NSE4 Firewall Policies and NAT Practice Question
An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?
⚠ Common exam trap
A common mix-up: candidates confuse source NAT (SNAT) with destination NAT (DNAT), thinking that enabling NAT on the WAN interface alone is sufficient for inbound access, when in fact a VIP (DNAT) and an allow policy are required to translate and permit the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ
To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use policy-based routing to forward SSH traffic
Why it's wrong here
PBR changes routing, not address translation.
- ✓
Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ
Why this is correct
VIP translates the destination address; the policy allows the traffic after translation.
- ✗
Configure source NAT on the outbound policy from DMZ to WAN
Why it's wrong here
Source NAT is for outbound traffic, not inbound.
- ✗
Enable NAT on the WAN interface
Why it's wrong here
NAT on interface is for source translation, not destination.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.