NSE4 Firewall Policies and NAT Practice Question
An admin is configuring a policy-based NAT rule (central NAT) to translate internal users' source IPs to the external IP of the FortiGate interface. However, users complain that some applications fail. The admin notices that the NAT rule is using 'dynamic IP pool' with overload. What is the MOST likely cause of the application failures?
⚠ Common exam trap
Candidates often assume IP pool exhaustion (Option A) is the cause, but the question specifies 'some applications fail' rather than all traffic failing, pointing to application-layer NAT sensitivity rather than resource exhaustion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The applications are sensitive to NAT and require a fixed port range
Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IP pool is exhausted and no more translations are available
Why it's wrong here
The IP pool being exhausted would cause all new outbound connection attempts to fail, not just those from a particular application, and it would affect any destination. Even with overload (PAT), the limiting factor is frequently the range of source ports, not the number of IP addresses; however, a single app like SIP or FTP would not be singled out by an exhausted pool. Hence, this is not a valid explanation for an application-specific NAT requirement.
- ✗
The route to the destination is missing
Why it's wrong here
A missing route to the destination would prevent the firewall from even sending a packet toward the target, resulting in a total connectivity failure for every session, not selective application breakage. NAT and routing are independent layers; a policy-based NAT rule cannot compensate for a routing blackhole. Therefore, this would not explain why only certain applications require a fixed port range.
- ✓
The applications are sensitive to NAT and require a fixed port range
Why this is correct
Several application-layer protocols, including SIP and FTP, embed IP addresses and TCP/UDP port numbers inside the payload. When overload NAT (PAT) dynamically assigns a different source port for each translation, the embedded port may no longer match the actual translated port, causing the peer to reject the session. A policy-based central NAT rule can be configured with a fixed port range or static port mapping, ensuring that the translated source port always matches what the application advertises. This is why application sensitivity is the correct reason for setting up such a NAT rule.
- ✗
The firewall policy does not have NAT enabled
Why it's wrong here
In FortiOS central NAT mode, translation is controlled by separate NAT policy rules, and the 'NAT' toggle on the firewall policy is not used; it is irrelevant to the translation process. If the firewall policy does not have NAT enabled, it does not mean central NAT is disabled—the central NAT policy still applies. Therefore, this is not a reason to think policy-based NAT is needed; the NAT configuration is already independent.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.