NSE4 Firewall Policies and NAT Practice Question
An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?
⚠ Common exam trap
The trap here is that candidates mistakenly think a schedule or static route is mandatory, but FortiGate only requires the traffic shaper object, the matching firewall policy, and the shaper assignment on that policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A traffic shaper object that defines bandwidth limits
A traffic shaper object is a fundamental component that defines the bandwidth limits (e.g., guaranteed bandwidth, maximum bandwidth, priority) that will be applied to traffic. Without this object, the firewall has no parameters to enforce rate limiting. In FortiGate, the traffic shaper object is created under 'Traffic Shapers' and can be per-policy or per-IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A traffic shaper object that defines bandwidth limits
Why this is correct
A traffic shaper object is the core definition of a bandwidth profile in Fortinet. It specifies parameters such as guaranteed bandwidth, maximum bandwidth, and traffic priority, enabling controlled allocation of network resources. Without this object, there is no shaping policy to reference, so creating it is an essential first step.
- ✓
A firewall policy that matches YouTube traffic
Why this is correct
To shape YouTube traffic, the firewall must first identify it using application control within a firewall policy. This policy matches traffic not by IP alone but by application signature, and it serves as the basis for applying the shaper. Thus, having a policy that correctly identifies YouTube traffic is a required component for effective shaping.
- ✗
A static route for the YouTube subnet
Why it's wrong here
A static route for the YouTube subnet is not relevant because traffic shaping operates at the policy and application layer, not at the routing table level. Routing determines the next hop for packets, whereas shaping controls bandwidth and prioritization after the traffic is permitted by a firewall policy. Additionally, YouTube traffic spans many dynamic subnets and CDNs, making static routes impractical and unrelated to bandwidth control.
- ✗
A schedule object to apply the shaper only during business hours
Why it's wrong here
A schedule object is purely optional in traffic shaping configuration; it is used in firewall policies to restrict the policy's time-of-day availability. Shaping itself does not require a schedule, and the shaper can be applied continuously. While schedules can be used to vary shaping patterns, they are not a prerequisite for basic traffic shaping.
- ✓
Enable traffic shaping on the firewall policy and assign the traffic shaper
Why this is correct
This step actually links the traffic shaper to the matched traffic. In the firewall policy, you must enable the "traffic shaping" option and assign the specified traffic shaper object, or the shaper remains unused. This final configuration ensures that the bandwidth limits defined in the object are enforced on the YouTube traffic identified by the policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.