Applying Traffic Shapers to Firewall Policies
An administrator needs to apply traffic shaping to limit bandwidth for video streaming traffic on a firewall policy. Which configuration step is required?
Quick Answer
The answer is to create a traffic shaper and reference it in the firewall policy. This is correct because traffic shaping in Fortinet’s FortiOS operates as a separate object that must be explicitly applied to a policy to control bandwidth; the shaper defines the rate limits and burst sizes, while the policy determines which traffic—such as video streaming—gets shaped. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this tests your understanding of how traffic shaping integrates with firewall policies, often appearing in scenario-based questions where you must distinguish between creating a shaper versus simply enabling QoS on an interface. A common trap is assuming that a default shaper is automatically applied, but the exam emphasizes that no shaping occurs until the shaper is referenced in the policy. Memory tip: think of the shaper as a speed limit sign and the policy as the road—you need both to enforce the limit.
⚠ Common exam trap
Many candidates confuse QoS interface settings (which limit all traffic on an interface) with traffic shapers (which limit specific traffic in a policy), leading them to select Option C instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a traffic shaper and reference it in the firewall policy
Traffic shaping in FortiGate is applied by creating a traffic shaper (either per-IP or shared) and then referencing that shaper in the firewall policy that matches the video streaming traffic. This allows the administrator to control bandwidth usage for specific traffic flows without affecting other traffic. Option D is correct because it directly describes this required configuration step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an application control profile to restrict video streaming
Why it's wrong here
Application control can block or allow, but does not shape bandwidth.
- ✗
Configure policy-based routing to shape traffic
Why it's wrong here
PBR is for routing, not shaping.
- ✗
Enable QoS on the interface and set the bandwidth limit
Why it's wrong here
Interface QoS is different from per-policy shaping.
- ✓
Create a traffic shaper and reference it in the firewall policy
Why this is correct
Traffic shapers define bandwidth limits and are applied via policies.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to configure traffic shaping to limit bandwidth for YouTube video streaming. Which THREE objects or settings must be configured on the FortiGate to apply traffic shaping?
medium- ✓ A.Traffic shaper (e.g., shared or per-IP shaper)
- ✓ B.Application control profile to identify YouTube traffic
- C.A DNS filter to block YouTube
- ✓ D.A firewall policy that applies the traffic shaper and the application control profile
- E.A static route for YouTube's IP range
Why A: A traffic shaper (shared or per-IP) defines the bandwidth limits (e.g., maximum rate, guaranteed rate) that will be enforced on the traffic. This shaper must be created first to control YouTube streaming bandwidth.
Variation 2. An administrator is configuring traffic shaping on a firewall policy to limit bandwidth for YouTube. Which THREE components are required?
hard- ✓ A.A traffic shaper object that defines bandwidth limits
- ✓ B.A firewall policy that matches YouTube traffic
- C.A static route for the YouTube subnet
- D.A schedule object to apply the shaper only during business hours
- ✓ E.Enable traffic shaping on the firewall policy and assign the traffic shaper
Why A: A traffic shaper object is a fundamental component that defines the bandwidth limits (e.g., guaranteed bandwidth, maximum bandwidth, priority) that will be applied to traffic. Without this object, the firewall has no parameters to enforce rate limiting. In FortiGate, the traffic shaper object is created under 'Traffic Shapers' and can be per-policy or per-IP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.