StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Source and destination NAT

Practice question 142 of 440 · hard

An internal client and server share a subnet. The client uses the server public VIP, but the server reply bypasses FortiGate. Which change can deliberately maintain the NAT return path?

Choose the single best answer.

  1. A.Enable DNAT only while leaving the directly reachable client source unchanged
  2. B.Configure appropriate hairpin SNAT
  3. C.Add a reverse permit without changing the server return path
  4. D.Move the existing hairpin permit earlier without changing the return path
Show the answer and explanation

✓ Correct answer

  • Configure appropriate hairpin SNAT

SNAT can make the server reply to FortiGate, preserving stateful reverse translation. DNAT alone leaves the directly reachable client source visible; rule order and reverse permission do not force the server to use FortiGate.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.