NSE4 · Question #137
You wish to create a firewall policy that applies only to traffic intended for your web server. The web server has an IP address of 192.168.2.2 and a /24 subnet mask. When defining the firewall addres
The correct answer is D. 192.168.2.2 / 255.255.255.255. To define a firewall address for a single web server at 192.168.2.2, the correct address object specifies the exact IP address with a host subnet mask.
Question
You wish to create a firewall policy that applies only to traffic intended for your web server. The web server has an IP address of 192.168.2.2 and a /24 subnet mask. When defining the firewall address for use in this policy, which one of the following addresses is correct?
Options
- A192.168.2.0 / 255.255.255.0
- B192.168.2.2 / 255.255.255.0
- C192.168.2.0 / 255.255.255.255
- D192.168.2.2 / 255.255.255.255
How the community answered
(42 responses)- A2% (1)
- B2% (1)
- C7% (3)
- D88% (37)
Why each option
To define a firewall address for a single web server at 192.168.2.2, the correct address object specifies the exact IP address with a host subnet mask.
This address (192.168.2.0 / 255.255.255.0) represents the entire 192.168.2.0/24 network, not just the single web server.
This address (192.168.2.2 / 255.255.255.0) incorrectly implies the IP 192.168.2.2 is a network address for a /24 subnet, which is not how individual hosts are specified for policy matching.
While 255.255.255.255 correctly designates a single host, 192.168.2.0 is the network address for a /24 subnet, not the specific web server's IP address.
To target only the specific web server at 192.168.2.2, the address object must use its exact IP address and a 255.255.255.255 (or /32) subnet mask, which denotes a single host.
Concept tested: FortiGate firewall address object for single host
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/339401/creating-ip-addresses
Topics
Community Discussion
No community discussion yet for this question.