud service's traffic to a chosen WAN while leaving other traffic on the default path.
- ✗
Use SD-WAN rules to load balance
Why it's wrong here
SD-WAN rules can indeed steer traffic by destination, but they are designed for dynamic, policy-based load balancing and require the WAN interfaces to be members of an SD-WAN zone with performance SLAs and health checks. For a simple static requirement — send this specific cloud service's traffic out port1 — using SD-WAN adds unnecessary configuration complexity and isn't the most direct routing method. PBR gives the same outcome with a simpler, purely routing-based rule.
- ✓
Use policy-based routing (PBR) to route traffic based on destination
Why this is correct
Policy-based routing (PBR) allows a FortiGate to match traffic using source and destination IP, port, protocol, or even application, and explicitly assign the outgoing interface and source address. This lets you send traffic destined to a specific cloud service through port1 or port2 regardless of the default routing table lookup. PBR is the correct way to implement a static, destination-based WAN selection for specific services.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.