A company has a FortiGate with two WAN interfaces: WAN1 (203.0.113.10) and WAN2 (198.51.100.20). Internal users on 10.0.0.0/8 need to access the internet. The administrator wants traffic from the 10.1.0.0/16 subnet to always egress via WAN1, while all other internal traffic uses WAN2. What is the most efficient way to achieve this using SNAT?

Create a single firewall policy from 10.0.0.0/8 to both WAN interfaces with NAT enabled and let the routing table decide the egress interface.

Create a single firewall policy from 10.0.0.0/8 to WAN1 with NAT enabled and a static route for 10.1.0.0/16 to use WAN2.

Create two firewall policies: one from 10.1.0.0/16 to WAN1 with NAT enabled, and another from 10.0.0.0/8 to WAN2 with NAT enabled.

Create a central SNAT policy for 10.1.0.0/16 to use WAN1's IP and another for 10.0.0.0/8 to use WAN2's IP, without firewall policies.

A FortiGate administrator needs to publish two internal servers (192.168.1.10 and 192.168.1.11) using a single public IP address 203.0.113.50. The first server hosts a web service on port 443, and the second hosts an SSH service on port 2222. The administrator creates a VIP with the mapped IP set to 203.0.113.50. What must be configured in the VIP to ensure traffic to port 443 goes to the first server and traffic to port 2222 goes to the second server?

Create a single VIP with the mapped-to IP set to 192.168.1.10 and configure port forwarding to also send port 2222 to 192.168.1.11.

Create a single VIP with the mapped-to IP set to 192.168.1.11 and configure the firewall policy to use port forwarding to redirect port 443 to 192.168.1.10.

Create a single VIP with the mapped-to IP set to 192.168.1.10 and use a firewall policy with a destination address that includes both servers.

Create two separate VIPs, one for each service, each with a different port forwarding configuration, and reference both in separate firewall policies.

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 2Objective 2

Configure Source NAT (SNAT) and Destination NAT (DNAT) Options in Firewall Policies NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 4)

Part of the Firewall Policies and Authentication domain, which accounts for 20-25% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–15 in this domain), expect 2–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20-25%of the exam

Questions 16–18

16application · medium
A company has a FortiGate with two WAN interfaces: WAN1 (203.0.113.10) and WAN2 (198.51.100.20). Internal users on 10.0.0.0/8 need to access the internet. The administrator wants traffic from the 10.1.0.0/16 subnet to always egress via WAN1, while all other internal traffic uses WAN2. What is the most efficient way to achieve this using SNAT?
Select an answer first
17application · medium
A FortiGate administrator needs to publish two internal servers (192.168.1.10 and 192.168.1.11) using a single public IP address 203.0.113.50. The first server hosts a web service on port 443, and the second hosts an SSH service on port 2222. The administrator creates a VIP with the mapped IP set to 203.0.113.50. What must be configured in the VIP to ensure traffic to port 443 goes to the first server and traffic to port 2222 goes to the second server?
Select an answer first
18foundation · easy
A company wants to allow internal users to access the internet while hiding their private IP addresses. Which NAT type should be used?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Configure Source NAT (SNAT) and Destination NAT (DNAT) Options in Firewall Policies NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–18

A company wants to allow internal users to access the internet while hiding their private IP addresses. Which NAT type should be used?

Keep studying — Firewall Policies and Authentication