NSE4 Firewall Policies and NAT Practice Question
A network admin needs to configure a FortiGate to allow remote VPN users (IPsec VPN) to access a web server in the DMZ. The VPN users are assigned IPs from 10.10.10.0/24. The web server is at 192.168.2.10:80. Which TWO objects must be created to define the traffic for the firewall policy? (Choose two.)
⚠ Common exam trap
Many exam-takers think a service object must be created for HTTP, but FortiGate includes predefined services for common protocols like HTTP, making custom creation unnecessary unless the port is non-standard.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An address object for the web server 192.168.2.10
The firewall policy must specify the destination address of the traffic, which is the web server at 192.168.2.10. Without an address object for this server, the policy cannot match the destination IP of the VPN users' HTTP requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A service object for HTTP (TCP/80)
Why it's wrong here
Service object is not strictly required if using pre-defined services, but it could be used. However, the question asks which TWO objects must be created; addresses are mandatory, service is optional (can use pre-defined HTTP).
- ✓
An address object for the web server 192.168.2.10
Why this is correct
The web server address object is mandatory because it defines the destination of the traffic in the firewall policy. FortiGate requires both source and destination address objects in every IPv4 policy, and this object uniquely identifies 192.168.2.10 as the server. Without it, the policy cannot match traffic to the web server, so the rule cannot be correctly created.
- ✓
An address object for the VPN user subnet 10.10.10.0/24
Why this is correct
The address object for the VPN user subnet is equally required as the source address in the policy. Remote SSL VPN clients are assigned IPs from 10.10.10.0/24, so this object matches the origin of all inbound VPN traffic. Since a FortiGate policy must specify a source, this object is essential to scope the rule to only the remote users. Note this is a network object, not an identity object.
- ✗
A user group object for VPN authentication
Why it's wrong here
A user group object is not required for a simple IP-based allow policy that lets VPN traffic reach the web server. The policy can match on the VPN user subnet directly, avoiding any dependency on user authentication state. User groups are only used in identity-based policies that enforce per-user access rights, which is not the stated requirement. The VPN tunnel itself already authenticates users, so the group is redundant for this traffic-selection purpose.
- ✗
A schedule object for business hours
Why it's wrong here
A schedule object is not a mandatory element for this task because FortiGate includes a default 'always' schedule, which allows the policy to be active at all times. Creating a business-hours schedule would unnecessarily restrict the remote access window, potentially preventing after-hours connectivity. The question asks for the minimum objects required to permit access; a schedule is an optional time-based constraint, not a fundamental traffic matcher.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.