The answer is that the VIP is configured for port forwarding only for HTTP (port 80). This is the most likely cause because a Virtual IP on a FortiGate maps a specific public IP and port combination to a private IP and port; if the VIP rule only defines a mapping for TCP 80, it will not translate traffic destined for TCP 443, leaving HTTPS unreachable while HTTP works. On the Fortinet NSE 4 exam, this scenario tests your understanding that VIPs are port-specific by default, and a common trap is assuming a single VIP automatically forwards all ports to the internal server. To avoid this, remember that each service requires its own port forwarding entry or a port range must be explicitly defined. A helpful memory tip: “One VIP, one port—unless you specify the whole sort.”
NSE4 Firewall Policies and NAT Practice Question
This NSE4 practice question tests your understanding of firewall policies and nat. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a web server in the DMZ that must be accessible from the internet on both HTTP and HTTPS. The admin configures a VIP to map the public IP to the server's private IP. However, external users can only reach HTTP. What is the MOST likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VIP is configured for port forwarding only for HTTP (port 80)
The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The VIP is configured for port forwarding only for HTTP (port 80)
Why this is correct
VIP port forwarding must specify each port; HTTPS (443) is not included.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The web server is not listening on HTTPS
Why it's wrong here
The symptom is that external users cannot reach HTTPS; the server may be configured correctly but traffic doesn't reach it.
✗
The VIP is using overload mode instead of one-to-one
Why it's wrong here
Overload mode is for source NAT, not destination NAT.
✗
The firewall policy allowing traffic to the VIP only permits HTTP
Why it's wrong here
If the VIP only forwards HTTP, the policy is irrelevant for HTTPS; the traffic never reaches the server.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume the firewall policy is the issue, but the VIP itself must be configured to forward the specific ports; a policy allowing all traffic is useless if the VIP does not translate the destination port for HTTPS.
Detailed technical explanation
How to think about this question
In FortiGate, a VIP object can be configured with port forwarding by specifying a single port or a port range. If only port 80 is defined, the VIP will not translate destination port 443, so HTTPS packets are dropped or not matched. A common real-world scenario is when an administrator creates a VIP for HTTP and forgets to add a second VIP or a port range for HTTPS, leading to partial accessibility. The VIP must explicitly include both ports, or separate VIPs must be created for each service.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Firewall Policies and NAT — This question tests Firewall Policies and NAT — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The VIP is configured for port forwarding only for HTTP (port 80) — The VIP (Virtual IP) configuration on a FortiGate maps a public IP and port to a private IP and port. If the VIP is configured only for port forwarding on TCP 80 (HTTP), it will not translate traffic for TCP 443 (HTTPS). This is the most likely cause because external users can reach HTTP but not HTTPS, indicating the VIP itself is not handling HTTPS traffic.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.