I85PREP
⌘ K
Fortinet NSE 4 study materials
Fortinet NSE 4 study resources

Fortinet NSE 4 practice questions

One question at a time. Build your Fortinet NSE 4 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1System and Network Settings

What is the default idle timeout for an administrator session on a FortiGate?

  1. 10 minutes
  2. 1 minute
  3. 30 minutes
  4. 5 minutes Correct answer.

Explanation

FortiOS logs out an idle administrator after 5 minutes of inactivity by default. The value is changed with set admintimeout under config system global. Increasing it lengthens the window in which an unattended session stays authenticated.

Question 2System and Network Settings

An administrator account is configured with the trusted hosts entry 10.0.0.0/24. What is the result?

  1. 10.0.0.0/24 is inserted into the routing table as a management network.
  2. The administrator is limited to read-only access when connecting from 10.0.0.0/24.
  3. Only sessions originating from 10.0.0.0/24 can authenticate as that administrator. Correct answer.
  4. Traffic sourced from 10.0.0.0/24 bypasses firewall policy inspection.

Explanation

Trusted hosts bind an administrator account to one or more source addresses, so administrative logins from any other address are rejected even with valid credentials. It is an access-control setting on the account, not a routing or policy feature. Multiple entries can be added, covering IPv4 or IPv6 sources.

Question 3System and Network Settings

Which TCP port is used by default for HTTPS administrative access to a FortiGate?

  1. 22
  2. 443 Correct answer.
  3. 80
  4. 10443

Explanation

The default administrative ports are 443 for HTTPS, 80 for HTTP, 22 for SSH and 23 for Telnet. The HTTPS port can be changed with set admin-sport under config system global. Changing the port requires administrators to specify it explicitly in the URL.

Question 4System and Network Settings

Which destination prefix identifies the default route in a FortiGate static route entry?

  1. 169.254.0.0/16
  2. 0.0.0.0/0 Correct answer.
  3. 255.255.255.255/32
  4. 0.0.0.0/32

Explanation

A default route matches every destination and is written as 0.0.0.0/0 with a subnet mask of 0.0.0.0. Traffic with no more specific match is forwarded to the configured gateway. A /32 entry matches only a single host address.

Question 5System and Network Settings

Which CLI command restores a FortiGate to its factory default configuration?

  1. execute factoryreset Correct answer.
  2. execute formatlogdisk
  3. execute backup config
  4. execute restore config

Explanation

The execute factoryreset command erases the running configuration and reboots the unit with factory defaults. Restore and backup commands move configuration files in and out without resetting the device. Log disk formatting only affects stored logs.

Question 6System and Network Settings

Which command displays the firmware version, serial number and system uptime of a FortiGate?

  1. get system status Correct answer.
  2. diagnose sys top
  3. show system global
  4. show system interface

Explanation

get system status returns the firmware build, serial number, HA mode, uptime and licensing state in one output. It is the standard first command used when identifying a device or preparing a support case. The other commands show processes, interface configuration or global settings.

Question 7System and Network Settings

Where are the DNS servers that the FortiGate itself uses for its own lookups configured?

  1. config system interface
  2. config system dhcp server
  3. config system dns Correct answer.
  4. config system dns-database

Explanation

The primary and secondary resolvers used by the FortiGate for its own queries, such as FortiGuard and update lookups, are set under config system dns. DNS server settings handed to clients are configured separately in the DHCP server object.

Question 8System and Network Settings

Which administrative access protocol transmits credentials across the network in cleartext?

  1. Telnet Correct answer.
  2. SSH
  3. HTTPS
  4. SNMPv3

Explanation

Telnet carries the entire session, including the login and password, unencrypted, so it can be captured by anyone on the path. HTTPS, SSH and SNMPv3 all provide encryption and integrity protection. Best practice is to disable Telnet on all interfaces.

Question 9System and Network Settings

Which statement about a zone on a FortiGate is correct?

  1. Each zone needs its own IP address and DHCP server.
  2. A zone can contain at most two interfaces and no VLAN sub-interfaces.
  3. A zone groups interfaces that can be referenced together in a policy. Correct answer.
  4. A zone must contain interfaces from different VDOMs.

Explanation

A zone is a logical container of one or more interfaces belonging to the same VDOM, and firewall policies can reference the zone as a single source or destination. A zone itself holds no IP address; the member interfaces keep their own addressing. Zones simplify policy management when many interfaces share identical rules.

Question 10System and Network Settings

Which command sequence enables multiple VDOM mode on a current FortiOS release?

  1. config firewall vdom / set status enable
  2. config system interface / set vdom-mode multi-vdom
  3. config global / set virtualization-mode enable
  4. config system global / set vdom-mode multi-vdom Correct answer.

Explanation

Multiple VDOM mode is turned on under config system global with set vdom-mode multi-vdom, after which VDOMs can be created under config vdom. Enabling it requires a reboot on most models. Older builds used vdom-admin under config system settings.

Question 11System and Network Settings

Which two pieces of information are required when creating a VLAN sub-interface on a FortiGate?

  1. A parent interface and a VLAN ID Correct answer.
  2. A virtual MAC address and an HA priority
  3. A zone name and a VDOM name
  4. An IP address and a DHCP address range

Explanation

A VLAN sub-interface is defined by the physical or aggregate interface that carries the tagged traffic and by the VLAN ID it matches. The IP address is optional depending on whether the interface is routed or used in a switch or zone. Tagged frames from other VLAN IDs are not accepted on that sub-interface.

Question 12System and Network Settings

Which command sends a copy of the FortiGate configuration to a TFTP server?

  1. execute backup config tftp Correct answer.
  2. execute backup config usb
  3. execute restore config tftp
  4. execute backup logs tftp

Explanation

execute backup config tftp prompts for the file name and the TFTP server address, then uploads the configuration. The restore counterpart downloads a file instead of exporting one. Log backups copy log data, not the configuration.

Question 13System and Network Settings

How does an active-passive FGCP cluster handle traffic?

  1. The secondary unit handles traffic while the primary monitors it.
  2. Each unit processes traffic for its own VDOM by default.
  3. Both units process traffic at the same time and share all sessions with each other.
  4. Only the primary unit processes traffic; the secondary stays in sync. Correct answer.

Explanation

In active-passive mode a single unit, the primary, forwards all traffic while the secondary maintains synchronized configuration and session state. If the primary fails, the secondary promotes itself and existing sessions continue. Active-active mode, by contrast, distributes sessions across the members.

Question 14System and Network Settings

Which protocol does a FortiGate aggregate interface use by default to bundle member links?

  1. VRRP
  2. LACP (802.3ad) Correct answer.
  3. Spanning Tree
  4. PAgP

Explanation

Aggregate interfaces are created with set type aggregate and a member list, and LACP per IEEE 802.3ad is the default bundling protocol, running in active or passive mode. All member ports must match in speed and duplex and connect to a switch configured for the same bundle.

Question 15System and Network Settings

Which interface setting controls whether HTTPS, SSH and ping administrative access are permitted?

  1. set service
  2. set allowaccess Correct answer.
  3. set protocol
  4. set status

Explanation

allowaccess is a per-interface list of the administrative protocols that are accepted, such as ping, https, ssh and fgfm. Removing a protocol from the list immediately blocks that access on that interface. Leaving administrative access enabled on internet-facing interfaces is a common security weakness.

Question 16System and Network Settings

Which configuration object defines a DHCP server for internal clients on a FortiGate?

  1. config system dhcp6 server
  2. config router dhcp
  3. config system dhcp server Correct answer.
  4. config firewall dhcp

Explanation

IPv4 DHCP servers are created under config system dhcp server, where each server is bound to a serving interface and given an address range, mask, gateway and DNS options. The object is separate from the interface address, so it must reference the correct interface. Leases can be reviewed with the diagnose commands.

Question 17System and Network Settings

Which setting under config system ntp causes the FortiGate to synchronize its clock with an NTP server?

  1. set sync enable
  2. set time-source ntp
  3. set clock-sync on
  4. set ntpsync enable Correct answer.

Explanation

NTP synchronization is enabled with set ntpsync enable under config system ntp, after which the server type and one or more server addresses are defined. Accurate time is required for certificate validation, log correlation and schedule-based policies.

Question 18System and Network Settings

What determines which parts of the configuration an administrator account can view and modify?

  1. The trusted hosts list configured on the administrator account
  2. The admin profile assigned to the account Correct answer.
  3. The administrator idle timeout configured globally
  4. The VDOM the administrator selects at login

Explanation

An admin profile grants read-only or read-write permission per configuration area, and the account inherits exactly those permissions. The account's VDOM assignment limits scope but does not by itself define which menus are editable. Several profiles, including super_admin, ship by default.

Question 19System and Network Settings

How is a second IP address added to an existing FortiGate interface?

  1. Create a zone that contains the interface twice.
  2. Create a VLAN sub-interface that reuses the same VLAN ID.
  3. Assign the address as a static route gateway.
  4. Enable secondary IP and add the address in secondaryip. Correct answer.

Explanation

An interface accepts extra addresses once set secondary-ip enable is applied, after which each address is defined under config secondaryip. This lets one interface answer on multiple subnets without creating VLANs or zones. The primary address is unchanged.

Question 20System and Network Settings

Which protocol allows a FortiGate to advertise itself to and learn about directly connected neighbor devices?

  1. VRRP
  2. LLDP Correct answer.
  3. LACP
  4. STP

Explanation

LLDP is a vendor-neutral Layer 2 protocol used to exchange identity, port and capability information with directly connected neighbors. FortiGate interfaces can transmit and receive LLDP independently, which helps document physical topology. It carries no routing or configuration data.

Question 21System and Network Settings

Two FortiGates are cabled for HA but never form a cluster. Which mismatch is the most likely cause?

  1. The administrator passwords differ between the units.
  2. The HA group name and password differ. Correct answer.
  3. The hostnames differ between the units.
  4. The static routes differ between the units.

Explanation

FGCP members must agree on the HA group name or group ID and the HA password, and they must use the same heartbeat interface configuration, before they can negotiate a cluster. Hostnames and admin passwords are local settings that need not match. Configuration is otherwise synchronized from the primary once the cluster forms.

Question 22System and Network Settings

What is a valid use of a loopback interface on a FortiGate?

  1. To carry HA heartbeat traffic between cluster members.
  2. To terminate VLAN tagging supplied by the ISP.
  3. To bridge two physical interfaces into a single broadcast domain.
  4. To provide an always-up address for management and routing. Correct answer.

Explanation

A loopback interface is virtual and stays up as long as the FortiGate is running, so its address is stable for management access, routing protocol identifiers and source addresses. It is not tied to any physical link state. Loopbacks therefore survive individual link failures.

Question 23System and Network Settings

Which statement describes a software switch on a FortiGate?

  1. It provides a transparent two-port bridge that cannot carry an IP address.
  2. It bridges multiple interfaces into one broadcast domain with one IP. Correct answer.
  3. It combines physical interfaces into a single link using LACP.
  4. It creates a virtual router instance with its own routing table.

Explanation

A software switch, configured with set type switch, binds member interfaces into a single Layer 2 broadcast domain that shares one MAC address and one IP address. Traffic between members is switched rather than routed. On some models a hardware switch offers the same behavior with switching offloaded to the chip.

Question 24System and Network Settings

Which statement about a virtual wire pair is correct?

  1. It can contain any number of physical interfaces.
  2. It requires an IP address on at least one member interface.
  3. It forwards traffic between exactly two interfaces without an IP. Correct answer.
  4. It performs NAT between its member interfaces by default.

Explanation

A virtual wire pair links exactly two interfaces and passes frames between them transparently, so the FortiGate can inspect traffic inline without changing the existing IP addressing. Because it is a Layer 2 construct, the pair carries no IP address of its own. Firewall policies still apply to the inspected traffic.

Question 25System and Network Settings

Two static routes point to the same destination and both next hops are reachable: route A has distance 10 and route B has distance 20. Which route is used?

  1. Neither; the FortiGate requires equal distances.
  2. Both, and traffic is load balanced across them.
  3. Route B, because a higher distance means a more preferred path.
  4. Route A, because the lower administrative distance wins. Correct answer.

Explanation

When several routes match the same destination, FortiOS installs the one with the lowest distance, the equivalent of administrative distance. Equal-cost multipath load balancing happens only when the competing routes have the same distance and priority. Distance values are set per route with set distance.

Question 26System and Network Settings

A FortiGate WAN interface is set to operate as a DHCP client. Which interface setting must be enabled for the FortiGate to install a default route using the gateway address supplied by the DHCP server?

  1. set defaultgw enable Correct answer.
  2. set gwdetect enable
  3. set dhcp-relay-service enable
  4. set dns-server-override disable

Explanation

When an interface runs in DHCP mode, the FortiGate only adds a default route from the DHCP-supplied gateway if the defaultgw option is enabled on that interface. Without it, the address and DNS information are still learned, but no default route is created. The setting is found under config system interface for the DHCP-mode interface.

Question 27System and Network Settings

Where is the setting configured that determines how long an idle administrative session may remain open before the FortiGate logs the administrator out?

  1. config system settings, set session-ttl
  2. config system global, set admintimeout Correct answer.
  3. config system admin, set idle-timeout for that account
  4. config system interface, set idle-timeout on the management port

Explanation

admintimeout under config system global defines the idle period, in minutes, after which any administrative session is terminated. It is a global value rather than a per-account value. Firewall session timers are configured separately and do not govern management sessions.

Question 28System and Network Settings

Which setting is defined on an individual administrator account and limits the source IP addresses from which that account is allowed to authenticate?

  1. The allowaccess setting on the management interface
  2. A local-in policy on the management interface
  3. Trusted hosts on the administrator account Correct answer.
  4. An administrative profile applied to the account

Explanation

Trusted hosts (trusthost1 through trusthost10) are configured on each administrator account and restrict the source addresses that account may log in from. Once at least one trusted host is defined, logins from any other address are refused even if the credentials are valid.

Question 29System and Network Settings

Which CLI configuration changes the baud rate used on the FortiGate console port?

  1. config system console, set baudrate Correct answer.
  2. config system global, set console-baud
  3. config system interface, set speed on port1
  4. config system settings, set console-speed

Explanation

The console port parameters are configured under config system console, where baudrate sets the line speed used by terminal software. Supported values are typically 9600, 19200, 38400, 57600 and 115200. This setting is independent of any physical interface configuration.

Question 30System and Network Settings

A FortiGate interface faces a subnet of DHCP clients, but the DHCP server for that subnet sits behind a different interface. Which configuration makes the FortiGate forward client requests to that server?

  1. DHCP option 82 enabled on the client VLAN
  2. mode dhcp with dhcp-relay-ip set to the server
  3. A policy route forwarding UDP port 67 to the server
  4. dhcp-relay-service with dhcp-relay-ip Correct answer.

Explanation

Enabling dhcp-relay-service on the client-facing interface and listing the server address in dhcp-relay-ip turns the interface into a DHCP relay agent. The FortiGate then forwards broadcasts from clients to the configured server and returns the replies. The interface itself must not be running as a DHCP server for the same scope.

Question 31System and Network Settings

Which link-monitor option controls whether static routes pointing at the monitored gateway are removed when the health check fails?

  1. set update-cascade-interface
  2. set protocol
  3. set update-static-route Correct answer.
  4. set gateway-ip

Explanation

With update-static-route enabled, a failed health check causes the FortiGate to withdraw the static routes that use the monitored gateway, forcing traffic to a backup path. When the probe succeeds again, those routes are reinstalled. Cascade options instead act on other interfaces rather than on route entries.

Question 32System and Network Settings

Which statement correctly describes how a policy route is evaluated on a FortiGate?

  1. It is evaluated only after the routing table lookup has failed
  2. It requires the destination to be an address configured on a local interface
  3. It applies only to traffic originated by the FortiGate itself
  4. It is evaluated before the routing table lookup Correct answer.

Explanation

Policy routes are checked ahead of the normal destination-based routing table lookup, so a matching policy route determines the outgoing interface and gateway for that traffic. If no policy route matches, the FortiGate falls back to the routing table. Policy routes can apply to forwarded traffic, not just to locally generated sessions.

Question 33System and Network Settings

Two VDOMs must exchange traffic over a dedicated point-to-point connection that consumes no physical ports. Which construct provides this?

  1. A virtual wire pair
  2. A loopback interface created in each VDOM
  3. An inter-VDOM link Correct answer.
  4. A software switch shared by both VDOMs

Explanation

An inter-VDOM link creates a pair of connected logical interfaces, one inside each VDOM, so traffic can be routed or filtered between the two VDOMs. Firewall policies in each VDOM govern what may cross the link. No physical interface is required.

Question 34System and Network Settings

An interface permits HTTPS and SSH administrative access from any address, but administrators want management logins to be accepted only from one source subnet. Which configuration accomplishes this?

  1. A local-in policy Correct answer.
  2. A trusted host entry added to the management interface
  3. A DoS policy applied to the management interface
  4. A firewall policy from the management interface to the FortiGate's own address

Explanation

Local-in policies filter traffic whose destination is the FortiGate itself, including management protocols, and are matched before the interface allowaccess rules. A local-in policy that accepts the management subnet and denies other sources achieves the restriction centrally. Normal firewall policies do not apply to traffic destined to the device.

Question 35System and Network Settings

A FortiGate must answer DNS queries for an internal domain from clients on the LAN. Which configuration holds the authoritative records for that domain?

  1. config system dns-database Correct answer.
  2. A DNS filter profile applied to the client policy
  3. The DNS option of the DHCP server
  4. config system dns

Explanation

config system dns-database defines local zones with their authoritative A, CNAME and other records, which the FortiGate serves when it acts as a DNS server for internal clients. Recursive queries for other domains are forwarded to the servers configured under config system dns.

Question 36System and Network Settings

A FortiGate WAN interface receives its address dynamically, and remote users need a fixed public hostname that always resolves to the current address. Which feature provides this?

  1. A wildcard record on the internal DNS server
  2. A DHCP reservation on the upstream server
  3. FortiGuard DDNS under config system ddns Correct answer.
  4. A static record in config system dns-database

Explanation

Dynamic DNS registers a public hostname with a provider and updates it whenever the monitored interface address changes. On FortiOS, config system ddns is used to enable the service, select the monitored interface and choose the DDNS server. The resulting name resolves to the current WAN address.

Question 37System and Network Settings

Which administrator account configuration causes that account to be authenticated by an external RADIUS server instead of the local password?

  1. remote-auth enabled together with a remote user group Correct answer.
  2. An administrative profile of super_admin assigned to the account
  3. Password policy enabled for the account
  4. Two-factor authentication enabled for the account

Explanation

Setting remote-auth on an administrator account and binding the account to a remote user group makes the FortiGate send the credentials to the configured RADIUS or LDAP server for verification. The local password is then not used for authentication. The administrative profile still determines authorization after the login succeeds.

Question 38System and Network Settings

In a two-member FGCP active-passive cluster where override is disabled on both members, the member with the higher HA priority fails and later recovers. What happens when it rejoins?

  1. It immediately becomes primary again
  2. Both members act as primary until the heartbeat is re-established
  3. The cluster elects the member with the higher serial number as primary
  4. It stays secondary until the current primary fails Correct answer.

Explanation

With override disabled, a member does not preempt the existing primary when it rejoins the cluster, so the recovered higher-priority unit returns as a secondary. It can become primary only if the current primary fails or the cluster is renegotiated after a full restart. Override must be enabled for priority to force a takeover.

Question 39System and Network Settings

Which setting limits the TCP segment size for sessions matching a firewall policy, and what is its purpose?

  1. set tcp-mss on the firewall policy, to keep segments within the path MTU Correct answer.
  2. set session-ttl on the firewall policy, to shorten the TCP handshake
  3. set tcp-mss on the interface, to limit UDP payload size
  4. set mtu on the egress interface, to fragment packets in transit

Explanation

tcp-mss on a firewall policy rewrites the MSS value in TCP SYN packets so that endpoints send segments small enough for the smallest MTU along the path. It is applied per policy, which allows different values for different traffic paths. It avoids the need to fragment packets further along the route.

Question 40System and Network Settings

SIP signalling on UDP 5060 succeeds, but the voice media on dynamically negotiated ports is dropped. Which feature should be verified, because it opens the required ports automatically?

  1. The DNS records for the SIP server
  2. The SIP session helper or SIP ALG Correct answer.
  3. The DoS policy on the SIP-facing interface
  4. The application control profile applied to the policy

Explanation

Session helpers inspect the signalling exchange and create openings for the media ports that the endpoints negotiate in the SIP headers. If the SIP helper is disabled or the traffic bypasses it, those pinholes are never created and RTP is blocked. Administrators verify the helper setting whenever signalling works but media fails.

Question 41Firewall Policy, Security Profiles, and Traffic Shaping

A FortiGate receives a packet that does not match any configured firewall policy. What happens to that packet by default?

  1. The packet is queued until an administrator creates a policy.
  2. The packet is forwarded after a warning is logged.
  3. The packet is dropped by the implicit deny policy. Correct answer.
  4. The packet is forwarded using the default route.

Explanation

FortiGate uses a top-down first-match evaluation of firewall policies. Traffic that matches no policy falls to the implicit deny at the bottom of the list, which discards it. No forwarding decision is made for unmatched traffic.

Question 42Firewall Policy, Security Profiles, and Traffic Shaping

Where is source NAT (SNAT) enabled for traffic that passes through a FortiGate?

  1. In the security profile attached to the policy
  2. In the firewall policy that accepts the traffic Correct answer.
  3. In the outbound interface configuration
  4. In the static route toward the destination

Explanation

NAT is a per-policy setting: the firewall policy that accepts the session has a NAT toggle, and optionally an IP pool. Address translation happens after the policy match is made. Interfaces, routes, and security profiles do not translate addresses.

Question 43Firewall Policy, Security Profiles, and Traffic Shaping

What must be true of a firewall policy before a security profile can be attached to it?

  1. The policy must have logging enabled.
  2. The policy action must be set to ACCEPT. Correct answer.
  3. The policy must use the always schedule.
  4. The policy must have NAT enabled.

Explanation

Security profiles inspect traffic that the FortiGate allows, so the profile option is available only on policies whose action is ACCEPT. Deny policies drop the session before inspection would occur.

Question 44Firewall Policy, Security Profiles, and Traffic Shaping

Which security profile allows or blocks web traffic based on FortiGuard categories?

  1. Intrusion prevention
  2. Antivirus
  3. Application control
  4. Web filter Correct answer.

Explanation

The web filter profile matches requests against FortiGuard URL categories and applies an action per category. It also supports static URL filtering and safe-search enforcement.

Question 45Firewall Policy, Security Profiles, and Traffic Shaping

What does application control primarily provide on a FortiGate?

  1. Filtering of URLs against a locally maintained allow list
  2. Identification and control of applications regardless of the port or protocol in use Correct answer.
  3. Scanning of email attachments for known malware
  4. Rate limiting of broadcast traffic on a subnet

Explanation

Application control recognizes applications by their traffic patterns and signatures, so it works even when an application uses non-standard ports. Actions such as block, monitor, or shape can then be applied per application or category.

Question 46Firewall Policy, Security Profiles, and Traffic Shaping

In a traffic shaper, what does the maximum bandwidth setting define?

  1. The bandwidth reserved for the traffic class
  2. The throughput ceiling for traffic using that shaper Correct answer.
  3. The bandwidth used for management traffic only
  4. The total bandwidth available on the physical interface

Explanation

Maximum bandwidth is the cap applied to sessions that use the shaper; traffic above the cap is delayed or dropped depending on configuration. Guaranteed bandwidth is a separate setting used when the link is congested.

Question 47Firewall Policy, Security Profiles, and Traffic Shaping

How does a FortiGate evaluate the order of firewall policies for IPv4 traffic?

  1. Policies are chosen by the entry that has the lowest latency.
  2. Policies are evaluated from top to bottom, and the first match is applied. Correct answer.
  3. Policies are matched by the most specific destination address first.
  4. Policies are evaluated by policy ID from lowest to highest priority.

Explanation

The policy list is an ordered sequence; evaluation starts at the top and stops at the first policy whose fields match the session. Moving a policy up or down in the list therefore changes its precedence.

Question 48Firewall Policy, Security Profiles, and Traffic Shaping

Which priority values can be assigned to a traffic shaper on a FortiGate?

  1. Priority 1, priority 2, and priority 3
  2. Critical, normal, and best effort
  3. High, medium, and low Correct answer.
  4. Gold, silver, and bronze

Explanation

FortiOS shapers use three priority levels: high, medium, and low. Priority determines which traffic is served first when the link is congested and shaped traffic competes for bandwidth.

Question 49Firewall Policy, Security Profiles, and Traffic Shaping

How does a shared traffic shaper differ from a per-IP traffic shaper?

  1. A shared shaper applies its limits only to download traffic, while a per-IP shaper applies its limits to upload traffic.
  2. A shared shaper can be used only in shaping policies, while a per-IP shaper can be used only in firewall policies.
  3. A shared shaper limits total bandwidth for all traffic using it; a per-IP shaper limits each source IP. Correct answer.
  4. A shared shaper must be referenced by a static route, while a per-IP shaper must be referenced by a policy route.

Explanation

A shared shaper enforces one bandwidth pool against every session that references it. A per-IP shaper instead applies the configured bandwidth to each source address individually, so total throughput scales with the number of clients.

Question 50Firewall Policy, Security Profiles, and Traffic Shaping

What happens to the NAT settings configured directly in firewall policies when central NAT is enabled?

  1. They are ignored, and NAT is controlled by the central SNAT table. Correct answer.
  2. They continue to be applied before central SNAT rules.
  3. They are converted automatically into central SNAT rules.
  4. They are combined with the central SNAT rules.

Explanation

Enabling central NAT moves SNAT control to the central SNAT table, and the NAT options inside individual firewall policies are no longer used. This gives a single ordered list of translation rules instead of per-policy settings.