NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?
⚠ Common exam trap
The trap is that candidates may think they must specify a specific source and destination IP range because the firewall is in transparent mode, but transparent mode still inspects Layer 3 and allows IP-based policies. The simplest and broadest policy is to use 'all' for both source and destination when the intent is to allow all internal users to any internet destination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Source: all, Destination: all
In transparent mode, the FortiGate operates as a Layer 2 bridge but still inspects Layer 3 headers, so it can match on IP addresses in firewall policies. The correct answer is 'all' for both source and destination because the policy is intended to allow all internal users to any internet destination, and using 'all' ensures the policy applies broadly without unnecessary restrictions. Using specific IP subnets is also possible, but 'all' is simple and commonly used when no further filtering is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Source: all, Destination: all
Why this is correct
In transparent mode, the policy can use 'all' for source/destination since the FortiGate does not have IP addresses in the path; it inspects all bridged traffic.
- ✗
Source: the FortiGate's management IP, Destination: the web server's IP
Why it's wrong here
The FortiGate's management IP is not used in transparent mode forwarding; policies apply to bridged traffic.
- ✗
Source: internal subnet, Destination: external subnet
Why it's wrong here
In transparent mode, the policy is applied to all traffic on the bridge; specifying subnets is optional but not required.
- ✗
Source: internal MAC addresses, Destination: external MAC addresses
Why it's wrong here
Policies in transparent mode use IP addresses, not MAC addresses, for matching.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.