Firewall Policies and NAT practice questions

A network administrator configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to a web server (172.16.1.10). Users on the 10.0.0.0/8 network cannot access the web server, but other internal users can. The administrator checks the policy list and sees the policy is enabled and in the correct position. What is the most likely cause?

Trap 1: The policy is placed below a deny-all policy

The administrator checked policy order and it is correct.

Trap 2: NAT is not configured on the policy

NAT is not required for internal-to-internal traffic.

Trap 3: The policy is disabled

The administrator already verified the policy is enabled.

A
The policy is placed below a deny-all policy
Why wrong: The administrator checked policy order and it is correct.
B
NAT is not configured on the policy
Why wrong: NAT is not required for internal-to-internal traffic.
C
The firewall does not have a route to the 10.0.0.0/8 network
Without a route, traffic from that network will be dropped.
D
The policy is disabled
Why wrong: The administrator already verified the policy is enabled.

Read the full VPN explanation →

Question 2hardmultiple choice

An organization wants to authenticate VPN users using an LDAP server. They configure an LDAP server object and a user group. However, users are unable to authenticate. The administrator checks the logs and sees 'authentication failed' errors. What is the most common misconfiguration?

Trap 1: The user group is not configured with the correct members

Group membership affects authorization, not authentication.

Trap 2: The LDAP server uses SSL/TLS but the FortiGate is not configured…

If SSL is required, the error would be about TLS, not authentication.

Trap 3: The LDAP server is not reachable from the FortiGate

If reachable, logs would show connection errors, not authentication failures.

A
The user group is not configured with the correct members
Why wrong: Group membership affects authorization, not authentication.
B
The LDAP server uses SSL/TLS but the FortiGate is not configured for it
Why wrong: If SSL is required, the error would be about TLS, not authentication.
C
The LDAP server bind DN or password is incorrect
Incorrect bind credentials prevent the FortiGate from querying the directory.
D
The LDAP server is not reachable from the FortiGate
Why wrong: If reachable, logs would show connection errors, not authentication failures.

Question 3easymultiple choice

A FortiGate administrator needs to allow SMTP traffic from the internal network to an external mail server. The internal network uses source NAT to the external interface IP. Which firewall policy configuration is correct?

Trap 1: Policy: source internal, destination external, service SMTP,…

Without NAT, internal private IPs will not be routable to the internet.

Trap 2: Policy: source internal, destination external, service SMTP (port…

Port 587 is for SMTP submission, but standard SMTP is port 25.

Trap 3: Policy: source internal, destination external, service SMTP (UDP),…

SMTP uses TCP, not UDP.

A
Policy: source internal, destination external, service SMTP, enable NAT
SMTP uses TCP port 25 and NAT is needed for outbound traffic.
B
Policy: source internal, destination external, service SMTP, disable NAT
Why wrong: Without NAT, internal private IPs will not be routable to the internet.
C
Policy: source internal, destination external, service SMTP (port 587), enable NAT
Why wrong: Port 587 is for SMTP submission, but standard SMTP is port 25.
D
Policy: source internal, destination external, service SMTP (UDP), enable NAT
Why wrong: SMTP uses TCP, not UDP.

Question 4mediummultiple choice

Refer to the exhibit. A FortiGate has this policy configured. Traffic from 10.0.1.0/24 to 192.168.1.10 on HTTP is being logged as allowed. However, users report that they cannot access the web server. What is the most likely issue?

Exhibit

config firewall policy
    edit 1
        set name "Allow-HTTP"
        set srcintf "internal"
        set dstintf "dmz"
        set srcaddr "10.0.1.0/24"
        set dstaddr "192.168.1.10"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

Trap 1: The policy is placed below a deny policy

If traffic is allowed, the policy must be hit before any deny policy.

Trap 2: The service is set to HTTP but the server uses HTTPS

The logs show HTTP traffic is allowed, so the server must be listening on HTTP.

Trap 3: The policy is disabled

Logs show traffic is allowed, so the policy is enabled.

A
NAT is not enabled on the policy
Without NAT, the server may send replies directly to the client's private IP, which is not routable.
B
The policy is placed below a deny policy
Why wrong: If traffic is allowed, the policy must be hit before any deny policy.
C
The service is set to HTTP but the server uses HTTPS
Why wrong: The logs show HTTP traffic is allowed, so the server must be listening on HTTP.
D
The policy is disabled
Why wrong: Logs show traffic is allowed, so the policy is enabled.

Question 5hardmultiple choice

Refer to the exhibit. An administrator runs 'diagnose firewall auth list' and sees two authenticated users. The firewall policy requires authentication for HTTP traffic from 10.0.0.0/24 to 192.168.1.10. User 'jsmith' has been idle for 20 minutes, but the authentication session is still active. The idle timeout is set to 30 minutes. What will happen after 30 minutes of inactivity?

Exhibit

FGT # diagnose firewall auth list
1: authid=1 type=ldap user=jsmith src=10.0.0.5 dst=192.168.1.10 proto=6 port=80 duration=1200 timeout=3600
2: authid=2 type=ldap user=ajones src=10.0.0.6 dst=192.168.1.10 proto=6 port=80 duration=600 timeout=3600

Trap 1: The authentication session will remain active because the firewall…

Authentication sessions have their own idle timer.

Trap 2: The user will be automatically re-authenticated without prompting

Automatic re-authentication does not happen; the user must re-enter credentials.

Trap 3: The firewall session will be torn down immediately

The firewall session continues until it times out or traffic ends.

A
The authentication session will remain active because the firewall session is still valid
Why wrong: Authentication sessions have their own idle timer.
B
The user will be automatically re-authenticated without prompting
Why wrong: Automatic re-authentication does not happen; the user must re-enter credentials.
C
The firewall session will be torn down immediately
Why wrong: The firewall session continues until it times out or traffic ends.
D
The authentication session will expire, and the user must re-authenticate for new traffic
The user will be prompted for credentials again after idle timeout.

Question 6mediummultiple choice

A company uses FSSO (Fortinet Single Sign-On) with a domain controller. Users authenticate to the domain, and the FortiGate retrieves the login events. The firewall policy uses the FSSO group. Some users report that after logging in, they cannot access resources that require authentication. The administrator checks the FSSO status and sees that the FortiGate is receiving login events. What is the most likely cause?

Trap 1: The user is not a member of the FSSO group

Group membership would be checked after authentication.

Trap 2: The FSSO collector agent is not running

If it were not running, events would not be received.

Trap 3: The FortiGate is not polling the domain controller

The administrator confirmed it is receiving events.

A
The user is not a member of the FSSO group
Why wrong: Group membership would be checked after authentication.
B
The FSSO collector agent is not running
Why wrong: If it were not running, events would not be received.
C
The user's IP address is not in the source address range of the policy
FSSO authenticates the user, but the policy's source address must match the user's IP.
D
The FortiGate is not polling the domain controller
Why wrong: The administrator confirmed it is receiving events.

Question 7easymultiple choice

An administrator wants to create a firewall policy that blocks all traffic from a specific IP address (10.0.0.99) to the internet, but allows all other traffic. Which policy configuration is correct?

Trap 1: Create an allow policy for source 'all' and then a deny policy for…

The deny policy must come before the allow policy to be effective.

Trap 2: Use a local-in policy to block the IP

Local-in policy is for traffic destined to the FortiGate itself.

Trap 3: Create a policy that denies all traffic from 10.0.0.99 to any…

This would block all traffic, not just internet.

A
Create a deny policy for source 10.0.0.99 to destination 'all' on the WAN interface, then an allow policy for all other traffic
The deny policy should be placed above the allow policy.
B
Create an allow policy for source 'all' and then a deny policy for 10.0.0.99
Why wrong: The deny policy must come before the allow policy to be effective.
C
Use a local-in policy to block the IP
Why wrong: Local-in policy is for traffic destined to the FortiGate itself.
D
Create a policy that denies all traffic from 10.0.0.99 to any destination
Why wrong: This would block all traffic, not just internet.

Question 8mediummulti select

Which TWO statements about firewall policy authentication are correct?

Trap 1: Authentication cannot be used with FSSO

FSSO is a method of authentication.

Trap 2: Authentication is only supported for inbound traffic

Authentication can be used for outbound traffic as well.

Trap 3: Authentication is performed after the traffic is allowed by the…

Authentication is performed before the policy allows traffic.

A
Authentication cannot be used with FSSO
Why wrong: FSSO is a method of authentication.
B
Authentication is only supported for inbound traffic
Why wrong: Authentication can be used for outbound traffic as well.
C
Authentication can be configured on a per-policy basis
Authentication is a policy setting.
D
Authentication can be based on local, LDAP, or RADIUS databases
FortiGate supports multiple authentication servers.
E
Authentication is performed after the traffic is allowed by the policy
Why wrong: Authentication is performed before the policy allows traffic.

Question 9hardmulti select

Which THREE conditions must be met for a firewall policy with FSSO authentication to work correctly?

Trap 1: The user's IP address must be in the destination address range of…

The source IP must match the policy's source address.

Trap 2: The user must be authenticated to the FortiGate locally

FSSO relies on domain authentication, not local.

A
The FortiGate must be able to communicate with the domain controller
FSSO requires communication with the DC to receive login events.
B
The user's IP address must be in the destination address range of the policy
Why wrong: The source IP must match the policy's source address.
C
The user must be a member of a group that is referenced in the firewall policy
The policy uses the group for authorization.
D
The FSSO collector agent must be running and properly configured
The collector agent gathers login events from the DC.
E
The user must be authenticated to the FortiGate locally
Why wrong: FSSO relies on domain authentication, not local.

Question 10hardmultiple choice

Refer to the exhibit. An administrator configures the policies as shown. Traffic from 10.0.0.0/8 to the internet on HTTP is denied. What is the most likely reason?

Exhibit

config firewall policy
    edit 0
        set name "Deny-All"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 1
        set name "Allow-HTTP"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "10.0.0.0/8"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

Trap 1: The Allow-HTTP policy uses service HTTP but the traffic uses HTTPS

The question states HTTP traffic.

Trap 2: The Allow-HTTP policy has the wrong source interface

The source interface is correct for internal traffic.

Trap 3: The Allow-HTTP policy is disabled

The exhibit shows it is configured, but not necessarily disabled; the issue is order.

A
The Allow-HTTP policy uses service HTTP but the traffic uses HTTPS
Why wrong: The question states HTTP traffic.
B
The Deny-All policy is placed above the Allow-HTTP policy
Policy ID 0 has lower sequence number and matches first.
C
The Allow-HTTP policy has the wrong source interface
Why wrong: The source interface is correct for internal traffic.
D
The Allow-HTTP policy is disabled
Why wrong: The exhibit shows it is configured, but not necessarily disabled; the issue is order.

Question 11easymultiple choice

A FortiGate administrator wants to restrict access to a sensitive server (10.0.0.100) such that only users who authenticate via LDAP can access it. Which firewall policy configuration is required?

Trap 1: Policy: source any, destination 10.0.0.100, service any, action…

No authentication is configured.

Trap 2: Policy: source any, destination 10.0.0.100, service any, action…

Missing user group reference.

Trap 3: Policy: source any, destination 10.0.0.100, service any, action…

FSSO is not LDAP.

A
Policy: source any, destination 10.0.0.100, service any, action accept
Why wrong: No authentication is configured.
B
Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP
Why wrong: Missing user group reference.
C
Policy: source any, destination 10.0.0.100, service any, action accept, enable authentication, set auth-type LDAP, set groups "LDAP-Users"
This configures authentication with LDAP and specifies the group.
D
Policy: source any, destination 10.0.0.100, service any, action accept, enable FSSO authentication
Why wrong: FSSO is not LDAP.

Study the full SD-WAN breakdown →

Question 12hardmultiple choice

A company has a FortiGate 100F with two ISPs (ISP1 and ISP2) for load balancing. They use SD-WAN to direct traffic. The firewall has a policy that allows HTTP and HTTPS traffic from internal users (10.0.0.0/8) to the internet. The policy uses FSSO authentication with an Active Directory domain controller. Recently, users on the 10.0.1.0/24 subnet report that they are prompted for authentication repeatedly, even though they are domain-joined and logged in. Users on other subnets do not have this issue. The administrator checks the FSSO configuration and sees that the collector agent is running and the FortiGate is receiving login events. The FortiGate's policy is configured with source address 10.0.0.0/8 and FSSO group 'Domain Users'. The administrator also notices that the FortiGate's SD-WAN rules are configured to use ISP1 for traffic from 10.0.0.0/8 except for traffic from 10.0.1.0/24, which uses ISP2. The FortiGate's FSSO collector agent is configured to listen on the IP address 192.168.1.1, which is the IP of the interface connected to ISP1. What is the most likely cause of the authentication issue?

Trap 1: The FSSO group 'Domain Users' does not include the affected users

The issue is subnet-specific, not group-specific.

Trap 2: The SD-WAN rule for 10.0.1.0/24 is misconfigured and drops…

The SD-WAN rule is for load balancing, not blocking.

Trap 3: The domain controller is not reachable from the FortiGate

The administrator confirmed login events are received for other subnets.

A
The FSSO group 'Domain Users' does not include the affected users
Why wrong: The issue is subnet-specific, not group-specific.
B
The SD-WAN rule for 10.0.1.0/24 is misconfigured and drops authentication traffic
Why wrong: The SD-WAN rule is for load balancing, not blocking.
C
The domain controller is not reachable from the FortiGate
Why wrong: The administrator confirmed login events are received for other subnets.
D
The FSSO collector agent is listening on an IP that is not reachable from the 10.0.1.0/24 subnet due to SD-WAN routing
The collector agent's IP is on ISP1 interface, but traffic from 10.0.1.0/24 goes via ISP2, so the domain controller may not be able to send login events to that IP.

Open the full VLAN trunking answer →

Question 13hardmultiple choice

A company uses FortiGate with firewall policies to control access between internal VLANs. Users in VLAN 10 report they can access internet but cannot reach a server in VLAN 20 on port 443. The server is reachable from other VLANs. The administrator checks the firewall policy configuration: there is a policy from VLAN10 to VLAN20 allowing HTTPS, with NAT disabled and logging enabled. The policy has a schedule set to 'Always'. The administrator also checks that there are no overlapping policies. What is the most likely cause?

Trap 1: NAT is disabled, so the server cannot send replies back.

NAT is not required for internal traffic; the server can reply directly to the source IP.

Trap 2: The policy order is incorrect; a deny policy above is blocking…

The administrator checked for overlapping policies and found none; if there were a deny policy above, it would block all traffic from VLAN10 to VLAN20, not just HTTPS.

Trap 3: The schedule is configured incorrectly and the policy is inactive…

The schedule is set to Always, so the policy is always active.

A
NAT is disabled, so the server cannot send replies back.
Why wrong: NAT is not required for internal traffic; the server can reply directly to the source IP.
B
The policy order is incorrect; a deny policy above is blocking traffic.
Why wrong: The administrator checked for overlapping policies and found none; if there were a deny policy above, it would block all traffic from VLAN10 to VLAN20, not just HTTPS.
C
A security profile applied to the policy is blocking the HTTPS traffic.
Security profiles such as SSL inspection or application control can block or interfere with HTTPS traffic, especially if the server certificate is not trusted.
D
The schedule is configured incorrectly and the policy is inactive during the current time.
Why wrong: The schedule is set to Always, so the policy is always active.

Question 14mediummultiple choice

Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Allow-Internet"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
    edit 2
        set name "Block-SSH"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "SSH"
        set logtraffic all
    next
end

Trap 1: The SSH connection will succeed because policy 2 is evaluated first.

Policies are evaluated from top to bottom; policy 1 is first.

Trap 2: The SSH connection will be blocked because policy 2 explicitly…

Firewall policies are evaluated in order; policy 1 (allow all) is before policy 2 (deny SSH), so policy 1 matches first and allows the traffic.

Trap 3: The SSH connection will be blocked because policy 1 does not…

Policy 1 uses service 'ALL', which includes SSH. The issue is the order.

A
The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.
Policy 1 matches all traffic from internal to wan1, so SSH is allowed before reaching the deny policy.
B
The SSH connection will succeed because policy 2 is evaluated first.
Why wrong: Policies are evaluated from top to bottom; policy 1 is first.
C
The SSH connection will be blocked because policy 2 explicitly denies SSH.
Why wrong: Firewall policies are evaluated in order; policy 1 (allow all) is before policy 2 (deny SSH), so policy 1 matches first and allows the traffic.
D
The SSH connection will be blocked because policy 1 does not include SSH service specifically.
Why wrong: Policy 1 uses service 'ALL', which includes SSH. The issue is the order.

Study the full SD-WAN breakdown →

Question 15easymultiple choice

A company has a FortiGate with two ISPs: wan1 (primary) and wan2 (backup). They want all outbound traffic from internal users to use wan1, and if wan1 fails, traffic should automatically fail over to wan2. The administrator configures static routes: default route via wan1 gateway with distance 10 and default route via wan2 gateway with distance 20. They also configure an SD-WAN zone with both interfaces and set a strategy of 'Manual' with 'Best Quality' for wan1. After testing, failover does not occur when wan1 goes down. What is the most likely reason?

Trap 1: The SD-WAN zone does not include the backup interface wan2.

The administrator configured the SD-WAN zone with both interfaces, so wan2 is included.

Trap 2: The static routes have the same distance, so failover does not…

The distances are different (10 and 20), so static routes would cause failover if SD-WAN were not used.

Trap 3: The firewall policy does not bind to the SD-WAN zone; it binds to…

The question states they configured an SD-WAN zone; typically policies reference the zone, not the physical interface.

A
The SD-WAN zone does not include the backup interface wan2.
Why wrong: The administrator configured the SD-WAN zone with both interfaces, so wan2 is included.
B
The SD-WAN strategy is set to Manual, which does not automatically failover; the administrator should use an automatic strategy or configure link health monitoring.
Manual strategy requires manual intervention or link health monitoring to trigger failover; automatic strategies like Lowest Cost or Best Quality with performance SLA will failover automatically.
C
The static routes have the same distance, so failover does not occur.
Why wrong: The distances are different (10 and 20), so static routes would cause failover if SD-WAN were not used.
D
The firewall policy does not bind to the SD-WAN zone; it binds to wan1 interface directly.
Why wrong: The question states they configured an SD-WAN zone; typically policies reference the zone, not the physical interface.

Question 16mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to create a firewall policy allowing HTTP traffic from internal to DMZ into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediumdrag order

Drag and drop the steps to configure SSL VPN on FortiGate into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Match each Fortinet product to its primary role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Next-generation firewall

Security information and event management

Centralized logging and analytics

Centralized management and policy orchestration

Advanced threat detection and analysis

Question 19mediummatching

Match each FortiGate logging destination to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stored on the FortiGate's internal memory or disk

Centralized log collector and analyzer

Standard protocol to send logs to external servers

Cloud-based log storage and management

Used for monitoring device status and performance

Question 20mediummultiple choice

A network admin has configured a firewall policy allowing HTTPS traffic from the internal network to a DMZ web server. Users report that the web pages load slowly. The admin checks the policy and notices traffic shaping is not applied. What is the BEST action to ensure fair bandwidth distribution for HTTPS traffic?

Trap 1: Increase the bandwidth of the internet link

This is a workaround and does not address fair distribution between different traffic types.

Trap 2: Configure policy-based routing for HTTPS traffic

PBR changes routing, not bandwidth allocation.

Trap 3: Enable QoS on the outgoing interface

QoS on an interface only prioritizes traffic but does not guarantee per-policy bandwidth limits.

A
Create a traffic shaping policy and apply it to the firewall policy
Traffic shapers are applied directly to firewall policies to control bandwidth for matching traffic.
B
Increase the bandwidth of the internet link
Why wrong: This is a workaround and does not address fair distribution between different traffic types.
C
Configure policy-based routing for HTTPS traffic
Why wrong: PBR changes routing, not bandwidth allocation.
D
Enable QoS on the outgoing interface
Why wrong: QoS on an interface only prioritizes traffic but does not guarantee per-policy bandwidth limits.