NSE4 System and Network Administration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Source: internal, Destination: port1, Service: HTTP/HTTPS, Action: ACCEPT

  Why this is correct

  This policy correctly implements outbound web access: traffic originates from the internal network, exits via the port1 interface that connects to the Internet, and is restricted to HTTP/HTTPS services. Because FortiGate firewall policies are interface-based and stateful, this single policy also allows the corresponding return traffic from external web servers to flow back to the internal users without an explicit reverse rule. The Action ACCEPT ensures that the traffic is permitted, aligning with the required use case.

• ✗

  Source: port1, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

  Why it's wrong here

  Reversing the source and destination interfaces would create an inbound policy: traffic arriving on port1 (the external/Internet-facing interface) is allowed to reach the internal network. This would permit external users to access internal resources, which is the exact opposite of what the administrator needs—allowing internal users to reach the web. Additionally, for outbound web traffic, the source must be the internal network, not the external side, so this policy's direction is fundamentally incorrect.

• ✗

  Source: external, Destination: internal, Service: HTTP/HTTPS, Action: ACCEPT

  Why it's wrong here

  This policy also describes inbound traffic, but it uses 'external' as the source and 'internal' as the destination, meaning it will allow external hosts to connect to internal servers over HTTP/HTTPS. Such a policy is typically used to expose an internal web server to the Internet (e.g., a DMZ or port-forwarding scenario), not to give internal users web access. Since the requirement is for internal users to initiate web requests, the source should be 'internal' and the destination should be the outgoing interface 'port1', making this option wrong in its traffic direction.

• ✗

  Source: internal, Destination: port1, Service: ALL, Action: ACCEPT

  Why it's wrong here

  While this policy has the correct source and destination (internal to port1) and Action ACCEPT, it allows ALL services, not just HTTP/HTTPS. This violates the principle of least privilege because internal users would be able to send any traffic (e.g., Telnet, SSH, SMTP, or other protocols) to the Internet, significantly expanding the attack surface. The administrator's goal is to permit web browsing only, so the Service should be specifically limited to HTTP/HTTPS; using ALL is overly permissive and a common security misconfiguration.

Go deeper

Related to this question