NSE4 Firewall Policies and NAT Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The central SNAT rule is disabled

  Why it's wrong here

  The central SNAT rule being disabled is not the root cause because precedence is determined by the NAT type configured on the policy, not by the enabled state of a central SNAT object. Even if the central SNAT rule were enabled, a policy with policy-based NAT (e.g., an IP pool assigned directly in the policy) will still take effect first. Disabling the central rule would only matter if no policy-based NAT existed, but here the policy explicitly defines its own NAT behavior.

• ✗

  The policy is using fixed port range

  Why it's wrong here

  A fixed port range does not influence which NAT mechanism is chosen; it only restricts the range of source ports used when an IP pool is applied for allocation. The policy either selects policy-based NAT or relies on central SNAT regardless of how ports are managed. In this scenario, the fixed port range is simply a property of the policy's NAT settings and does not cause central SNAT to be ignored—the presence of an explicit per-policy NAT configuration is what overrides the central rule.

• ✓

  Policy-based NAT overrides central SNAT rules

  Why this is correct

  This is correct because FortiOS applies policy-based NAT with higher priority than central NAT objects. When an administrator configures a source NAT directly on the firewall policy (such as selecting an IP pool), that per-policy NAT is evaluated before any central SNAT rule. The central NAT feature only serves as a fallback for policies that do not have their own NAT configuration, so the policy's own NAT action takes precedence and effectively masks the central SNAT rule.

• ✗

  The IP pool is out of addresses

  Why it's wrong here

  Exhaustion of IP pool addresses would cause new sessions to fail address allocation, typically generating error logs or dropped packets, not silently reverting to the interface IP. Such a failure would occur after the policy has already selected the pool, meaning central SNAT never comes into play. Since the policy explicitly uses the pool, running out of addresses does not trigger a fallback to central SNAT or the interface IP; it simply breaks connectivity.

Go deeper

Related to this question