NSE4 Firewall Policies and NAT Practice Question
An admin wants to block all traffic from the internet to a specific internal server except for the IP address 203.0.113.50. Which firewall policy configuration achieves this using the principle of least privilege?
⚠ Common exam trap
Many candidates think a VIP with restricted source (Option A) can control source access, but VIPs only handle destination translation and do not enforce source-based filtering; the actual access control must be done via firewall policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a deny policy from internet to server with any source, then an allow policy from source 203.0.113.50 to the server above it
It follows the principle of least privilege by explicitly denying all traffic from the internet to the internal server (with a deny policy using any source), then placing an explicit allow policy above it for source 203.0.113.50. In FortiGate firewall policy processing, policies are evaluated top-down, so the more specific allow rule for the trusted source is matched first, while the broader deny rule below it blocks all other internet traffic. This ensures only the permitted IP address can reach the server, and all other traffic is explicitly blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a VIP with restricted source
Why it's wrong here
A virtual IP (VIP) object is used for destination NAT, translating an external address/port to an internal server. Configuring a source restriction on the VIP limits which source IPs can use that translation, but it does not act as a firewall access-control rule; traffic that matches the VIP still requires a firewall policy to permit or deny it. Thus, simply restricting the VIP source does not block all other internet traffic and is not a substitute for policy-based control.
- ✗
Use a local-in policy to block the server IP
Why it's wrong here
Local-in policies on FortiGate govern traffic destined to the FortiGate's own interfaces, such as HTTPS management, ping, or routing protocols. Traffic transiting from the internet to the internal server is forwarded through the FortiGate and is not terminated at the device, so local-in policy rules do not apply to it. Using a local-in policy to block the server IP would have no effect on forwarded traffic and could instead disrupt legitimate management sessions if sourced accordingly.
- ✓
Create a deny policy from internet to server with any source, then an allow policy from source 203.0.113.50 to the server above it
Why this is correct
This approach follows the least-privilege principle by creating a broad deny policy for any internet source to the server, then placing a more specific allow policy above it for source 203.0.113.50. Because FortiGate evaluates policies top-down with first-match logic, the allow policy captures the permitted host while all other sources fall through to the explicit deny and are blocked. Without the explicit deny, the implicit deny at the bottom would still block other traffic, but an explicit deny makes the intent clear and reduces reliance on a default behavior.
- ✗
Create a single allow policy from source 203.0.113.50 to the server and rely on implicit deny for all other traffic
Why it's wrong here
Implicit deny only applies after all policies are evaluated; but the allow policy would match only that source, other traffic would hit implicit deny, effectively working, but not following least privilege because the allow policy is not explicitly denying first. However, it works, but best practice is explicit deny. The question expects explicit deny for least privilege.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.