NSE4 Firewall Policies and NAT Practice Question
An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?
⚠ Common exam trap
Many exam-takers assume a correctly configured VIP automatically allows traffic, but FortiGate requires an explicit firewall policy to permit the translated traffic, and the exam tests this separation of NAT and policy functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy for HTTPS traffic is missing or has incorrect destination
The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall policy for HTTPS traffic is missing or has incorrect destination
Why this is correct
In FortiGate, VIPs only perform destination NAT; they do not implicitly permit traffic. A firewall policy must explicitly allow HTTPS traffic with the destination set to the VIP object, and the service must include HTTPS (or port 443). If the existing policy only allows HTTP to the same VIP, HTTPS packets are dropped due to no matching policy, so the connection never reaches the server.
- ✗
The server's HTTPS service is not running
Why it's wrong here
Because HTTP users can successfully reach the server, the server is up and the network path from the firewall to the server is functional. An HTTPS service failure would prevent the server from responding, but the traffic would still be forwarded and appear in server logs; here the issue is that the packets are being blocked at the firewall, indicating a policy or NAT problem rather than a server-side issue.
- ✗
VIPs cannot share the same public IP address
Why it's wrong here
FortiGate supports multiple VIPs that share the same public IP address as long as their public ports or protocols differ. For example, a VIP for HTTP on port 80 and another for HTTPS on port 443 can both map to different internal servers on the same public IP. Thus, sharing a public IP is not a misconfiguration and cannot cause HTTPS to fail.
- ✗
The HTTPS VIP is configured with the wrong internal port
Why it's wrong here
If the HTTPS VIP's mapped internal port were wrong, such as mapping public 443 to internal 8080 while the server listens on 443, traffic would still pass through the firewall and reach the server, where the connection would be reset or refused. This would generate an active session and a different failure pattern (e.g., handshake timeout) compared to HTTPS being completely unreachable, which indicates the policy is dropping the traffic before any connection is attempted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.