StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Firewall policies

Practice question 108 of 440 · easy

An established client TCP connection is permitted from LAN to DMZ. Only its server replies are required. Which additional policy is normally necessary?

Choose the single best answer.

  1. A.A DMZ-to-LAN DENY policy
  2. B.A second LAN-to-DMZ ACCEPT policy
  3. C.No reverse permit is needed for replies matching the session
  4. D.A local-in HTTPS permit for the client
Show the answer and explanation

✓ Correct answer

  • No reverse permit is needed for replies matching the session

Stateful replies use the existing permitted session. Separate reverse permission is needed for independent server initiation, not these replies; local-in rules address traffic terminating on FortiGate.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.