A company has a FortiGate with two WAN interfaces: WAN1 (203.0.113.10) and WAN2 (198.51.100.20). They have a single internal subnet 10.0.0.0/8. The administrator wants to load-balance outbound internet traffic across both WAN links. They create two firewall policies: one from internal to WAN1 with NAT enabled, and another from internal to WAN2 with NAT enabled. What is the expected behavior?

All traffic will use WAN2 because it is the default route.

All traffic will use WAN1 because the first policy in the list takes precedence.

The policies will conflict, and no traffic will be allowed.

Traffic will be load-balanced across both WAN links based on the routing table and policy matching.

A FortiGate administrator is configuring DNAT for a public-facing application. The application uses both TCP port 443 and UDP port 443. The administrator creates a VIP with the mapped IP set to 203.0.113.70 and the mapped-to IP set to 192.168.1.30. The VIP is configured with port forwarding for TCP 443. The firewall policy from WAN to internal uses this VIP. Users report that the application works over TCP but not over UDP. What is the most likely cause?

The FortiGate's UDP ALG is interfering with the traffic.

The firewall policy is set to allow only TCP traffic.

The VIP is only configured for TCP port forwarding, so UDP traffic is not translated.

The internal server is not listening on UDP port 443.

A company wants to host a web server on an internal private IP address and make it accessible from the internet via a public IP address. Which NAT technique should be used?

Destination NAT (DNAT) using a VIP

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 2Objective 2

Configure Source NAT (SNAT) and Destination NAT (DNAT) Options in Firewall Policies NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 1)

Part of the Firewall Policies and Authentication domain, which accounts for 20-25% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–15 in this domain), expect 2–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20-25%of the exam

Questions 1–5

1expert · hard
A company has a FortiGate with two WAN interfaces: WAN1 (203.0.113.10) and WAN2 (198.51.100.20). They have a single internal subnet 10.0.0.0/8. The administrator wants to load-balance outbound internet traffic across both WAN links. They create two firewall policies: one from internal to WAN1 with NAT enabled, and another from internal to WAN2 with NAT enabled. What is the expected behavior?
Select an answer first
2foundation · easy
In a FortiGate VIP definition, which setting allows you to redirect traffic from a specific external port to a different internal port on the mapped server?
Select an answer first
3foundation · easy
Which FortiGate object is used to redirect inbound traffic destined to a public IP address to an internal server's private IP address?
Select an answer first
4expert · hard
A FortiGate administrator is configuring DNAT for a public-facing application. The application uses both TCP port 443 and UDP port 443. The administrator creates a VIP with the mapped IP set to 203.0.113.70 and the mapped-to IP set to 192.168.1.30. The VIP is configured with port forwarding for TCP 443. The firewall policy from WAN to internal uses this VIP. Users report that the application works over TCP but not over UDP. What is the most likely cause?
Select an answer first
5foundation · easy
A company wants to host a web server on an internal private IP address and make it accessible from the internet via a public IP address. Which NAT technique should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Configure Source NAT (SNAT) and Destination NAT (DNAT) Options in Firewall Policies NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

In a FortiGate VIP definition, which setting allows you to redirect traffic from a specific external port to a different internal port on the mapped server?

Which FortiGate object is used to redirect inbound traffic destined to a public IP address to an internal server's private IP address?

A company wants to host a web server on an internal private IP address and make it accessible from the internet via a public IP address. Which NAT technique should be used?

Keep studying — Firewall Policies and Authentication