Courseiva

CCNA Firewall Policies and NAT Questions

75 of 76 questions · Page 1/2 · Firewall Policies and NAT · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?

A.Both policies will be applied because the traffic matches both
B.Policy ID 2 because it has a broader destination and is more inclusive
C.Policy ID 1 because it is the first matching policy in the list
D.Neither policy; implicit deny will block the traffic
AnswerC

FortiGate performs a sequential lookup from the top of the policy list, and the first policy whose source, destination, service, user, and other attributes match the packet becomes the winner. Here, Policy ID 1 meets the session's source and destination, so the lookup terminates immediately. Consequently, Policy ID 1 is the only rule applied, even if later rules are equally or more general.

Why this answer

Policy ID 1 is correct because FortiGate uses a sequential, first-match policy evaluation model. Traffic from 10.0.1.10 to 203.0.113.5 matches the source and destination of Policy ID 1 exactly, and since it appears first in the policy list, it is applied immediately. Once a match is found, no further policies are evaluated, even if a later policy (like Policy ID 2) also matches.

Exam trap

The trap here is that candidates often assume a broader or more inclusive policy (like 'destination all') will override a more specific one, but FortiGate's first-match logic means policy order, not specificity, determines which policy is applied.

How to eliminate wrong answers

Option A is wrong because FortiGate does not apply multiple policies to the same traffic; it stops at the first match. Option B is wrong because FortiGate does not select policies based on inclusivity or broader destination; it strictly follows the order in the policy list. Option D is wrong because the traffic explicitly matches Policy ID 1, which has an allow action, so the implicit deny is never reached.

Practice this question →
2
MCQeasy

An administrator needs to block access to specific websites based on their FQDN (e.g., *.example.com). The FortiGate should match the destination domain regardless of the IP address the domain resolves to. Which type of address object should the admin use in the firewall policy destination?

A.Geography object
B.Subnet object
C.Wildcard FQDN object
D.FQDN object
AnswerC

Wildcard FQDN supports patterns with * to match multiple domains.

Why this answer

A Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.

Exam trap

The trap here is that candidates often confuse a standard FQDN object with a Wildcard FQDN object, assuming the FQDN object supports wildcard patterns or dynamic IP resolution, when in fact it only resolves to a static IP at policy installation time and cannot match patterns like *.example.com.

How to eliminate wrong answers

Option A is wrong because a Geography object matches traffic based on the source or destination IP address's geographic location (country), not the FQDN. Option B is wrong because a Subnet object matches traffic based on a specific IP address or range (e.g., 10.0.0.0/24), which cannot account for dynamic IP resolution of a domain. Option D is wrong because a standard FQDN object resolves the domain to a single IP address at policy installation time and does not support wildcard patterns like *.example.com; it also cannot match traffic if the domain resolves to multiple IPs or changes over time.

Practice this question →
3
MCQhard

An organization has a FortiGate with two internet connections (WAN1 and WAN2). They want traffic to a specific web service (203.0.113.50 port 443) to always exit via WAN2. All other internet traffic should use WAN1. Which feature should be used to achieve this?

A.Central NAT policy to force the traffic out of WAN2
B.Static route with a higher priority for WAN2 to 203.0.113.0/24
C.SD-WAN with a strategy of 'Best Quality'
D.Policy-based routing (PBR) configured with a policy matching the destination and service
AnswerD

PBR allows routing decisions based on firewall policy criteria.

Why this answer

Policy-based routing (PBR) allows you to override the routing table based on match criteria such as source/destination IP, port, or protocol. In this scenario, you create a PBR policy that matches destination 203.0.113.50 and service TCP/443, then sets the next-hop to the WAN2 gateway. This ensures that only traffic to that specific web service exits via WAN2, while all other traffic follows the default route via WAN1.

Exam trap

The trap here is that candidates confuse policy-based routing with static routing or SD-WAN strategies, assuming that a more specific static route or a quality-based SD-WAN rule can achieve the same per-service interface selection, but only PBR provides the necessary layer-4 granularity to match both destination IP and port.

How to eliminate wrong answers

Option A is wrong because Central NAT policy controls source NAT translation (e.g., which IP address traffic is masqueraded to), not the egress interface selection; it cannot force traffic out of a specific WAN link. Option B is wrong because a static route with a higher priority (lower administrative distance) for 203.0.113.0/24 would direct all traffic to that subnet (including other ports or services) via WAN2, not just port 443, and it does not provide per-service granularity. Option C is wrong because SD-WAN with 'Best Quality' strategy selects the best path based on link quality metrics (latency, jitter, packet loss) rather than forcing traffic to a specific interface; it would not guarantee that the traffic always exits via WAN2.

Practice this question →
4
MCQmedium

An administrator has configured a firewall policy that allows outbound traffic from a subnet to the internet, with NAT enabled. The external IP is 203.0.113.1. However, the administrator wants all traffic from a specific internal server (10.0.0.10) to appear with source IP 203.0.113.2. What should the administrator do?

A.Create a VIP with the external IP and apply it to the policy
B.Create an IP Pool with 203.0.113.2 and reference it in the policy
C.Configure route-based NAT
D.Set the NAT to 'Use Outgoing Interface Address'
AnswerB

An IP Pool allows selecting a different source NAT IP.

Why this answer

An IP Pool in FortiGate allows you to override the source IP address for specific traffic, even when NAT is enabled on the policy. By creating an IP Pool with the single address 203.0.113.2 and referencing it in the firewall policy, traffic from 10.0.0.10 will be NATed to that specific IP instead of the outgoing interface address (203.0.113.1). This is the standard method for fixed source NAT (also called 'static NAT' or 'one-to-one NAT') for a specific host.

Exam trap

The trap here is confusing Virtual IP (VIP) with IP Pool: VIP is for destination NAT (inbound), while IP Pool is for source NAT (outbound), and many candidates mistakenly apply a VIP to change the source IP of outbound traffic.

How to eliminate wrong answers

Option A is wrong because a Virtual IP (VIP) is used for destination NAT (port forwarding), not for changing the source IP of outbound traffic; applying a VIP to a policy would translate the destination address of incoming traffic, not the source of outgoing traffic. Option C is wrong because route-based NAT is a concept for VPNs or policy-based routing, not a direct method to specify a fixed source IP for NAT; FortiGate uses IP Pools for that purpose. Option D is wrong because setting NAT to 'Use Outgoing Interface Address' would NAT all traffic to the IP of the outgoing interface (203.0.113.1), which is exactly what the administrator wants to avoid for the specific server.

Practice this question →
5
MCQmedium

A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?

A.No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions
B.Create a second VIP for the return traffic
C.Add a policy from DMZ to WAN allowing the internal server to reply
D.Configure static routing on the internal server to route through the FortiGate
AnswerA

No additional configuration is required because FortiGate's session table maintains bidirectional state for every translated flow. When a server responds to a VIP-mapped connection, the FortiGate identifies the session via the 5-tuple, performs the reverse DNAT, and rewrites the source IP back to the original VIP address. This automatic reverse NAT is inherent to stateful inspection, so any manual return-path setup is unnecessary.

Why this answer

When a FortiGate performs destination NAT (DNAT) via a VIP for inbound traffic, it automatically creates a session entry that includes the reverse NAT mapping. For return traffic from the internal server, the FortiGate uses this session to perform source NAT (SNAT) back to the original public IP (203.0.113.10). This is called 'implicit reverse NAT' and requires no additional configuration; the session state ensures the reply packets are correctly translated and forwarded to the external client.

Exam trap

The trap here is that candidates often think a separate outbound policy or NAT rule is required for return traffic, but FortiGate's stateful firewall and implicit reverse NAT handle this automatically, making additional policies or VIPs unnecessary.

How to eliminate wrong answers

Option B is wrong because a second VIP is not needed; reverse NAT is handled automatically by the session table, not by a separate VIP object. Option C is wrong because no explicit policy from DMZ to WAN is required for return traffic; FortiGate's stateful inspection allows reply packets to traverse based on the existing session created by the inbound policy. Option D is wrong because the internal server does not need static routing through the FortiGate for return traffic; the server's default gateway should point to the FortiGate's DMZ interface, but this is a basic network requirement, not an additional step specific to VIP functionality.

Practice this question →
6
MCQmedium

An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?

A.The VIP does not have NAT reflection enabled
B.The server is not responding to internal requests
C.The firewall policy for internal to VIP is missing
D.The VIP is configured on a different interface
AnswerA

The VIP lacks NAT reflection (also called NAT hairpin or loopback), which is required for internal users to reach the same VIP that external users can access. With NAT reflection disabled, a packet from an internal client destined to the VIP's public IP hits the FortiGate but is neither source-NATed nor properly routed back, so the session never establishes. This perfectly matches the symptom where external users work, but internal users cannot use the public IP.

Why this answer

The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.

Exam trap

The trap here is that candidates often assume internal users can always reach a server via its public IP because the VIP is working externally, overlooking the need for NAT reflection to handle traffic sourced from the same subnet as the destination server.

How to eliminate wrong answers

Option B is wrong because the server is reachable from external users, proving it responds to requests; internal users failing to reach it via the public IP is a NAT/routing issue, not a server responsiveness problem. Option C is wrong because internal-to-VIP traffic does not require a separate firewall policy if the VIP is configured with NAT reflection; the existing policy for external-to-VIP traffic typically handles the loopback, and a missing policy would cause a different symptom (e.g., no traffic at all). Option D is wrong because the VIP is configured on the correct interface (the one with the public IP), and if it were on a different interface, external users would also fail to reach the server.

Practice this question →
7
MCQhard

An administrator needs to allow traffic from a guest network (192.168.100.0/24) to the internet only during business hours (Mon-Fri, 08:00-18:00). The administrator creates a schedule object and applies it to the firewall policy. However, guests can still access the internet outside of the schedule. What is the most likely cause?

A.The guest network is also allowed by another policy without a schedule
B.The schedule is not selected in the firewall policy
C.The schedule object is configured as a group but not applied
D.The FortiGate clock is not synchronized with an NTP server
AnswerB

Why this answer

If the schedule is not actually selected in the firewall policy configuration, the policy will apply without any time restriction, allowing traffic at all times. The administrator may have created the schedule object but forgotten to assign it to the policy's schedule field, which is a common oversight.

Exam trap

The trap here is that candidates assume creating a schedule object automatically applies it to the policy, but FortiGate requires explicit selection of the schedule in the policy's schedule field, and failing to do so leaves the policy unrestricted.

How to eliminate wrong answers

Option A is wrong because while another policy without a schedule could allow traffic, the question states the administrator applied the schedule to the policy, so the most likely cause is that the schedule itself was not selected in that policy. Option C is wrong because a schedule object configured as a group still functions as a schedule; if it were applied to the policy, it would enforce the time restriction. Option D is wrong because an unsynchronized clock could cause the schedule to apply at incorrect times, but it would not cause the schedule to be completely ignored; the policy would still enforce the schedule based on the device's local time.

Practice this question →
8
MCQmedium

An admin runs 'diagnose sys session filter dport 443' and sees output showing sessions with 'proto=6' and 'expire=3599'. The admin notices that these sessions are not being cleaned up after the firewall policy that allowed them is deleted. What is the reason?

A.The sessions are using UDP protocol, which has a longer timeout
B.The sessions are protected by a different policy that still exists
C.The sessions are in a different VDOM
D.FortiGate does not delete existing sessions when a policy is removed; sessions must be cleared manually
AnswerD

Correct. Policy changes affect new sessions only. Existing sessions continue until they time out.

Why this answer

When a firewall policy is deleted on a FortiGate, the existing sessions that were created by that policy are not automatically removed. The FortiGate continues to process those sessions until they expire naturally based on their timeout values. In this case, the sessions with 'proto=6' (TCP) and 'expire=3599' seconds remaining will persist until the timer counts down, even though the originating policy no longer exists.

The admin must manually clear them using 'diagnose sys session clear' or wait for the timeout to expire.

Exam trap

The trap here is that candidates often assume FortiGate automatically removes sessions when a policy is deleted, similar to how some other firewalls handle stateful inspection, but FortiGate requires manual intervention or timeout expiration to clear sessions.

How to eliminate wrong answers

Option A is wrong because 'proto=6' indicates TCP, not UDP; UDP uses protocol number 17 and has different timeout behavior. Option B is wrong because the output shows sessions with 'expire=3599', meaning they are still active and not yet protected by another policy; if another policy existed, the sessions would still be subject to the same timeout behavior, but the question states the policy that allowed them was deleted. Option C is wrong because the 'diagnose sys session filter dport 443' command without a VDOM filter applies to the current VDOM, and the output does not indicate a different VDOM; sessions in different VDOMs would require explicit VDOM filtering.

Practice this question →
9
MCQeasy

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

A.The SD-WAN zone does not include the backup interface wan2.
B.The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.
C.The static routes have the same distance, so failover does not occur.
D.The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.
AnswerB

With the SD-WAN strategy set to Manual, FortiGate uses the configured static routes and does not automatically re-evaluate link health to move traffic away from a failed interface. Automatic failover requires either an automatic strategy such as Lowest Cost or Best Quality combined with a performance SLA, or explicit link health monitoring to trigger a route update when wan1 goes down. Since neither is configured, the manual strategy explains why failover does not occur; this is the correct resolution.

Why this answer

When the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Exam trap

The trap here is that candidates assume static route distance alone handles failover, but when SD-WAN is configured with a Manual strategy, the SD-WAN rule overrides the routing table and prevents automatic failover unless link health monitoring is enabled.

How to eliminate wrong answers

Option A is wrong because the SD-WAN zone includes both wan1 and wan2 as stated in the scenario, so the backup interface is present. Option C is wrong because the static routes have different distances (10 and 20), which is the correct configuration for failover; equal distances would cause ECMP, not prevent failover. Option D is wrong because the firewall policy binding to the SD-WAN zone is not the issue; the policy can bind to the zone, but the failover failure is due to the SD-WAN strategy setting, not the policy binding.

Practice this question →
10
Multi-Selectmedium

A FortiGate admin needs to allow inbound HTTPS traffic to a web server while also applying an application control profile to block certain web applications. The web server has a VIP configured. Which TWO components are necessary for this configuration?

Select 2 answers
A.A central SNAT rule to translate the server's response
B.A VIP configured to map the public IP to the web server's private IP
C.A security profile group containing only the antivirus profile
D.A traffic shaping policy to prioritize HTTPS
E.A firewall policy with destination set to the VIP and application control profile applied
AnswersB, E

The VIP is required for destination NAT to reach the internal server.

Why this answer

A Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

Exam trap

The trap here is that candidates often think a central SNAT rule is required for return traffic, but FortiGate automatically handles reverse NAT for VIP traffic, making option A a common distractor.

Practice this question →
11
MCQhard

An admin runs the command 'diagnose firewall iprope list 100000' and sees the following output: id=2000000000 action=deny flag=0x0 src-interface=any dst-interface=any proto=0 src-addr=0.0.0.0-255.255.255.255 dst-addr=0.0.0.0-255.255.255.255 What does this entry represent?

A.A loopback interface policy
B.The implicit deny policy at the end of the policy list
C.A user-created deny policy that blocks all traffic
D.A NAT policy that translates all addresses
AnswerB

The implicit deny has a fixed ID of 2000000000 and denies all unmatched traffic.

Why this answer

The output shows an entry with id=2000000000, action=deny, and source/destination addresses covering all possible IPs (0.0.0.0-255.255.255.255). In FortiGate, the implicit deny policy is automatically inserted at the end of the policy list with a high ID (typically 2000000000) and matches any traffic that hasn't been permitted by earlier policies. This is not a user-created policy but the built-in default deny rule.

Exam trap

The trap here is that candidates may confuse the high ID (2000000000) with a user-created policy or think it's a NAT rule, but FortiGate reserves this ID specifically for the implicit deny, which is automatically generated and cannot be manually created or removed.

How to eliminate wrong answers

Option A is wrong because a loopback interface policy would reference a specific loopback interface (e.g., 'loopback') in the src-interface or dst-interface field, not 'any'. Option C is wrong because user-created deny policies have IDs in the normal range (e.g., 1-65535), not the reserved high ID 2000000000, and they would not automatically cover all IP ranges unless explicitly configured. Option D is wrong because NAT policies are configured under 'config firewall policy' with action set to 'accept' and include NAT-related options (e.g., 'set nat enable'), not a deny action with a catch-all address range.

Practice this question →
12
MCQhard

An administrator configures a Central SNAT policy to translate traffic from the internal network (10.0.0.0/8) to the internet using the IP pool 'pool1'. The administrator also has a firewall policy that uses policy-based NAT with an IP pool 'pool2'. Both policies match the same traffic. Which NAT will be applied?

A.Central SNAT using pool1
B.Both NAT rules are applied in sequence
C.The traffic is dropped due to conflicting NAT configurations
D.Policy-based NAT using pool2
AnswerA

Central SNAT rules are evaluated before any policy-based NAT. In FortiGate's NAT execution order, central source NAT takes precedence over the NAT settings configured inside a firewall policy, so a matching central SNAT rule using pool1 is selected. The session's source IP is translated to an address from pool1, and the policy's NAT configuration is completely bypassed.

Why this answer

Central SNAT policies have higher priority than policy-based NAT when both match the same traffic. In FortiOS, Central SNAT is evaluated before firewall policies, and if a match is found, the policy-based NAT within the firewall policy is ignored. Therefore, pool1 is applied.

Exam trap

The trap here is that candidates assume policy-based NAT within a firewall policy takes precedence because it is more specific, but FortiOS gives Central SNAT higher priority regardless of specificity.

How to eliminate wrong answers

Option B is wrong because FortiOS does not apply both NAT rules in sequence; only the Central SNAT policy is used, and the policy-based NAT is bypassed. Option C is wrong because there is no conflict that causes traffic to be dropped; the system deterministically selects the Central SNAT policy. Option D is wrong because policy-based NAT using pool2 is overridden by the higher-priority Central SNAT policy when both match the same traffic.

Practice this question →
13
MCQhard

An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?

A.The destination interface should be the internal interface, not wan1
B.The policy needs NAT enabled
C.The source interface should be the internal interface
D.The VIP is not associated with the policy
AnswerA

After the virtual IP (VIP) performs destination NAT (DNAT), the packet's destination IP becomes the internal server's private address. To deliver that packet, the firewall must route it out the interface that connects to that server, which is the internal interface. If the policy's destination interface is mistakenly set to wan1, the firewall will attempt to send the packet back out the WAN interface, causing the traffic to fail or be misrouted. Therefore, the destination interface must be the internal interface to match the post-DNAT forwarding path.

Why this answer

The VIP maps the public IP to the internal server, but the firewall policy's destination interface is set to 'wan1', which is the external interface. Traffic arriving on wan1 and destined for the VIP must be processed by a policy where the destination interface is the internal interface (e.g., 'internal' or 'lan') so that the firewall can route the decapsulated traffic to the private server. Setting the destination interface to wan1 prevents the firewall from forwarding the traffic to the internal network, breaking connectivity.

Exam trap

The trap here is that candidates often confuse the source and destination interface roles in a VIP policy, assuming the destination interface should match the incoming interface (wan1) rather than the internal interface where the server resides.

How to eliminate wrong answers

Option B is wrong because NAT is already implicitly handled by the VIP configuration; the VIP performs destination NAT (DNAT) and does not require an explicit NAT policy. Option C is wrong because the source interface should remain 'wan1' as traffic originates from the external network; changing it to the internal interface would block legitimate inbound traffic. Option D is wrong because the VIP is associated with the policy via the destination address field; the issue is the interface mismatch, not a missing association.

Practice this question →
14
MCQmedium

An administrator needs to block traffic from a specific geographic region (e.g., country) from reaching the corporate web server. Which type of address object should be used to define the source?

A.Wildcard FQDN object
B.FQDN object
C.Subnet object
D.Geography object
AnswerD

Geography objects allow selection by country/region using GeoIP, enabling policy enforcement based on geographic location.

Why this answer

A Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

Exam trap

The trap here is that candidates may confuse Geography objects with FQDN or Subnet objects, mistakenly thinking they can manually define country IP ranges via subnets, but FortiGate's GeoIP feature automates this with a dedicated object type.

How to eliminate wrong answers

Option A is wrong because a Wildcard FQDN object matches domain names with wildcard patterns (e.g., *.example.com) and is used for web filtering or DNS-based policies, not for blocking traffic based on geographic region. Option B is wrong because an FQDN object resolves to a specific IP address or set of IP addresses via DNS, which cannot represent an entire country's IP range. Option C is wrong because a Subnet object defines a specific IP range (e.g., 192.168.1.0/24) and would require manually aggregating all IP ranges for a country, which is impractical and error-prone.

Practice this question →
15
Multi-Selecthard

A FortiGate has a policy that matches traffic from LAN to WAN with NAT enabled and an IP pool. The pool contains IPs 203.0.113.1 to 203.0.113.5. The administrator notices that all traffic appears to come from 203.0.113.1. Which THREE reasons could explain this?

Select 3 answers
A.Only one source IP is generating traffic
B.The IP pool is configured with 'type one-to-one'
C.The IP pool is configured with 'type overload' and all source ports are being used
D.The IP pool is configured with 'type fixed port range'
E.The 'set nat' command is missing from the policy
AnswersA, B, D

If only one client, all traffic will use that client's translation.

Why this answer

If only one source IP (e.g., a single internal host) is generating traffic, the IP pool's overload (PAT) mechanism will map all sessions from that host to the first available IP in the pool (203.0.113.1) until its port range is exhausted. Since the pool has multiple IPs but only one source is active, the FortiGate will consistently use the same pool IP for all outbound traffic, making it appear as if all traffic originates from 203.0.113.1.

Exam trap

The trap here is that candidates assume 'overload' always distributes traffic across all pool IPs, but they overlook that distribution only occurs when multiple source IPs or port exhaustion triggers rotation; with a single source, the first pool IP is used exclusively.

Practice this question →
16
MCQhard

A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?

A.Change the IP pool type to 'Fixed Port Range'
B.Disable NAT and use policy-based routing
C.Use Central SNAT instead of policy-based NAT
D.Enable 'Preserve Source Port' in the firewall policy
AnswerA

In FortiOS, an IP pool configured as Fixed Port Range allocates source ports from a contiguous range for each NAT session rather than randomly selecting them as in Overload mode. This deterministic port assignment is essential when the destination service expects a stable or predictable source port per connection, such as legacy protocols or inter-server communications with port-based ACLs. Select this pool type in the IP pool configuration and reference it in the firewall policy's Dynamic IP Pool setting to satisfy the application requirement.

Why this answer

When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.

Exam trap

The trap here is that candidates may confuse 'Preserve Source Port' (a valid IP pool setting) with a firewall policy option, or assume that Central SNAT inherently provides fixed port ranges, when in fact the IP pool type must be explicitly changed to 'Fixed Port Range'.

How to eliminate wrong answers

Option B is wrong because disabling NAT and using policy-based routing would bypass NAT entirely, which does not address the need for a fixed source port range and could break connectivity for other traffic. Option C is wrong because Central SNAT is a different method of configuring NAT (centralized vs. policy-based) but does not inherently provide a fixed source port range; the IP pool type must still be set to 'Fixed Port Range'. Option D is wrong because 'Preserve Source Port' is not a valid option in FortiGate firewall policies; the correct feature to preserve the original source port is 'Preserve Source Port' in the IP pool configuration, not in the policy itself.

Practice this question →
17
MCQmedium

An administrator needs to configure a firewall policy that allows internal users to access a specific web server on the internet using its domain name. The web server's IP address may change. Which type of address object should be used as the destination in the policy?

A.IP Range object that covers the entire public IP space
B.Subnet object with the current IP address
C.FQDN address object
D.Geography object
AnswerC

FQDN objects allow DNS resolution to be used, so the policy works even if the IP changes.

Why this answer

An FQDN (Fully Qualified Domain Name) address object allows the firewall to resolve the domain name to an IP address dynamically. This is essential when the web server's IP address may change, as the firewall will periodically perform DNS resolution to update the destination IP in the policy, ensuring continuous access without manual reconfiguration.

Exam trap

The trap here is that candidates often confuse FQDN objects with static DNS entries or assume a subnet object is sufficient, overlooking the dynamic IP change scenario that FQDN objects are specifically designed to handle.

How to eliminate wrong answers

Option A is wrong because an IP Range object covering the entire public IP space would allow traffic to any internet destination, violating the principle of least privilege and creating a massive security risk. Option B is wrong because a Subnet object with the current IP address is static; if the server's IP changes, the policy will fail to match the new IP, blocking access. Option D is wrong because a Geography object matches traffic based on geographic location (country), not a specific host or domain, and cannot ensure traffic reaches the correct web server.

Practice this question →
18
MCQmedium

An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?

A.The session is in the process of being established and has not completed the TCP three-way handshake
B.The session is a UDP session because the proto_state is 01
C.The session has been closed and is being removed from the session table
D.The session is fully established and has been active for 3600 seconds
AnswerA

proto_state=01 means the first SYN has been sent but no SYN-ACK received, indicating the handshake is incomplete.

Why this answer

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

Exam trap

The trap here is that candidates see `duration=3600` and assume the session is fully established and active, but they overlook that `proto_state=01` indicates the TCP handshake is incomplete, not an established connection.

How to eliminate wrong answers

Option B is wrong because `proto=6` explicitly indicates TCP, not UDP (UDP uses protocol 17), and `proto_state=01` is a TCP state indicator, not a UDP one. Option C is wrong because a closed session being removed would show a `proto_state` of 06 (TIME_WAIT) or 07 (CLOSE_WAIT), and the expire timer would be very low or zero, not 3599 seconds. Option D is wrong because a fully established TCP session would show `proto_state=02` (ESTABLISHED), not `01` (SYN-SENT); the duration of 3600 seconds with an expire of 3599 suggests the session has been waiting for handshake completion for that entire time, which is abnormal.

Practice this question →
19
MCQhard

An admin is configuring a policy-based NAT rule (central NAT) to translate internal users' source IPs to the external IP of the FortiGate interface. However, users complain that some applications fail. The admin notices that the NAT rule is using 'dynamic IP pool' with overload. What is the MOST likely cause of the application failures?

A.The IP pool is exhausted and no more translations are available
B.The route to the destination is missing
C.The applications are sensitive to NAT and require a fixed port range
D.The firewall policy does not have NAT enabled
AnswerC

Several application-layer protocols, including SIP and FTP, embed IP addresses and TCP/UDP port numbers inside the payload. When overload NAT (PAT) dynamically assigns a different source port for each translation, the embedded port may no longer match the actual translated port, causing the peer to reject the session. A policy-based central NAT rule can be configured with a fixed port range or static port mapping, ensuring that the translated source port always matches what the application advertises. This is why application sensitivity is the correct reason for setting up such a NAT rule.

Why this answer

Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.

Exam trap

The trap here is that candidates often assume IP pool exhaustion (Option A) is the cause, but the question specifies 'some applications fail' rather than all traffic failing, pointing to application-layer NAT sensitivity rather than resource exhaustion.

How to eliminate wrong answers

Option A is wrong because an exhausted IP pool would cause new sessions to fail, but existing sessions would continue; the complaint is about application failures, not a complete inability to connect. Option B is wrong because a missing route would prevent all traffic to the destination, not just specific applications. Option D is wrong because the question states a policy-based NAT rule is configured, which inherently enables NAT; the firewall policy does not need a separate NAT enable checkbox when central NAT is used.

Practice this question →
20
MCQmedium

A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?

A.Add a new policy with a higher ID
B.Move the allow policy above the deny policy
C.Disable the deny policy
D.Delete the deny policy
AnswerB

Changing order ensures the allow policy matches first.

Why this answer

FortiGate policies are evaluated sequentially from top to bottom (lowest ID to highest ID). The first matching policy is applied. If an explicit deny policy appears above an allow policy for the same subnet, the deny policy will match first and drop the traffic.

Moving the allow policy above the deny policy ensures it is evaluated first, allowing the traffic.

Exam trap

The trap here is that candidates may think adding a new policy with a higher ID (Option A) will override the deny policy, but they fail to understand that FortiGate evaluates policies in order of ID (lowest to highest), so a higher ID policy is evaluated later and will never be reached if a deny policy with a lower ID matches first.

How to eliminate wrong answers

Option A is wrong because adding a new policy with a higher ID places it below the existing policies in the list, so it would still be evaluated after the deny policy and never be reached. Option C is wrong because disabling the deny policy is an unnecessary workaround that leaves a disabled policy in the configuration, potentially causing confusion and not addressing the root cause of policy ordering. Option D is wrong because deleting the deny policy is overly aggressive; the deny policy may be needed for other traffic, and the correct solution is to reorder policies rather than remove a potentially valid rule.

Practice this question →
21
MCQhard

An administrator configures a policy-based NAT rule to translate traffic from 10.0.0.0/8 to 203.0.113.1 using an IP Pool with overload. Later, they also enable Central SNAT for the same traffic. The traffic is not being NAT'd as expected. What is the MOST likely reason?

A.Both NAT methods are applied, causing double NAT
B.Central SNAT overrides policy-based NAT
C.The IP Pool used in policy-based NAT is also used in Central SNAT, causing a conflict
D.Policy-based NAT always overrides Central SNAT
AnswerB

When Central NAT is enabled, policy-based NAT rules are ignored for the matching traffic.

Why this answer

Central SNAT (Source NAT) is a centralized NAT policy that takes precedence over policy-based NAT rules when both are configured for the same traffic. In FortiGate, Central SNAT is evaluated before policy-based NAT, and if a matching Central SNAT rule exists, it will override any policy-based NAT configuration. This is by design to provide a more predictable and manageable NAT architecture.

Exam trap

The trap here is that candidates often assume policy-based NAT is always applied because it is configured directly on the firewall policy, but FortiGate's Central SNAT has a higher precedence, leading to unexpected NAT behavior when both are enabled.

How to eliminate wrong answers

Option A is wrong because double NAT would occur only if both NAT methods were applied sequentially, but Central SNAT overrides policy-based NAT, so only one NAT translation is applied. Option C is wrong because using the same IP Pool in both Central SNAT and policy-based NAT does not inherently cause a conflict; the conflict arises from the precedence order, not the pool itself. Option D is wrong because policy-based NAT does not always override Central SNAT; in fact, Central SNAT has higher priority and overrides policy-based NAT when both are configured for the same traffic.

Practice this question →
22
MCQmedium

A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?

A.The source address object 'Internal_Net' has an incorrect subnet mask
B.The new policy is placed below the older policy in the policy list
C.The new policy is disabled
D.Traffic shaping is applied to the new policy and is interfering
AnswerB

FortiGate firewall policies are evaluated sequentially from the top of the policy list downward, and the first policy whose source, destination, and service match the packet is applied. If the new policy is created below an older, broader policy that also matches the same traffic, the older policy will intercept the traffic before the new policy is ever considered. This first-match behavior is the reason traffic appears to hit the older policy, regardless of the new policy's content. The fix is to move the new policy above the older one in the policy list.

Why this answer

A FortiGate firewall evaluates policies sequentially from top to bottom, applying the first match. If the new policy is placed below an older policy with a broader source definition, traffic from 'Internal_Net' will match the older policy first and never reach the new policy. Therefore, option B is the correct answer.

Exam trap

The trap here is that candidates assume a newly created policy will automatically take precedence over older policies, but FortiGate requires manual reordering to enforce policy priority, unlike some vendors that use a most-specific-match logic.

How to eliminate wrong answers

Option A is wrong because an incorrect subnet mask on 'Internal_Net' would cause the object to not match the source IP, but the question states traffic is matching an older policy, implying the source object is functional. Option C is wrong because a disabled policy would show as greyed out in the GUI and generate a log entry indicating 'deny' or 'no match', but the traffic is matching an older policy, not being dropped. Option D is wrong because traffic shaping does not prevent policy matching; it only affects bandwidth allocation after a policy is matched, and would not cause traffic to skip the new policy.

Practice this question →
23
MCQeasy

An admin wants to block all traffic from the internet to a specific internal server except for the IP address 203.0.113.50. Which firewall policy configuration achieves this using the principle of least privilege?

A.Configure a VIP with restricted source
B.Use a local-in policy to block the server IP
C.Create a deny policy from internet to server with any source, then an allow policy from source 203.0.113.50 to the server above it
D.Create a single allow policy from source 203.0.113.50 to the server and rely on implicit deny for all other traffic
AnswerC

This approach follows the least-privilege principle by creating a broad deny policy for any internet source to the server, then placing a more specific allow policy above it for source 203.0.113.50. Because FortiGate evaluates policies top-down with first-match logic, the allow policy captures the permitted host while all other sources fall through to the explicit deny and are blocked. Without the explicit deny, the implicit deny at the bottom would still block other traffic, but an explicit deny makes the intent clear and reduces reliance on a default behavior.

Why this answer

It follows the principle of least privilege by explicitly denying all traffic from the internet to the internal server (with a deny policy using any source), then placing an explicit allow policy above it for source 203.0.113.50. In FortiGate firewall policy processing, policies are evaluated top-down, so the more specific allow rule for the trusted source is matched first, while the broader deny rule below it blocks all other internet traffic. This ensures only the permitted IP address can reach the server, and all other traffic is explicitly blocked.

Exam trap

The trap here is that candidates often think a VIP with restricted source (Option A) can control source access, but VIPs only handle destination translation and do not enforce source-based filtering; the actual access control must be done via firewall policies.

How to eliminate wrong answers

Option A is wrong because a VIP (Virtual IP) with restricted source is used for destination NAT (port forwarding) and does not control source-based access; it translates the destination IP/port but still relies on firewall policies to permit or deny traffic, so it does not achieve the explicit block-all-except-one requirement. Option B is wrong because a local-in policy controls traffic destined to the FortiGate itself (management traffic), not traffic passing through the FortiGate to an internal server; it cannot be used to filter transit traffic to a specific server. Option D is wrong because relying on implicit deny alone violates the principle of least privilege; while it would block other traffic, it does not provide an explicit deny rule, making it harder to audit and potentially allowing unintended traffic if the implicit deny is accidentally overridden or if there are other policies that match before it.

Practice this question →
24
MCQeasy

A junior admin is creating firewall policies and wants to ensure that all traffic not explicitly permitted is denied. Which FortiGate mechanism provides this behavior by default?

A.The security profile group
B.The default route
C.The last explicit deny policy in the policy list
D.The implicit deny rule
AnswerD

The implicit deny rule is a built-in, invisible final policy on every FortiGate firewall; any session that does not match an explicit allow or explicit deny policy is automatically dropped and logged. This rule cannot be deleted or disabled, ensuring that the firewall always enforces a default-deny posture for all unpermitted traffic. It is the true answer to the question because it is automatically applied, requiring no configuration, and it closes the gap that would otherwise allow traffic to pass unchecked.

Why this answer

The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

Exam trap

The trap here is that candidates may think the last explicit deny policy (Option C) is the default mechanism, but FortiGate's implicit deny rule is always present and active by default, whereas an explicit deny policy must be manually added and is not a default behavior.

How to eliminate wrong answers

Option A is wrong because a security profile group is a collection of security profiles (e.g., antivirus, web filter) applied to a firewall policy, not a mechanism that denies traffic by default. Option B is wrong because the default route controls where traffic is forwarded, not whether it is permitted or denied; it does not enforce access control. Option C is wrong because while an explicit deny policy can be added to the policy list, it is not present by default; the implicit deny rule is the built-in mechanism that denies all unmatched traffic without requiring any explicit policy.

Practice this question →
25
MCQmedium

An admin wants to block access to malicious websites using FortiGuard Web Filtering. Which policy configuration is necessary to apply the web filter profile to HTTP/HTTPS traffic?

A.Configure a DNS filter instead of a web filter
B.Create a policy with action DENY and a web filter profile
C.Create an allow policy for HTTP/HTTPS and apply a web filter profile
D.Use an application control profile to block malicious sites
AnswerC

Creating an allow policy for HTTP/HTTPS and attaching a web filter profile is the correct approach because the web filter profile inspects every allowed web request and compares each URL against FortiGuard categories or a custom block list. If a site is categorized as malicious or matches a blocked URL pattern, the web filter blocks the connection while still permitting access to other legitimate sites. This is the built-in mechanism for controlling web access based on URL reputation and content classification.

Why this answer

FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

Exam trap

The trap here is that candidates often think a deny policy can have a web filter profile applied to block malicious sites, but FortiGate only applies security profiles on allow policies, and deny policies simply drop traffic without inspection.

How to eliminate wrong answers

Option A is wrong because a DNS filter is used to block domains based on DNS queries, not to inspect HTTP/HTTPS content for malicious URLs; FortiGuard Web Filtering requires a web filter profile, not a DNS filter. Option B is wrong because a policy with action DENY drops all traffic before any security profiles, including web filter profiles, can be applied; web filter profiles can only be attached to allow policies where traffic is permitted and then inspected. Option D is wrong because an application control profile is designed to identify and control application traffic (e.g., Facebook, YouTube), not to block malicious websites based on URL categories; that is the function of a web filter profile.

Practice this question →
26
MCQeasy

An administrator wants to allow SSH access from the internet to a server inside the network at 192.168.1.10. Which NAT configuration is needed?

A.Use policy-based routing to forward SSH traffic
B.Create a VIP mapping public IP:22 to private IP:22 and an allow policy from WAN to DMZ
C.Configure source NAT on the outbound policy from DMZ to WAN
D.Enable NAT on the WAN interface
AnswerB

VIP translates the destination address; the policy allows the traffic after translation.

Why this answer

To allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.

Exam trap

The trap here is that candidates often confuse source NAT (SNAT) with destination NAT (DNAT), thinking that enabling NAT on the WAN interface alone is sufficient for inbound access, when in fact a VIP (DNAT) and an allow policy are required to translate and permit the traffic.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) controls the path packets take based on criteria like source/destination, but it does not perform address translation; it cannot map a public IP to a private IP for inbound access. Option C is wrong because source NAT (SNAT) translates the source IP of outbound traffic, which is used for internal hosts to access the internet, not for allowing inbound SSH from the internet to an internal server. Option D is wrong because simply enabling NAT on the WAN interface without a specific VIP or DNAT rule does not create a mapping for inbound traffic; it typically applies to outbound traffic (masquerading) or requires additional configuration to handle inbound connections.

Practice this question →
27
MCQmedium

A FortiGate admin has configured a firewall policy allowing traffic from the internal network (10.0.1.0/24) to the internet (any). Users report that they cannot access a specific website (203.0.113.5). The admin runs 'diagnose firewall fqdn list' and sees that the FQDN object used in a policy above the allow policy resolves to an IP that includes 203.0.113.5. What is the MOST likely cause?

A.The destination NAT on the allow policy is misconfigured
B.The FortiGate's DNS server is not resolving the FQDN correctly
C.The antivirus profile on the allow policy is blocking the website
D.The FQDN object resolved to the IP after the policy was created, but the policy lookup uses the cached IP and matches before the allow policy
AnswerD

Policy lookup matches the first policy where source/destination conditions are met. Since the FQDN object resolved to the destination IP, a higher-priority policy matches and the intended allow policy is never evaluated.

Why this answer

The FQDN object in a policy above the allow policy resolved to an IP that includes 203.0.113.5. FortiGate performs policy lookup based on cached IP addresses for FQDN objects. Since the FQDN object's cached IP now matches the destination IP of the website, traffic hits the higher-priority policy (which likely denies or otherwise blocks the traffic) before reaching the allow policy.

This is why users cannot access the website despite the allow policy existing.

Exam trap

The trap here is that candidates assume the allow policy will always match traffic to the website, but they overlook that FortiGate evaluates policies top-down and uses cached IP addresses for FQDN objects, so a higher-priority policy with a matching cached IP can intercept the traffic before the allow policy is reached.

How to eliminate wrong answers

Option A is wrong because destination NAT is not involved in this scenario; the issue is about policy matching order based on cached FQDN resolution, not NAT misconfiguration. Option B is wrong because the FQDN resolved correctly (the admin sees the IP in the list), so DNS resolution is not the problem. Option C is wrong because there is no indication that an antivirus profile is blocking the website; the problem is policy precedence, not security profile filtering.

Practice this question →
28
MCQeasy

An administrator needs to allow outbound DNS traffic (UDP port 53) from multiple internal subnets to the internet. Which object type should be used to group the subnets into a single source in the firewall policy?

A.VIP group
B.Schedule group
C.Address group
D.Service group
AnswerC

An address group is the correct object because it bundles multiple address objects—such as subnets, IP ranges, and FQDNs—into a single named entity. This address group can then be used as the source field in an outbound policy, effectively allowing all internal subnets to initiate DNS queries. This is exactly what the administrator needs to match the source subnets for outbound UDP port 53 traffic.

Why this answer

An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.

Exam trap

The trap here is that candidates often confuse address groups with service groups, mistakenly thinking that grouping subnets is done via service objects, but service groups only define protocols and ports, not IP addresses.

How to eliminate wrong answers

Option A is wrong because a VIP group is used to group multiple virtual IP (VIP) objects for destination NAT (port forwarding) or load balancing, not for grouping source subnets. Option B is wrong because a schedule group is used to group time-based schedules (e.g., daily, weekly) to control when a policy is active, not to define source addresses. Option D is wrong because a service group is used to group multiple service definitions (e.g., DNS, HTTP, HTTPS) by protocol/port, not to group source IP subnets.

Practice this question →
29
MCQmedium

A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?

A.The interface is not configured as a WAN interface
B.The policy is disabled
C.The firewall policy action is set to DENY
D.The traffic is being processed by a higher priority deny policy
AnswerC

If the policy action is set to DENY, even though the traffic matches the source/destination/service, it will be dropped. This is a common misconfiguration.

Why this answer

The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).

Exam trap

The trap here is that candidates often assume a policy being 'hit' in debug flow means it is allowing traffic, but in FortiOS, a policy with action DENY will still show as 'hit' before the packet is dropped.

How to eliminate wrong answers

Option A is wrong because the interface type (WAN vs. internal) does not affect whether a firewall policy can allow traffic; FortiGate policies are based on source/destination interfaces and addresses, not interface roles. Option B is wrong because if the policy were disabled, the debug flow would not show packets hitting that policy; it would either match a different policy or be dropped by the implicit deny. Option D is wrong because if a higher-priority deny policy were processing the traffic, the debug flow would show that policy being hit, not the current policy; the debug output explicitly shows this policy being hit and then dropped.

Practice this question →
30
MCQeasy

A FortiGate administrator wants to ensure that traffic from the internal network to the internet is translated to a single public IP address. Which NAT method should be used?

A.Central SNAT
B.One-to-one NAT
C.Fixed port range NAT
D.Overload NAT
AnswerD

Overload NAT, also known as Port Address Translation (PAT), is the correct method for this scenario. It translates the source IP address of all internal hosts to one public IP while dynamically assigning a unique source port for each connection, preserving the host identity through the port mapping. This provides scalable, concurrent internet access for many internal users using a single public address.

Why this answer

Overload NAT (also known as Port Address Translation or PAT) is the correct method because it allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is exactly what the administrator needs: translating all internal-to-internet traffic to one public IP.

Exam trap

The trap here is that candidates often confuse 'Central SNAT' (a FortiGate configuration method) with a specific NAT type, or think 'one-to-one NAT' is suitable for sharing a single IP, when it actually requires a dedicated public IP per internal host.

How to eliminate wrong answers

Option A is wrong because Central SNAT is a policy-based NAT method in FortiGate that can use overload or other modes, but it is not a specific NAT method itself; it is a configuration approach. Option B is wrong because one-to-one NAT maps a single private IP to a single public IP, which would require multiple public IPs for multiple internal hosts, not a single public IP. Option C is wrong because fixed port range NAT allocates a fixed range of ports per internal host, which still requires multiple public IPs or port ranges and does not achieve the goal of using a single public IP for all traffic.

Practice this question →
31
MCQmedium

You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?

A.The TCP handshake is incomplete; the SYN-ACK has not been received
B.The session is a UDP session
C.The session has been idle for 3600 seconds
D.The session is fully established and will expire in 3599 seconds
AnswerA

State 01 is SYN_SENT, meaning the SYN has been sent but no SYN-ACK received yet.

Why this answer

The output shows a TCP session (proto=6) with proto_state=01, which in Fortinet's session table indicates the session is in the SYN-SENT state (TCP state 1). This means the initial SYN has been sent but the SYN-ACK has not yet been received, so the TCP three-way handshake is incomplete. The duration and expire values reflect the session's age and remaining lifetime, not its establishment status.

Exam trap

The trap here is that candidates see 'expire=3599' and assume the session is established and about to expire, but Fortinet's proto_state field directly reveals the TCP handshake phase, and state 01 specifically means the handshake is incomplete.

How to eliminate wrong answers

Option B is wrong because proto=6 explicitly indicates TCP (not UDP, which would be proto=17). Option C is wrong because duration=3600 shows the session has been active for 3600 seconds, not idle; idle time is tracked separately in the session table. Option D is wrong because proto_state=01 (SYN-SENT) means the session is not fully established; a fully established TCP session would show proto_state=02 (ESTABLISHED) or higher.

Practice this question →
32
MCQmedium

A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?

A.The VIP is configured for port forwarding only for HTTP (port 80)
B.The web server is not listening on HTTPS
C.The VIP is using overload mode instead of one-to-one
D.The firewall policy allowing traffic to the VIP only permits HTTP
AnswerA

The virtual IP (VIP) object on a FortiGate is responsible for destination NAT, mapping an external address and port to an internal server. When a VIP is defined with only the HTTP service (port 80), the FortiGate will only translate traffic destined to that external IP:port pair. Incoming HTTPS connections to port 443 are not matched by the VIP, so they are dropped or not forwarded, precisely matching the symptom that external users cannot reach the web server over HTTPS.

Why this answer

The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.

Exam trap

The trap here is that candidates often assume the firewall policy is the issue, but the VIP itself must be configured to forward the specific ports; a policy allowing all traffic is useless if the VIP does not translate the destination port for HTTPS.

How to eliminate wrong answers

Option B is wrong because if the web server were not listening on HTTPS, the connection would still be attempted and fail at the server level, but the symptom is that external users cannot reach HTTPS at all, which points to a VIP or policy issue, not server configuration. Option C is wrong because overload mode (PAT) and one-to-one mode (DNAT) both can handle multiple ports; the mode does not restrict which ports are forwarded. Option D is wrong because the firewall policy allowing traffic to the VIP only permits HTTP would block HTTPS, but the question states the VIP is configured for port forwarding only for HTTP, making the VIP itself the root cause; a policy issue would be secondary and less likely given the VIP configuration.

Practice this question →
33
Multi-Selectmedium

A FortiGate administrator needs to allow inbound HTTPS traffic to a web server located at 192.168.1.10. The public IP is 203.0.113.5. The administrator wants to translate the destination to the internal server and also translate the source port to a fixed range for logging purposes. Which THREE configuration elements are required?

Select 3 answers
A.Create a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10
B.Create a firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination
C.Configure Central SNAT to translate the server's source IP for return traffic
D.Create an IP pool with fixed port range for source translation
E.Enable 'allow source port translation' on the VIP
AnswersA, B, D

A VIP is necessary for destination NAT (DNAT) to forward public IP to internal server.

Why this answer

To allow inbound HTTPS to an internal server with destination NAT, a Virtual IP (VIP) mapping 203.0.113.5 to 192.168.1.10 is required. A firewall policy from WAN to DMZ allowing HTTPS and referencing the VIP as destination permits the traffic and applies the NAT. Additionally, to translate the source port to a fixed range for logging, an IP pool with fixed port range is needed.

Thus, options A, B, and D are all required.

Exam trap

The trap here is that candidates often confuse VIPs (destination NAT) with IP pools (source NAT) or Central SNAT, mistakenly thinking source translation is needed for inbound traffic, when the question specifically requires destination translation and fixed port mapping for logging.

Practice this question →
34
MCQeasy

What is the order of evaluation for firewall policies on a FortiGate?

A.Random order
B.From bottom to top
C.From top to bottom, first match
D.By policy ID in ascending order
AnswerC

Correct.

Why this answer

FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.

Exam trap

The trap here is that candidates often confuse policy ID with evaluation order, assuming policies are processed by ascending ID, but FortiGate evaluates based on the visual list order, which can be manually rearranged independently of the ID numbers.

How to eliminate wrong answers

Option A is wrong because FortiGate does not evaluate policies in random order; it uses a deterministic sequential evaluation from top to bottom. Option B is wrong because policies are evaluated from top to bottom, not bottom to top; a bottom-to-top order would reverse the intended priority and is not how FortiGate processes policies. Option D is wrong because while policy IDs are assigned sequentially, evaluation order is determined by the policy's position in the list (which can be rearranged), not by the numeric ID; reordering policies changes evaluation order independently of their IDs.

Practice this question →
35
MCQmedium

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

A.The user is not a member of the FSSO group
B.The FSSO collector agent is not running
C.The user's IP address is not in the source address range of the policy
D.The FortiGate is not polling the domain controller
AnswerC

FSSO authenticates the user, but the policy's source address must match the user's IP.

Why this answer

Even though the FortiGate is receiving FSSO login events, the firewall policy also includes a source address restriction. If the user's IP address falls outside the defined source address range, the policy will not match, and the user will be denied access despite being authenticated via FSSO. The FSSO group membership is only one condition; the source IP must also satisfy the policy's source address criteria.

Exam trap

The trap here is that candidates assume receiving FSSO login events guarantees policy match, ignoring that the source address condition in the firewall policy is a separate, independent requirement that must also be satisfied.

How to eliminate wrong answers

Option A is wrong because if the user were not a member of the FSSO group, the FortiGate would not show the user as authenticated, and the administrator would not see the user's login events in the FSSO status. Option B is wrong because the FSSO collector agent is confirmed to be running since the FortiGate is receiving login events; a stopped collector agent would prevent event reception. Option D is wrong because the FortiGate is already receiving login events, which proves it is successfully polling or receiving data from the domain controller; if polling were failing, no events would appear.

Practice this question →
36
Multi-Selecthard

A FortiGate administrator is configuring a policy-based routing (PBR) rule to send all traffic from the 'Engineering' VLAN (10.1.0.0/16) to a dedicated internet link through gateway 203.0.113.1. The administrator also wants to apply a traffic shaper to limit bandwidth. Which THREE configuration tasks must be performed?

Select 3 answers
A.Define a traffic shaper object with the desired bandwidth limits
B.Enable SD-WAN on the FortiGate
C.Configure Central NAT to translate the source IP
D.Create a policy-based route with source 10.1.0.0/16 and gateway 203.0.113.1
E.Create a firewall policy allowing traffic from Engineering VLAN to internet and apply the traffic shaper
AnswersA, D, E

The shaper must exist before it can be applied in a firewall policy.

Why this answer

A traffic shaper object must first be defined with the desired bandwidth limits (e.g., maximum rate, burst size) before it can be applied to a firewall policy. Without this object, the shaper cannot be referenced or enforced.

Exam trap

The trap here is that candidates often think SD-WAN is required for PBR or that Central NAT is mandatory, when in fact PBR and traffic shaping are independent features that can be configured without SD-WAN or Central NAT.

Practice this question →
37
Multi-Selectmedium

An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)

Select 2 answers
A.execute ping 203.0.113.50
B.diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80
C.diagnose debug flow
D.diagnose firewall policy list
E.get firewall policy
AnswersB, D

Simulates the policy lookup for a specific flow, showing which policy matches.

Why this answer

B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.

Exam trap

The trap here is that candidates often confuse 'diagnose debug flow' (a real-time debugging tool) with 'diagnose firewall iprope lookup' (a static policy lookup tool), or they mistakenly think 'get firewall policy' can identify the matching policy without specifying traffic parameters.

Practice this question →
38
MCQmedium

An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?

A.Create a central SNAT policy with the source as the mail server and the translated IP as the desired address
B.Use a VIP with port forwarding to translate the source
C.In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload
D.Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool
AnswerC

In the firewall policy, enabling NAT and referencing an IP pool is the proper method for policy-based source NAT. An IP pool configured as overload (PAT) allows multiple internal sessions to share a single translated IP, while a fixed port range pool also uses a single IP but constrains the source port range; both can satisfy the requirement for a single public address for the mail server. This is exactly what the admin needs for SMTP traffic, ensuring all outbound mail appears from the same IP. Thus it is the correct choice.

Why this answer

The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.

Exam trap

The trap here is that candidates often confuse IP pools with VIPs or central SNAT, mistakenly thinking VIPs can modify source IPs or that central SNAT is required, when in fact the IP pool directly attached to the firewall policy is the correct and simplest solution for overriding the source NAT address.

How to eliminate wrong answers

Option A is wrong because a central SNAT policy is used for source NAT but does not allow specifying an IP pool directly within a firewall policy; it requires separate configuration and is not the standard method for overriding the translated IP in a policy-based NAT scenario. Option B is wrong because a Virtual IP (VIP) is used for destination NAT (port forwarding), not source NAT; it translates incoming traffic to an internal server, not outbound source IPs. Option D is wrong because a dynamic IP pool is used for load-balancing or rotating source IPs, not for pinning the source to a specific IP from a pool; the admin needs a fixed translation, which requires Fixed Port Range or Overload mode.

Practice this question →
39
Multi-Selectmedium

A FortiGate administrator is troubleshooting why traffic from a specific internal host is not being allowed through a firewall policy. The policy appears correct and is enabled. Which TWO diagnostic commands could the administrator use to determine if the traffic is matching a different policy?

Select 2 answers
A.get system performance status
B.config system ha
C.execute ping options
D.diagnose firewall iprope list
E.diagnose debug flow
AnswersD, E

This shows hit counts for each policy, indicating which policies are being matched.

Why this answer

The 'diagnose firewall iprope list' command (D) displays the kernel's internal firewall rule list, allowing the administrator to verify the exact order and matching criteria of all policies. The 'diagnose debug flow' command (E) enables real-time packet flow tracing, showing which policy each packet matches and why it is accepted or denied. Together, these two commands directly reveal if traffic is matching a different policy than intended.

Exam trap

The trap here is that candidates often rely on 'get system performance status' or 'execute ping' to troubleshoot policy matching, but these commands do not reveal which policy ID the traffic is matching or the order of evaluation.

Practice this question →
40
MCQhard

An admin configures a policy-based NAT rule (central SNAT) to translate source IPs from 10.0.0.0/24 to a dynamic IP pool of 203.0.113.1-203.0.113.10 with overload enabled. Users report that some connections are dropped. What is the MOST likely cause?

A.The port range for each IP in the pool is exhausted
B.The firewall policy has 'set nat enable' disabled
C.The route to the internet is missing
D.The pool does not have enough IPs to cover all users
AnswerA

Each IP has a limited number of ports (around 64,000). Under heavy traffic, ports can be exhausted, causing connection drops.

Why this answer

With overload enabled (Port Address Translation), the firewall translates multiple internal IPs to a single public IP by using unique source ports. Each public IP can handle up to 65,535 ports, but the actual usable port range is often smaller due to reserved ports and system limits. When all ports on all IPs in the pool are consumed, new connections are dropped because no port can be allocated for the translation.

Exam trap

The trap here is that candidates assume the pool must have enough IPs for each user, but overload (PAT) allows many users to share a single IP, so the real bottleneck is port exhaustion, not IP count.

How to eliminate wrong answers

Option B is wrong because 'set nat enable' is a legacy setting for policy-based NAT; central SNAT rules do not require this option to be enabled on the firewall policy. Option C is wrong because a missing internet route would cause all outbound traffic to fail, not just some connections being dropped. Option D is wrong because dynamic IP pools with overload do not require one IP per user; the issue is port exhaustion, not a lack of IP addresses.

Practice this question →
41
MCQmedium

A network administrator has configured a firewall policy allowing traffic from the internal network (10.0.0.0/8) to the internet. Users report that some websites are not loading. The administrator runs 'diagnose firewall iprope list 100000' and sees the policy listed with a hit count of zero. What is the MOST likely cause?

A.The source interface or destination interface is incorrectly configured
B.The policy has a schedule that does not match the current time
C.The policy is placed below a more specific or broader policy that matches the same traffic
D.The FortiGate has a routing issue preventing traffic from reaching the internet
AnswerC

FortiGate firewall policies are evaluated top-down and the first policy that matches all configured criteria (source, destination, interface, and service) is executed; lower policies are never reached if a higher policy matches the same traffic. This means a broader policy placed above this specific rule—for example, an any-to-any policy—will shadow it, causing this rule's hit count to remain zero. Since FortiGate uses first-match rather than best-match, rule ordering is critical, and moving this rule above the broad policy would restore its visibility and hit count.

Why this answer

A hit count of zero indicates the firewall policy has never matched any traffic. When a more specific or broader policy exists above it in the sequence, the FortiGate processes policies top-down and stops at the first match, so the lower policy never gets evaluated. This is the most likely cause given that the policy is present but unused.

Exam trap

The trap here is that candidates often assume a zero hit count means the policy is not working due to misconfiguration or routing, but the real issue is policy ordering and the top-down match-first behavior of FortiGate firewalls.

How to eliminate wrong answers

Option A is wrong because if the source or destination interface were misconfigured, the traffic would not match any policy at all, but the administrator would likely see hits on other policies or no hits anywhere, not specifically zero on this policy while other policies may have hits. Option B is wrong because a schedule mismatch would prevent the policy from being active, but the policy would still appear in the rule list with a hit count of zero; however, the question states users can reach some websites, implying some traffic is passing, which would not be the case if a schedule were blocking all traffic through this policy. Option D is wrong because a routing issue would prevent traffic from reaching the internet entirely, but users report only some websites are not loading, indicating partial connectivity, and routing issues would affect all internet-bound traffic, not just specific sites.

Practice this question →
42
MCQeasy

An admin needs to translate the source IP of traffic from multiple internal hosts to a single public IP when accessing the internet, while keeping track of each session. Which NAT method should be used?

A.Fixed port range NAT
B.One-to-one NAT
C.Central SNAT without overload
D.Overload NAT (Port Address Translation)
AnswerD

Overload NAT, also known as Port Address Translation (PAT), allows many internal hosts to share one public IP by rewriting not only the source IP but also the source port to a unique, dynamically assigned value. The NAT engine maintains a translation table keyed by the public IP and the new source port, so return traffic is correctly forwarded back to the original internal host. This session multiplexing is what makes a single public IP sufficient for the entire internal network, with a theoretical maximum of about 65,536 concurrent sessions per public IP.

Why this answer

Overload NAT, also known as Port Address Translation (PAT), allows multiple internal hosts to share a single public IP address by mapping each session to a unique source port. This is the correct method for translating source IPs from multiple internal hosts to one public IP while maintaining session tracking, as it uses the transport-layer port number to differentiate between concurrent connections.

Exam trap

The trap here is that candidates often confuse 'Central SNAT without overload' with PAT, not realizing that without overload (port translation), the NAT device cannot multiplex multiple internal hosts to a single public IP, leading to session failures.

How to eliminate wrong answers

Option A is wrong because Fixed port range NAT assigns a predefined range of ports to each internal host, which limits the number of concurrent sessions per host and does not efficiently share a single public IP across many hosts. Option B is wrong because One-to-one NAT maps a single internal IP to a single external IP, requiring a public IP for each internal host, which does not conserve public IP addresses. Option C is wrong because Central SNAT without overload translates the source IP without using port multiplexing, meaning it can only handle one session per public IP at a time, causing conflicts when multiple internal hosts try to access the internet simultaneously.

Practice this question →
43
MCQmedium

A FortiGate administrator has configured a firewall policy allowing HTTP traffic from the internal network (10.0.1.0/24) to the DMZ server (192.168.1.10). The policy is placed after a deny-all policy that blocks traffic from internal to DMZ. Even though the allow policy is more specific, traffic is still being denied. What is the most likely cause?

A.The deny-all policy has a higher policy ID than the allow policy
B.The allow policy is configured with the wrong source interface
C.The allow policy uses a schedule that is not active at the current time
D.The deny-all policy is placed above the allow policy in the policy list
AnswerD

FortiOS performs first-match evaluation, checking rules top-down and enforcing the first rule whose all conditions (source, destination, service, schedule, etc.) are satisfied. If a broad deny-all is positioned above the specific allow policy, every packet that would otherwise match the allow rule hits the deny-all first and is dropped. That is the classic misordering mistake, and it cannot be compensated for by policy IDs or other attributes.

Why this answer

FortiGate firewall policies are evaluated sequentially from top to bottom. The first matching policy is applied, and subsequent policies are ignored. Since the deny-all policy is placed above the more specific allow policy, traffic from 10.0.1.0/24 to 192.168.1.10 matches the deny-all first and is dropped, never reaching the allow rule.

Exam trap

The trap here is that candidates mistakenly believe FortiGate uses a 'best-match' or 'most-specific' logic like routing tables, when in fact it uses strict first-match sequential evaluation, making policy order critical.

How to eliminate wrong answers

Option A is wrong because policy ID order does not determine evaluation priority; FortiGate uses the physical sequence in the policy list, not the ID number. Option B is wrong because if the source interface were incorrect, the traffic would not match the allow policy at all, but the question states the traffic is denied by the deny-all policy, implying the allow policy is otherwise correctly configured. Option C is wrong because a schedule issue would cause the allow policy to be inactive, but the traffic would still be evaluated against the deny-all policy and denied; however, the most likely cause given the policy placement is the order, not a schedule.

Practice this question →
44
Multi-Selecthard

An admin is configuring a policy-based NAT (central SNAT) to translate internal users to a pool of public IPs using overload. The admin wants to ensure that specific applications using non-standard ports are not affected by NAT. Which THREE steps should the admin consider?

Select 3 answers
A.Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'
B.Configure a separate IP pool dedicated to those applications
C.Use a fixed port range in the IP pool configuration
D.Use central SNAT with a VIP for source NAT
E.Enable 'set nat enable' on the policy
AnswersA, B, C

Adding a policy before the central SNAT policy with 'set nat disable' creates a deterministic exception: traffic matching that earlier policy is evaluated and its NAT disabled, so it is never processed by the subsequent central SNAT rule. Due to FortiOS policy ordering, the first match wins, meaning this exempt policy must be placed ahead of the NAT policy. This selectively preserves the original source address/port for those applications while other traffic continues through central SNAT.

Why this answer

Adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation, ensuring that applications using non-standard ports are not affected by the overload behavior. Option B is correct because configuring a separate IP pool dedicated to those applications allows you to control the NAT behavior independently, such as using a pool without PAT or with a fixed port range, thereby avoiding port remapping issues. Option C is correct because using a fixed port range in the IP pool confines source port allocation to a specified range, accommodating applications that expect particular ports.

Option D is incorrect because a VIP is for destination NAT, not source NAT, and does not address source port modification. Option E is incorrect because enabling NAT on the policy would translate all traffic, not protect specific applications.

Exam trap

The trap is that candidates may believe only disabling NAT (Option A) can protect applications, overlooking that a dedicated IP pool with a fixed port range (Options B and C) can also preserve application behavior by controlling source port allocation. Additionally, some might incorrectly assume that a VIP (Option D) or simply enabling NAT (Option E) would address the issue.

Practice this question →
45
MCQmedium

A network admin runs 'diag sys session filter proto 6' and 'diag sys session list' and sees many sessions with state 'SYN_SENT' to a public web server. The firewall policy allows TCP/443. What is the MOST likely cause?

A.The web server is overloaded and dropping connections
B.The policy is in proxy mode but should be flow mode
C.The destination NAT (VIP) for the web server is not configured
D.The firewall policy has session TTL set too low
AnswerC

The destination NAT (VIP) is the critical missing element in this scenario. When a client sends a TCP SYN to the web server's public IP, the FortiGate must use a matching VIP to translate that destination to the server's private IP address; without it, the firewall has no next hop or internal server to forward the packet to. As a result, the SYN is dropped or consumed by the firewall itself, the server never receives the request, and the client's session stays in SYN_SENT.

Why this answer

The 'diag sys session filter proto 6' command filters for TCP sessions (protocol 6). Seeing many sessions stuck in 'SYN_SENT' state indicates that the FortiGate is sending SYN packets to the destination but never receiving a SYN-ACK reply. Since the firewall policy allows TCP/443, the most likely cause is that the destination NAT (VIP) for the public web server is not configured.

Without a VIP, the FortiGate forwards the packet with the original destination IP (the public IP), which may not be routable or may not exist on the internal network, causing the SYN to be sent into a black hole.

Exam trap

The trap here is that candidates assume 'SYN_SENT' always indicates a server-side issue (like overload or firewall blocking), but in FortiGate diagnostics, it specifically points to a missing or misconfigured destination NAT when the destination is a public IP that must be translated to an internal server.

How to eliminate wrong answers

Option A is wrong because an overloaded web server would typically respond with a SYN-ACK or RST, not cause the FortiGate to see endless 'SYN_SENT' states; the server would still complete the TCP handshake or reject the connection. Option B is wrong because proxy mode vs. flow mode affects how the firewall processes traffic (e.g., deep inspection), but it does not cause sessions to remain in 'SYN_SENT' state; that state indicates a failure in the TCP handshake at the network layer. Option D is wrong because a low session TTL would cause sessions to expire prematurely, not prevent the initial SYN-ACK from being received; 'SYN_SENT' means the handshake never completed, not that it was terminated early.

Practice this question →
46
MCQeasy

Which statement best describes the 'implicit deny' policy on a FortiGate?

A.It can be moved to a different position in the policy list
B.It is automatically applied to all traffic that does not match any explicit policy
C.It is a configurable policy that denies all traffic
D.It logs all denied traffic by default
AnswerB

Any traffic not matched by a higher-priority allow policy is denied by the implicit deny.

Why this answer

The 'implicit deny' policy on a FortiGate is a built-in, last-resort rule that automatically denies any traffic not matching an explicit firewall policy. It is not visible in the policy list and cannot be moved, modified, or deleted; it is always applied as the final rule to ensure that only explicitly permitted traffic is allowed through the FortiGate.

Exam trap

The trap here is that candidates often confuse the implicit deny with a configurable policy, thinking it can be moved, logged, or modified, when in fact it is a fixed, non-configurable default rule that is always present and never logs traffic by default.

How to eliminate wrong answers

Option A is wrong because the implicit deny policy is not a movable entry in the policy list; it is a fixed, invisible rule that always resides at the bottom of the policy evaluation order. Option C is wrong because the implicit deny is not configurable — it is a hardcoded default behavior that cannot be edited or removed. Option D is wrong because the implicit deny does not log denied traffic by default; logging must be explicitly enabled on an explicit deny policy or via global logging settings.

Practice this question →
47
MCQhard

A FortiGate with multiple WAN interfaces uses policy-based routing (PBR) to route traffic from subnet 10.0.0.0/24 through port1 and 10.0.1.0/24 through port2. However, traffic from 10.0.0.0/24 is still using port2. The PBR rule appears correctly configured. What is the MOST likely issue?

A.The source subnet in the PBR rule is incorrectly specified as 10.0.1.0/24
B.The firewall policy for that traffic has a route override setting that bypasses PBR
C.The static route for 0.0.0.0/0 has a higher administrative distance than the PBR rule
D.The PBR rule has a higher priority number than other rules
AnswerB

If the policy has an explicit route override (like setting the outgoing interface), it will bypass PBR. Disabling route override allows PBR to work.

Why this answer

The 'route override' setting in a firewall policy allows the FortiGate to ignore policy-based routing (PBR) rules for matching traffic. When enabled, the firewall policy uses the routing table (e.g., static or dynamic routes) instead of PBR, which explains why traffic from 10.0.0.0/24 is still using port2 despite a correctly configured PBR rule. This is a common misconfiguration where PBR appears correct but is overridden by the firewall policy's route override option.

Exam trap

The trap here is that candidates often assume PBR always takes precedence over static routes, but FortiGate's firewall policy 'route override' setting can silently bypass PBR, making it a hidden pitfall in multi-WAN configurations.

How to eliminate wrong answers

Option A is wrong because if the source subnet in the PBR rule were incorrectly specified as 10.0.1.0/24, traffic from 10.0.0.0/24 would not match the PBR rule at all, but the question states the PBR rule appears correctly configured, and the issue is that traffic is using port2 instead of port1, implying the rule exists but is being bypassed. Option C is wrong because administrative distance applies to static routes versus dynamic routes, not to PBR; PBR has a higher priority than static routes by default, and a static route's administrative distance does not affect whether PBR is applied. Option D is wrong because a higher priority number in PBR means lower priority (lower numbers are evaluated first), so a higher priority number would not cause the rule to be ignored; it would simply be evaluated later, but the rule would still apply if matched.

Practice this question →
48
MCQeasy

A FortiGate administrator configures a firewall policy to allow HTTP traffic from internal users to the internet. The policy uses source address 'internal_subnet', destination address 'all', and service 'HTTP'. After applying the policy, users report they cannot access websites. What is the most likely cause?

A.The source interface is misconfigured
B.The destination address object 'all' is incorrect
C.The policy order is incorrect and a deny policy above is blocking the traffic
D.The policy only allows HTTP (port 80), but users are likely accessing HTTPS (port 443)
AnswerD

A common oversight: the policy only permits port 80, but most websites use HTTPS on port 443.

Why this answer

The policy explicitly allows HTTP (TCP port 80), but modern web traffic predominantly uses HTTPS (TCP port 443). Since the service object does not include HTTPS, the firewall will drop HTTPS packets by default unless a separate policy or rule permits them. This is the most likely reason users cannot access websites, as most sites redirect HTTP to HTTPS or require HTTPS for secure connections.

Exam trap

The trap here is that candidates assume 'HTTP' covers all web traffic, but FortiGate treats HTTP and HTTPS as distinct services based on port numbers, and the implicit deny will block any unmatched traffic.

How to eliminate wrong answers

Option A is wrong because the source interface misconfiguration would typically cause a complete lack of connectivity for all traffic from that interface, not just web browsing, and the policy would not match at all. Option B is wrong because the destination address object 'all' is a valid FortiGate object that represents any destination IP address, and it is correct for allowing traffic to the internet. Option C is wrong because while policy order can affect traffic matching, the question states the policy was applied and there is no indication of a deny policy above; the most direct and common cause is the service mismatch.

Practice this question →
49
Multi-Selectmedium

A FortiGate admin wants to ensure that traffic from the internal network (192.168.1.0/24) to the internet uses a specific public IP (203.0.113.10) for source NAT, and that the same public IP is also used for inbound connections to an internal web server (10.0.1.10) on port 443. Which TWO configurations are required? (Choose two.)

Select 2 answers
A.Configure an IP Pool with type Overload using 203.0.113.10
B.Configure a Virtual IP mapping 203.0.113.10:443 to 10.0.1.10:443
C.Create a firewall policy with source NAT enabled and the IP Pool selected
D.Configure Central SNAT with the same public IP
AnswersA, B

This provides source NAT for outbound traffic using the required public IP.

Why this answer

An IP Pool with type Overload allows multiple internal hosts to share a single public IP (203.0.113.10) for source NAT when traffic goes to the internet. This is the standard method for PAT (Port Address Translation) in FortiGate, enabling many-to-one NAT.

Exam trap

The trap here is that candidates often confuse IP Pools (for source NAT) with Virtual IPs (for destination NAT), or think that enabling source NAT in a policy alone is enough without configuring the IP Pool object.

Practice this question →
50
MCQmedium

An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?

A.Use an application control profile to restrict video streaming
B.Configure policy-based routing to shape traffic
C.Enable QoS on the interface and set the bandwidth limit
D.Create a traffic shaper and reference it in the firewall policy
AnswerD

Traffic shapers define bandwidth limits and are applied via policies.

Why this answer

Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.

Exam trap

The trap here is that candidates often confuse QoS interface settings (which limit all traffic on an interface) with traffic shapers (which limit specific traffic in a policy), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because an application control profile is used to identify and optionally block or allow applications, not to shape or limit bandwidth; it does not provide traffic shaping capabilities. Option B is wrong because policy-based routing (PBR) is used to route traffic based on source/destination or other attributes, not to shape or limit bandwidth; shaping is applied via traffic shapers in policies, not via routing decisions. Option C is wrong because enabling QoS on an interface sets a bandwidth limit for the entire interface, not for specific traffic types like video streaming; traffic shaping for specific applications requires a traffic shaper referenced in a firewall policy.

Practice this question →
51
Multi-Selecthard

A company needs to allow inbound HTTPS traffic from the internet to a web server behind the FortiGate. The public IP is 203.0.113.10, and the internal server is 192.168.1.10. The server must receive the original source IP of the client. Which THREE configurations are required to achieve this?

Select 3 answers
A.A firewall policy from WAN to DMZ allowing HTTPS traffic to the VIP
B.Disabling source NAT on the firewall policy (set nat enable disable)
C.A static route for 203.0.113.10 pointing to the ISP gateway
D.A Central SNAT policy to translate the source to the FortiGate's IP
E.A Virtual IP (VIP) mapping 203.0.113.10:443 to 192.168.1.10:443
AnswersA, B, E

The policy must permit the traffic to the VIP destination.

Why this answer

A firewall policy from WAN to DMZ is required to permit the inbound HTTPS traffic to the VIP. The policy must reference the VIP as the destination and allow HTTPS (TCP/443) to pass through the FortiGate.

Exam trap

The trap here is that candidates often think a static route for the public IP is needed, but the VIP is handled by the FortiGate's local routing, and the default route suffices for outbound traffic to the ISP.

Practice this question →
52
MCQmedium

A FortiGate administrator wants to ensure that traffic from the 192.168.1.0/24 network to the internet is translated to a single public IP address using overload (PAT). Which NAT configuration should be used?

A.Policy-based NAT with a fixed port range
B.One-to-one NAT IP Pool
C.Virtual IP (VIP) with port forwarding
D.Central SNAT with a dynamic IP pool using overload
AnswerD

Central SNAT with a dynamic IP pool using overload is the correct approach because it implements many-to-one Source NAT: the FortiGate dynamically selects a public IP from the pool and rewrites each internal source IP to that public IP while also changing the source port to a unique value, enabling thousands of internal connections to share a single public address. Central NAT is the recommended method for outbound internet traffic because it cleanly separates NAT configuration from firewall policies and directly supports overload/PAT, matching the requirement for general internet egress.

Why this answer

Central SNAT with a dynamic IP pool using overload (PAT) is the correct method to translate all traffic from the 192.168.1.0/24 network to a single public IP address. The 'overload' option enables port address translation (PAT), allowing multiple internal hosts to share one public IP by using unique source port numbers, which is exactly what the administrator needs for internet-bound traffic.

Exam trap

The trap here is that candidates often confuse 'one-to-one NAT' (Option B) with PAT, thinking it can overload a single IP, but one-to-one NAT requires a dedicated public IP per internal host and does not perform port translation.

How to eliminate wrong answers

Option A is wrong because policy-based NAT with a fixed port range restricts the number of concurrent translations to the size of the port range, which would not allow all hosts in the /24 network to share a single IP efficiently and could exhaust ports quickly. Option B is wrong because one-to-one NAT IP Pool maps each internal IP to a unique public IP, requiring multiple public IPs and not supporting overload (PAT) to share a single IP. Option C is wrong because Virtual IP (VIP) with port forwarding is used for inbound destination NAT (port forwarding) to internal servers, not for outbound source NAT with overload to a single public IP.

Practice this question →
53
MCQmedium

A FortiGate administrator wants to ensure that traffic from the internal network to an external FTP server uses a specific source IP address (203.0.113.10). The internal network uses RFC 1918 addresses. Which NAT configuration should be used?

A.Policy-based NAT using an IP pool set to 'Fixed Port Range'
B.Virtual IP (VIP) mapping the internal server to 203.0.113.10
C.Central SNAT with dynamic IP pool
D.Policy-based NAT using an IP pool with type 'Overload' and the IP address 203.0.113.10
AnswerD

Policy-based NAT with an IP pool of type Overload performs source NAT by translating the source address of all matching sessions to the single IP defined in the pool. Since the pool contains only 203.0.113.10, every outbound session from the internal server will appear to originate from that exact IP using PAT (port address translation). This directly meets the requirement of ensuring all traffic from the server uses 203.0.113.10 as the source IP.

Why this answer

Policy-based NAT with an IP pool type 'Overload' (PAT) allows multiple internal hosts to share the single public IP 203.0.113.10 for outbound traffic. This meets the requirement to translate RFC 1918 source addresses to a specific source IP when accessing an external FTP server, while preserving port multiplexing.

Exam trap

The trap here is confusing VIP (inbound destination NAT) with source NAT (SNAT), leading candidates to select Option B, even though the requirement is for outbound traffic from internal clients to use a specific source IP.

How to eliminate wrong answers

Option A is wrong because 'Fixed Port Range' IP pools are used for static port allocation, typically for protocols that require predictable ports (e.g., SIP), not for general outbound source NAT with a single IP. Option B is wrong because a Virtual IP (VIP) is used for inbound destination NAT (port forwarding) to map an external IP to an internal server, not for outbound source NAT from internal clients. Option C is wrong because Central SNAT with a dynamic IP pool would select from a range of IPs, not guarantee the specific source IP 203.0.113.10.

Practice this question →
54
MCQmedium

An administrator creates a firewall policy with a traffic shaper to limit bandwidth for guest wireless users. After applying the policy, users can still consume high bandwidth. The administrator confirms the policy is matching. What is the MOST likely reason the traffic shaper is not effective?

A.The traffic shaper's maximum bandwidth is set too high
B.The traffic shaper is applied to the wrong direction (egress vs ingress)
C.The traffic shaper is configured but not applied to the policy's 'Traffic Shaper' field
D.The traffic shaper is a per-IP shaper but the policy applies to a subnet
AnswerC

FortiGate traffic shapers are objects that must be explicitly referenced in a firewall policy; simply creating a shaper under Traffic Shaping does not cause any policy to use it. The firewall policy's 'Traffic Shaper' field and 'Per-IP Shaper' field both default to 'None', which means traffic matching the policy is forwarded with no bandwidth limitation. To enforce a shaping rule, the administrator must select the desired shaper in that drop-down field. When the shaper is left unassigned, the policy passes traffic at full interface speed, perfectly explaining the 'high bandwidth consumption' symptom.

Why this answer

In FortiGate, a traffic shaper must be explicitly selected in the 'Traffic Shaper' field of the firewall policy to be applied. Simply creating a shaper and configuring it is insufficient; the policy's shaper field links the shaper to the traffic. Without this link, the shaper is not enforced, even if the policy matches.

Exam trap

The trap here is that candidates assume creating a traffic shaper automatically applies it to all matching traffic, but FortiGate requires explicit assignment in the firewall policy's shaper field to enforce the limit.

How to eliminate wrong answers

Option A is wrong because setting the maximum bandwidth too high would still limit bandwidth, just at a higher threshold; it would not cause the shaper to be completely ineffective. Option B is wrong because traffic shapers in FortiGate are applied per policy and control both ingress and egress directions based on the shaper type (e.g., per-policy shaper applies to both directions); direction misconfiguration would not render the shaper entirely ineffective. Option D is wrong because a per-IP shaper applied to a subnet is valid and would limit each individual IP's bandwidth; it would not cause the shaper to be ineffective.

Practice this question →
55
MCQhard

A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?

A.Policy ID 2 because it matches the source and service
B.Both policies, and the traffic is load-balanced
C.No policy matches, traffic is denied by implicit deny
D.Policy ID 1 because it is first in order and matches the service HTTP
AnswerA

Policy ID 2 matches source and service.

Why this answer

Policy ID 2 matches because the source IP 10.0.1.50 falls within the 10.0.1.0/24 subnet, and the service is set to ALL, which includes HTTP. FortiGate uses a top-down policy lookup and selects the first match based on source, destination, and service; since Policy ID 2 matches all criteria, it is applied.

Exam trap

The trap here is that candidates assume the first policy in the list always matches if the service is HTTP, ignoring that the source must also match; FortiGate requires all conditions to be met for a policy to apply.

How to eliminate wrong answers

Option B is wrong because FortiGate does not load-balance traffic across multiple matching policies; it uses a first-match logic, so only one policy is selected. Option C is wrong because a matching policy exists (ID 2), so traffic is not denied by the implicit deny rule. Option D is wrong because Policy ID 1 does not match the source (10.0.1.50 is not in 10.0.0.0/24), so it is skipped even though it is first in order.

Practice this question →
56
MCQmedium

An admin wants to block all traffic from a specific geographic region. Which address object type should be used in the firewall policy source?

A.FQDN
B.Subnet
C.IP range
D.Geography
AnswerD

Geography objects use IP geolocation to match traffic from specific countries.

Why this answer

FortiGate firewalls include a built-in Geography address object type that allows policies to match traffic based on the source or destination IP address's registered country or region. This object uses GeoIP databases to classify IP addresses, enabling administrators to block or allow traffic from entire geographic areas without needing to manually list individual subnets or ranges.

Exam trap

The trap here is that candidates may confuse Geography with IP range or subnet, thinking they can manually compile a list of all IPs for a region, but FortiGate's Geography object automates this via the GeoIP database and is the correct, scalable approach for geographic blocking.

How to eliminate wrong answers

Option A is wrong because FQDN (Fully Qualified Domain Name) objects resolve to IP addresses via DNS and are used for policies based on domain names, not geographic location. Option B is wrong because a Subnet object defines a contiguous block of IP addresses using a network prefix (e.g., 192.168.1.0/24) and cannot represent an entire geographic region. Option C is wrong because an IP range object specifies a start and end IP address (e.g., 10.0.0.1-10.0.0.255) and is intended for arbitrary address ranges, not for geographic classification.

Practice this question →
57
MCQmedium

A company has a web server in the DMZ that needs to be accessible from the internet on port 443 (HTTPS). The administrator configures a Virtual IP (VIP) mapping the public IP 203.0.113.10 to the private IP 10.0.1.10 port 443. Which firewall policy is required to allow inbound traffic?

A.A policy from WAN to DMZ with source any, destination IP of the server (10.0.1.10), and action ACCEPT
B.A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT
C.No firewall policy is needed; the VIP automatically allows traffic
D.A policy from DMZ to WAN with source VIP, destination any, and action ACCEPT
AnswerB

This is the correct way to publish a server. The VIP object defines the public-to-private IP mapping, and the policy uses that VIP as the destination to explicitly allow inbound traffic. After the policy is matched, FortiOS performs destination NAT, replacing the VIP IP with the server's private IP and forwarding the packet to the DMZ. This ensures that all traffic is inspected and controlled by the firewall.

Why this answer

When a Virtual IP (VIP) is configured in FortiGate, the firewall policy must reference the VIP object as the destination, not the actual private IP. The VIP translates the public IP (203.0.113.10) to the private IP (10.0.1.10), and the policy from WAN to DMZ with destination VIP ensures that inbound traffic is matched and permitted before NAT translation occurs. Without this policy, the VIP alone does not allow traffic; it only defines the translation rule.

Exam trap

The trap here is that candidates often assume a VIP automatically permits traffic or that the policy should use the private IP, but FortiGate requires an explicit firewall policy referencing the VIP object to allow inbound traffic through the NAT mapping.

How to eliminate wrong answers

Option A is wrong because the policy must use the VIP object as the destination, not the actual private IP (10.0.1.10); referencing the private IP bypasses the NAT translation and will not match the incoming traffic destined to the public IP. Option C is wrong because a VIP does not automatically allow traffic; it only defines the NAT mapping, and a corresponding firewall policy with action ACCEPT is mandatory to permit the traffic. Option D is wrong because the required policy must be from WAN to DMZ (inbound direction), not from DMZ to WAN; the DMZ-to-WAN policy would control outbound responses, not the initial inbound connection.

Practice this question →
58
MCQmedium

A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?

A.Create an IP pool with the external IP and reference it in the firewall policy
B.Enable NAT on the firewall policy without specifying an IP pool
C.Create a VIP for the web server and reference it in the firewall policy
D.Configure Central SNAT and a matching rule
AnswerB

When you enable NAT on a firewall policy and leave the IP pool field blank, FortiOS performs source NAT using the primary IP address of the egress interface—here, 198.51.100.1. This is the simplest and most common method for enabling internet access from a private network, as it requires no separate NAT objects or additional configuration. The NAT action is directly part of the policy, exactly matching the scenario's request to apply NAT to the policy itself.

Why this answer

When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.

Exam trap

The trap here is that candidates often confuse source NAT with destination NAT and incorrectly select a VIP (option C), or they overcomplicate the scenario by assuming an IP pool is always required for NAT, when in fact the default interface NAT is sufficient when the goal is to use the FortiGate's own external IP.

How to eliminate wrong answers

Option A is wrong because creating an IP pool is necessary only when you need to translate to a specific IP address that is not the egress interface IP, or when you need to use a range of IPs (e.g., for load balancing or hiding many internal hosts behind a smaller set of public IPs). Here, the requirement is to use the FortiGate's own external IP, which is the default behavior when NAT is enabled without a pool. Option C is wrong because a Virtual IP (VIP) is used for destination NAT (DNAT), i.e., translating an incoming public IP to an internal private IP, not for source NAT.

The question asks for source NAT, so a VIP is irrelevant. Option D is wrong because Central SNAT is an alternative method for configuring source NAT, but it is not required; the question does not specify a need for central NAT management, and the standard policy-based NAT (enabling NAT on the policy) is the simplest and correct approach for this scenario.

Practice this question →
59
MCQmedium

A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?

A.The traffic is in a different VDOM than the policy
B.The internet-facing interface is not part of any VDOM
C.The subnet object is defined in the wrong address group
D.The policy is placed at the bottom of the list
AnswerA

Each VDOM on a FortiGate operates as an independent virtual firewall with its own routing table, policy set, and interface associations. A firewall policy configured in the root VDOM only examines traffic whose ingress and egress interfaces belong to that same VDOM. If the traffic flows through interfaces assigned to VDOM2, the root policy is never evaluated, so the traffic is instead subject to VDOM2's own policy list, and the mismatch explains why the policy has no effect.

Why this answer

In a multi-VDOM FortiGate, each VDOM operates as an independent virtual firewall with its own routing table, policies, and interfaces. A firewall policy created in the root VDOM only applies to traffic that enters and exits interfaces assigned to that root VDOM. If the traffic originates from or is destined to an interface belonging to a different VDOM, it will never match the root VDOM policy, causing the traffic to be dropped or handled by the correct VDOM's policies.

Exam trap

The trap here is that candidates assume a policy in the root VDOM applies to all traffic by default, not realizing that VDOMs create strict administrative boundaries where policies are only effective within their own VDOM.

How to eliminate wrong answers

Option B is wrong because an internet-facing interface must be assigned to a VDOM to function; unassigned interfaces are not operational and cannot pass traffic. Option C is wrong because even if the subnet object is in the wrong address group, the policy would still match if the source IP falls within the defined subnet range; the issue is VDOM isolation, not address group membership. Option D is wrong because policy order only matters within the same VDOM; a policy at the bottom of the list in the root VDOM would still match traffic that belongs to the root VDOM, but it cannot match traffic from a different VDOM regardless of its position.

Practice this question →
60
MCQmedium

An administrator wants to ensure that traffic from the engineering department (subnet 192.168.10.0/24) to the internet uses a specific public IP address for source NAT. Additionally, traffic from the marketing department (192.168.20.0/24) should use a different public IP. Which method should be used?

A.Configure a single Central SNAT rule with multiple source subnets and a single IP pool
B.Create two firewall policies, each with its own IP pool, for the respective subnets
C.Use VIP for source NAT
D.Use a single policy with a dynamic IP pool that randomly assigns IPs
AnswerB

This allows granular control over which IP is used for each subnet.

Why this answer

The requirement is to map specific source subnets to different public IP addresses. In FortiGate, this is achieved by creating separate firewall policies for each subnet, each with its own IP pool configured for source NAT. A single Central SNAT rule with one IP pool cannot differentiate between subnets to assign different public IPs.

Exam trap

The trap here is that candidates often confuse IP pools (used for source NAT) with Virtual IPs (used for destination NAT), leading them to incorrectly select VIP for source NAT.

How to eliminate wrong answers

Option A is wrong because a single Central SNAT rule with one IP pool would apply the same public IP to all traffic matching the rule, regardless of source subnet, failing to meet the requirement for different public IPs per department. Option C is wrong because Virtual IP (VIP) is used for destination NAT (port forwarding), not source NAT; it translates incoming traffic's destination, not outgoing traffic's source. Option D is wrong because a dynamic IP pool randomly assigns IPs from a range, which does not guarantee that traffic from engineering always uses one specific public IP and marketing uses another; it would mix them.

Practice this question →
61
Multi-Selectmedium

A FortiGate admin is troubleshooting an issue where traffic from a specific internal host (10.0.1.50) to the internet is not being NATed as expected. The firewall policy has NAT enabled with an IP pool of type Overload. Which TWO conditions could cause the traffic to bypass the IP pool?

Select 2 answers
A.The firewall policy's NAT setting is set to 'disable'
B.The IP pool is configured for one-to-one NAT
C.The internal host is using a non-standard source port
D.A policy with a lower policy ID matches the traffic and has NAT enabled with a different IP pool or no pool
E.The IP pool is configured with a source filter that does not include 10.0.1.50
AnswersD, E

Policy matching stops at the first match; if a higher-priority policy matches, the intended policy is not evaluated.

Why this answer

FortiGate processes firewall policies in sequential order based on policy ID. If a policy with a lower ID matches the traffic and has NAT enabled with a different IP pool (or no pool), that policy will be applied first, causing the traffic to bypass the intended IP pool. Option E is correct because an IP pool of type Overload uses a source filter to determine which source addresses are eligible for NAT; if 10.0.1.50 is not included in that filter, the traffic will not use the pool.

Exam trap

The trap here is that candidates often overlook the sequential policy matching order and the source filter requirement, assuming that enabling NAT on a policy with an IP pool guarantees its use for all matching traffic.

Practice this question →
62
MCQeasy

Which statement best describes the implicit deny policy at the end of a FortiGate policy list?

A.It denies all traffic that does not match any explicit policy, and it logs the denied traffic
B.It can be moved to a different position in the policy list
C.It can be disabled or deleted by the admin
D.It is always present and denies any traffic that does not match an explicit allow policy
AnswerD

The implicit deny is always present as the last effective rule in the FortiGate policy list, regardless of how many explicit policies are configured. Any traffic that does not match an explicit allow policy is dropped by this default rule, ensuring that all unmatched packets are blocked. This is a mandatory security control that cannot be removed or repositioned, providing a safe default deny posture.

Why this answer

The implicit deny policy is a built-in, last-resort rule at the bottom of the FortiGate policy list that silently drops any traffic not matching an explicit allow policy. It cannot be moved, disabled, or deleted because it is a fundamental security mechanism ensuring that only explicitly permitted traffic is allowed through the firewall.

Exam trap

The trap here is that candidates often think the implicit deny can be configured or removed like an explicit policy, but FortiGate enforces it as an unchangeable, always-present rule that cannot be logged or repositioned.

How to eliminate wrong answers

Option A is wrong because the implicit deny policy does not log denied traffic by default; logging must be explicitly configured on an explicit deny policy. Option B is wrong because the implicit deny policy is fixed at the very end of the policy list and cannot be repositioned. Option C is wrong because the implicit deny policy is a permanent, non-removable safeguard that cannot be disabled or deleted by the administrator.

Practice this question →
63
MCQeasy

A FortiGate administrator needs to ensure that all internal users (10.0.0.0/8) accessing the internet use a single public IP address 203.0.113.10 for source NAT. Which NAT configuration should be used?

A.Create a Central SNAT rule with a Dynamic IP Pool using overload
B.Enable NAT on the outgoing interface policy without an IP pool
C.Create a policy-based NAT rule with fixed port range
D.Configure a VIP with port forwarding
AnswerA

A Central SNAT rule with a Dynamic IP Pool in overload mode references a configured pool of public addresses and applies source network address translation independently of firewall policies. Overload (PAT) creates a unique mapping of internal IP:port to the selected public IP:port, allowing many internal users to share a single public address. This is the appropriate method when the required public IP is not the interface IP and must be shared by all internal clients.

Why this answer

Central SNAT with a Dynamic IP Pool using overload (Port Address Translation) allows all internal users in 10.0.0.0/8 to share a single public IP (203.0.113.10) by dynamically mapping multiple private source IPs and ports to unique source ports on the public IP. This is the standard method for many-to-one NAT, ensuring all outbound internet traffic appears from the same public address.

Exam trap

The trap here is that candidates often confuse enabling NAT on the interface policy (Option B) with using a specific IP pool, not realizing that interface NAT uses the interface's own IP and cannot force a different public address without an explicit IP pool.

How to eliminate wrong answers

Option B is wrong because enabling NAT on the outgoing interface policy without an IP pool uses the interface's own IP address (typically the WAN IP) for source NAT, not a specific public IP like 203.0.113.10, and may not guarantee a single IP if the interface has multiple addresses. Option C is wrong because a policy-based NAT rule with fixed port range would restrict the number of concurrent sessions to the size of the port range, causing connection failures under load, and is not designed for many-to-one overload NAT. Option D is wrong because a VIP with port forwarding is used for inbound destination NAT (port mapping to internal servers), not for outbound source NAT from internal users to the internet.

Practice this question →
64
MCQmedium

A network administrator configures a firewall policy allowing HTTP traffic from the internal network (10.0.0.0/8) to the internet. After applying the policy, users report they can browse the web, but the FortiGate logs show that all sessions are using the 'implicit deny' policy ID 0. What is the most likely cause?

A.The source interface on the policy is set to the WAN interface instead of the internal interface
B.Central NAT is enabled and overriding the policy-based NAT
C.The policy has a schedule applied that is currently inactive
D.The policy is placed after the implicit deny rule
AnswerA

If the source interface is wrong, the traffic will not match this policy. The administrator may have a different policy (or the implicit allow) allowing the traffic, but the logs show the implicit deny is being hit because the correct policy is not matched.

Why this answer

If the source interface on the firewall policy is set to the WAN interface instead of the internal interface, traffic arriving from the internal network (10.0.0.0/8) on the internal interface will not match that policy. The FortiGate then falls through to the implicit deny policy (ID 0), which logs and drops the session. Since HTTP traffic is still reaching the internet, it suggests that another mechanism (such as a default route or NAT) is allowing the traffic, but the policy matching fails due to the interface mismatch.

Exam trap

The trap here is that candidates assume a policy with correct source/destination addresses will match regardless of the interface setting, but FortiOS strictly enforces interface matching, and a mismatch causes the policy to be ignored, leading to the implicit deny being hit.

How to eliminate wrong answers

Option B is wrong because Central NAT (centralized NAT policies) does not cause the implicit deny policy to be used; it only affects how NAT is applied, not the firewall policy matching itself. Option C is wrong because an inactive schedule would cause the policy to not match, but the logs would show the policy ID of the scheduled policy (not ID 0) if it were present, and the traffic would still be denied by the implicit deny; however, the question states users can browse the web, which would not happen if the only applicable policy had an inactive schedule. Option D is wrong because the implicit deny rule is always the last rule in the policy list; a policy placed after it is impossible in FortiOS, as the implicit deny is a built-in rule that cannot be reordered.

Practice this question →
65
MCQhard

A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?

A.The FortiGate is using a proxy server that caches different results for different users
B.The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent
C.The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing
D.Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic
AnswerD

This is the correct answer because FortiGate firewall policies are matched in order of policy ID (and any explicit sequencing), and the first matching policy is enforced. If a higher-priority policy (lower policy ID) matches certain users' traffic (e.g., based on source IP, user group, or interface) and that policy lacks a web filter profile, those users bypass the intended filtering entirely, while others match the intended lower-priority policy that has the restrictive web filter profile.

Why this answer

When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.

Exam trap

The trap here is that candidates assume all traffic from the same subnet is treated identically, overlooking that FortiGate policy matching is first-match and can differentiate based on other attributes like source port or user identity, leading to inconsistent profile application.

How to eliminate wrong answers

Option A is wrong because FortiGate does not use an external proxy server for web filtering by default; it uses local proxy-based inspection or flow-based inspection, and caching is not a factor in inconsistent web filter results. Option B is wrong because FortiGuard ratings are consistent per URL and do not vary per user; if the rating is inconsistent, it would affect all users equally, not selectively. Option C is wrong because FQDN resolution in firewall policies is performed by the FortiGate itself, not per user; DNS load balancing would return different IPs to the FortiGate, but the FortiGate resolves the FQDN once and uses that single IP for policy matching, so it cannot cause per-user differences.

Practice this question →
66
MCQeasy

Which of the following statements about FortiGate policy lookup order is correct?

A.Policies are evaluated from top to bottom, and the first matching policy is used
B.Policies are evaluated based on a priority number assigned to each policy
C.Policies are evaluated from bottom to top, and the last matching policy is used
D.Policies are evaluated randomly to balance load
AnswerA

FortiGate firewall policies are evaluated sequentially from the top of the policy list. The first policy whose source, destination, service, and other matching criteria align with the session's attributes is selected and enforced. Because evaluation stops at the first match, placing more specific rules above broader ones is critical for proper traffic control.

Why this answer

FortiGate uses a top-down sequential search for policy matching. When a packet arrives, the firewall starts at the top of the policy list and evaluates each policy in order until it finds one where all configured criteria (source, destination, service, schedule, etc.) match. The first matching policy is then applied, and no further policies are checked.

This is the fundamental behavior of FortiGate's firewall policy lookup.

Exam trap

The trap here is that candidates often confuse FortiGate's sequential top-down evaluation with other firewall platforms (like Cisco ASA) that use a priority-based or implicit-rule model, leading them to incorrectly select Option B or C.

How to eliminate wrong answers

Option B is wrong because FortiGate does not assign a numeric priority to each policy; the order in the policy list (sequence number) determines the evaluation order, not a separate priority field. Option C is wrong because FortiGate evaluates policies from top to bottom, not bottom to top; the last matching policy would never be used unless it is the first match from the top. Option D is wrong because FortiGate does not use random selection for policy matching; it strictly follows the sequential top-down order to ensure deterministic and predictable traffic handling.

Practice this question →
67
MCQeasy

Which of the following best describes a Virtual IP (VIP) in FortiGate?

A.A method to translate a public IP/port to a private IP/port for inbound traffic
B.A method to translate private source IPs to a public IP for outbound traffic
C.A method to group multiple firewall policies
D.A method to load balance traffic across multiple WAN interfaces
AnswerA

VIP maps external (public) addresses to internal (private) destinations, enabling inbound access.

Why this answer

A Virtual IP (VIP) in FortiGate is used for Destination NAT (DNAT), translating an incoming public IP address and port to a private IP address and port. This allows external hosts to access internal servers (e.g., web servers) using a public IP, while the server remains on a private RFC 1918 address. The VIP object is referenced in a firewall policy to permit the inbound traffic and perform the translation.

Exam trap

The trap here is confusing Virtual IP (Destination NAT) with IP Pool (Source NAT), as both involve address translation but serve opposite traffic directions; candidates often pick Option B thinking VIP is for outbound translation.

How to eliminate wrong answers

Option B is wrong because it describes Source NAT (SNAT) or IP Pool, not a Virtual IP; SNAT translates private source IPs to a public IP for outbound traffic. Option C is wrong because grouping multiple firewall policies is done using policy packages or policy groups, not a Virtual IP. Option D is wrong because load balancing traffic across multiple WAN interfaces is achieved using SD-WAN or ECMP routing, not a Virtual IP; VIPs can be used for server load balancing (SLB) but not for balancing across WAN interfaces.

Practice this question →
68
MCQhard

An administrator configures a firewall policy with a schedule object that is set to 'Available: Mon-Fri 09:00-17:00'. At 10:00 AM on Saturday, users report they cannot access the resource. The administrator checks the policy list and sees the policy is enabled. What is the MOST likely reason?

A.The FortiGate's system time is incorrect
B.A deny policy with higher priority is blocking the traffic
C.The schedule object is not correctly applied to the policy
D.The schedule object only allows traffic on weekdays, and Saturday is not included
AnswerD

The schedule object defined as 'Mon-Fri 09:00-17:00' explicitly restricts allowed days to Monday through Friday. On Saturday, the current time falls outside the schedule's active period, so the policy's schedule condition is not met. Consequently, the FortiGate skips this policy and evaluates subsequent policies, eventually hitting the implicit deny rule that drops the traffic. This is a standard behavior: a firewall policy with a time-based schedule is inactive outside its defined window.

Why this answer

The schedule object is configured to allow traffic only from Monday to Friday, 09:00-17:00. Since Saturday is outside this range, the firewall policy will deny or not match the traffic, even though the policy is enabled. This is the most direct and likely reason for the access failure.

Exam trap

The trap here is that candidates may overlook the schedule's day-of-week restriction and assume the policy is simply 'enabled' means it should work, failing to recognize that a schedule object can limit traffic to specific days and times, making the policy inactive outside those windows.

How to eliminate wrong answers

Option A is wrong because an incorrect system time would affect all schedule-based policies, but the issue is specifically tied to the day of the week (Saturday), not a time drift; moreover, the administrator would likely notice other time-related anomalies. Option B is wrong because a deny policy with higher priority would block traffic regardless of the schedule, but the question states the policy is enabled and the schedule is the only configured restriction; there is no indication of a conflicting deny rule. Option C is wrong because the schedule object is correctly applied to the policy (the administrator sees the policy in the list with the schedule), and the issue is that the schedule itself does not include Saturday, not that it is misapplied.

Practice this question →
69
MCQhard

A FortiGate has policy-based NAT enabled. The admin wants to translate the source IP of internal users to the interface IP for internet traffic. The firewall policy has NAT enabled. However, traffic from the internal network to the internet shows the original source IP instead of the interface IP. What is the MOST likely reason?

A.Central NAT is enabled and overrides the per-policy NAT setting
B.The destination is a VIP that disables NAT
C.The NGFW mode is set to profile-based
D.The policy is configured in proxy inspection mode
AnswerA

Central NAT is enabled and overrides the per-policy NAT setting. When central NAT is enabled in FortiOS, the per-policy NAT flag is ignored, and NAT is controlled exclusively by central NAT rules (source IP pools and destination VIPs). This means even if the policy shows NAT as enabled, the actual address translation is determined by the central NAT table, not the policy. Therefore, the admin would need to check the central NAT configuration to verify why NAT is not taking effect.

Why this answer

When policy-based NAT is enabled, the per-policy NAT setting should translate the source IP to the interface IP. However, if Central NAT is also enabled, it takes precedence and overrides the per-policy NAT configuration. Central NAT uses its own rules (e.g., IP pools) and can prevent the interface IP translation from being applied, leaving the original source IP unchanged.

Exam trap

The trap here is that candidates assume per-policy NAT always works when enabled, but FortiGate's Central NAT feature can silently override it, making it appear as if NAT is broken.

How to eliminate wrong answers

Option B is wrong because a VIP (Virtual IP) is used for destination NAT (port forwarding) and does not disable source NAT; in fact, VIPs often require source NAT to be enabled for return traffic. Option C is wrong because NGFW mode (profile-based vs. policy-based) affects inspection features like IPS and application control, not the NAT operation or precedence. Option D is wrong because proxy inspection mode changes how traffic is inspected (e.g., SSL inspection) but does not disable or override the per-policy NAT setting.

Practice this question →
70
MCQmedium

An administrator configures a firewall policy with a schedule that allows traffic only during business hours (Monday to Friday, 09:00-18:00). At 17:55 on a Friday, a user establishes an SSH session that is still active at 18:05. What happens to the session when the schedule ends?

A.The session is immediately terminated at 18:00
B.The session continues until it ends naturally
C.The session is allowed but new sessions are blocked
D.The session is terminated after a 60-second grace period
AnswerB

FortiGate does not interrupt established sessions when a schedule ends; the session remains active until it closes.

Why this answer

FortiGate firewall policies control the establishment of new sessions based on the schedule. Once a session is established, it is tracked in the session table and continues to be forwarded even if the schedule ends, until the session naturally terminates or times out. This behavior ensures that ongoing traffic is not abruptly disrupted when a schedule expires.

Exam trap

The trap here is that candidates assume schedules enforce a hard cutoff on all traffic, but FortiGate only applies schedules to new session initiation, not to already established sessions.

How to eliminate wrong answers

Option A is wrong because FortiGate does not immediately terminate active sessions when a schedule ends; it only blocks new session establishments. Option C is wrong because it describes the actual behavior (new sessions blocked, existing sessions continue), but the question asks what happens to the already active session, which continues until it ends naturally, not just 'allowed'—the session is not simply allowed; it continues without interruption. Option D is wrong because there is no 60-second grace period for session termination after a schedule ends; sessions persist based on their own idle timeout or until they finish naturally.

Practice this question →
71
MCQeasy

Which of the following is the default action of a FortiGate firewall policy if no policy matches the traffic?

A.Log and drop
B.Redirect to authentication
C.Accept
D.Deny
AnswerD

Traffic that does not match any policy is implicitly denied.

Why this answer

FortiGate firewall policies operate on a 'first-match' basis, and if no policy matches the traffic, the default action is to deny the traffic. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall. The implicit deny rule is automatically applied at the end of the policy list and cannot be removed or modified.

Exam trap

The trap here is that candidates may confuse the default action of a firewall with the default action of a router (which forwards traffic) or assume that FortiGate logs all denied traffic by default, but neither is true; the implicit deny is silent unless explicitly configured to log.

How to eliminate wrong answers

Option A is wrong because 'Log and drop' is not a default action; logging is only performed if a policy explicitly enables logging, and the implicit deny does not generate logs by default. Option B is wrong because 'Redirect to authentication' is a feature of authentication policies or captive portal configurations, not the default action for unmatched traffic. Option C is wrong because 'Accept' would violate the security model of a firewall, which must block all traffic unless explicitly allowed; accepting unmatched traffic would create a security vulnerability.

Practice this question →
72
MCQmedium

A network administrator creates a firewall policy allowing HTTP traffic from the internal network to a web server in the DMZ. Users report that they cannot access the web server. The administrator runs 'diagnose firewall iprope list' and sees the policy is present. What is the MOST likely cause of the issue?

A.A deny policy with a lower policy ID is matching the traffic before the allow policy
B.The firewall policy has an incorrect source interface
C.The policy is disabled
D.The web server is not responding to HTTP requests
AnswerA

In FortiGate, policy matching uses a first-match model: the firewall processes rules in ascending policy ID order and stops at the first rule whose source, destination, and service match the session. If a deny policy with a lower ID (i.e., positioned earlier in the policy list) matches the same HTTP traffic as the intended allow policy, that deny will drop the packets and the allow policy will never be reached. This shadowing behavior is the most probable cause, and it can be confirmed by placing the allow rule above the deny or by comparing policy IDs in the `get firewall policy` output.

Why this answer

The 'diagnose firewall iprope list' command confirms the allow policy exists in the FortiGate's kernel policy list, meaning it is present and enabled. However, FortiGate evaluates policies in sequential order based on policy ID (lowest first), so a deny policy with a lower ID that matches the same traffic (e.g., from internal to DMZ) will be hit first, blocking the HTTP request before the allow policy can be evaluated. This is the most likely cause because the policy is present but not being matched due to ordering.

Exam trap

The trap here is that candidates assume 'policy is present' means it is working, but FortiGate's policy order (lowest ID first) means a lower-ID deny policy can override a higher-ID allow policy even if both match the same traffic.

How to eliminate wrong answers

Option B is wrong because an incorrect source interface would cause the policy not to match at all, but the 'diagnose firewall iprope list' output would not show the policy as present for that traffic flow; the administrator would see no matching entry. Option C is wrong because a disabled policy would not appear in the 'diagnose firewall iprope list' output at all, yet the administrator sees it present. Option D is wrong because the web server not responding would result in a timeout or connection reset, but the firewall would still allow the traffic (the policy would match), and the issue would be reported differently; the 'diagnose firewall iprope list' check would not be the first troubleshooting step for a server-side problem.

Practice this question →
73
MCQhard

A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?

A.The external server is rate-limiting connections
B.The firewall policy has a timeout setting that is too low
C.The IP pool has run out of IP addresses
D.The fixed port range is too small, causing port exhaustion
AnswerD

Fixed port range NAT assigns a block of ports to each source IP. If the range is small (e.g., 1 port), it fills quickly and blocks new sessions. The 'used_port=65535' indicates the last port in a range is in use.

Why this answer

The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.

Exam trap

The trap here is that candidates may confuse IP address exhaustion (Option C) with port exhaustion, but the diagnostic output clearly shows IP addresses are still available while ports are maxed out, pointing directly to the fixed port range being too small.

How to eliminate wrong answers

Option A is wrong because the external server rate-limiting would affect all users equally and would not cause the specific symptom of 'used_port=65535' entries in the IP pool list. Option B is wrong because a low firewall policy timeout would cause connections to be dropped prematurely, not prevent new connections from being established due to port exhaustion. Option C is wrong because the 'diagnose ip pool list' output shows many entries with 'used_port=65535', indicating that IP addresses are still available but all ports within the fixed range are in use, not that IP addresses have run out.

Practice this question →
74
MCQhard

An administrator is configuring a VIP to map a public IP to an internal server. The server hosts both HTTP and HTTPS services. The admin creates a VIP with port forwarding for port 80 to internal port 80, and another VIP for port 443 to internal port 443. Both VIPs use the same public IP. Users can access HTTP but not HTTPS. What is the most likely issue?

A.The firewall policy for HTTPS traffic is missing or has incorrect destination
B.The server's HTTPS service is not running
C.VIPs cannot share the same public IP address
D.The HTTPS VIP is configured with the wrong internal port
AnswerA

In FortiGate, VIPs only perform destination NAT; they do not implicitly permit traffic. A firewall policy must explicitly allow HTTPS traffic with the destination set to the VIP object, and the service must include HTTPS (or port 443). If the existing policy only allows HTTP to the same VIP, HTTPS packets are dropped due to no matching policy, so the connection never reaches the server.

Why this answer

The most likely issue is that the firewall policy for HTTPS traffic is missing or has an incorrect destination. Even with a correctly configured VIP, traffic must be allowed by a firewall policy that matches the destination (the VIP's public IP and port 443) and the action must be set to ACCEPT. Without this policy, the FortiGate will drop the HTTPS packets, while HTTP traffic works because its corresponding policy exists.

Exam trap

The trap here is that candidates assume a correctly configured VIP automatically allows traffic, but FortiGate requires an explicit firewall policy to permit the translated traffic, and the exam tests this separation of NAT and policy functions.

How to eliminate wrong answers

Option B is wrong because if the server's HTTPS service were not running, the admin would typically see connection refused or timeout errors, not a complete lack of access; the issue is at the firewall level, not the server. Option C is wrong because FortiGate VIPs can share the same public IP address as long as they use different ports (e.g., 80 and 443), which is a standard port-based VIP configuration. Option D is wrong because the admin explicitly configured the HTTPS VIP with internal port 443, which is correct for HTTPS; if the internal port were wrong, the traffic would reach the server but on the wrong port, causing a different failure mode.

Practice this question →
75
MCQhard

An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?

A.The VIP is configured with port forwarding and the server is expecting a different port
B.The VIP is using a different public IP than expected
C.The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP
D.The server's routing is misconfigured and traffic is returning via a different path
AnswerC

When the firewall policy matching the VIP traffic has NAT enabled, FortiGate replaces the original source IP with the IP of the egress interface used to forward the packet. This source NAT (SNAT) hides the client's real address, so the internal server logs show the FortiGate's interface IP as the connection source. This is the standard behavior, explaining why the admin observes the FortiGate IP instead of the client's public IP.

Why this answer

When a firewall policy has NAT enabled (typically 'Enable NAT' or 'Use Outgoing Interface Address'), the FortiGate performs source NAT (SNAT) on the traffic, replacing the original client source IP with the IP of its egress interface (the internal interface in this scenario). This is standard behavior for source NAT, which hides the original client IP from the internal server, causing the server logs to show the FortiGate's internal interface IP instead of the actual client IP.

Exam trap

The trap here is that candidates often assume NAT only applies to outbound traffic, but FortiGate policies apply NAT bidirectionally unless explicitly disabled, causing the source IP to be overwritten even for inbound VIP traffic.

How to eliminate wrong answers

Option A is wrong because port forwarding configuration on the VIP does not affect source IP preservation; it only translates destination ports, and the server expecting a different port would cause connectivity failure, not a source IP mismatch. Option B is wrong because using a different public IP than expected would result in the server not receiving traffic at all or traffic being dropped, not in the server seeing the FortiGate's internal IP as the source. Option D is wrong because misconfigured server routing causing asymmetric return traffic would typically lead to dropped connections or timeouts, not to the server logging the FortiGate's internal IP as the source; the source IP seen by the server is determined by the inbound packet's source address, which is already modified by NAT before the server processes it.

Practice this question →
Page 1 of 2 · 76 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Firewall Policies and NAT questions.

Start 20-question session