WATCHGUARD NETWORK SECURITY
ESSENTIALS PRACTICE QUIZ
(100+ EXAM PRACTICE QUESTIONS
AND CORRECT ANSWERS LATEST 2026)
What is the best pattern to block an Adobe PDF document in FTP
uploads?
*{DF
*.p*
.*df
*.pdf - CORRECT ANSWER ✔✔- *.pdf
What do you need to know to set up a VPN between 2 devices?(4)
The IPSec certificate and the pre-shared key
The public IP or domain information of the VPN remote gateway
The configuration of phase 1 and phase 2 of the VPN remote gateway
The private network address on the remote device where you want to
send traffic
The name of the gateway and tunnel on the remote VPN gateway -
CORRECT ANSWER ✔✔- The IPSec certificate and the pre-shared
key.
1|Page
,The public IP or domain information of the VPN remote gateway
The configuration of phase 1 and phase 2 of the VPN remote gateway
The private network address on the remote device where you want to
send traffic
For each VLAN interface, how many untagged networks can you have?
Dependent on the firewall model
Four
One
Unlimited - CORRECT ANSWER ✔✔- One
You have configured a BOVPN and have just saved the configuration on
both devices. When you look at the tunnel status in Firebox System
Manager, the tunnel does not appear active. What could have caused
this? (3)
There is no connection between the IP addresses of the external interface
of each device
No traffic was sent to the IP address on the other side of the tunnel
There is a difference in the VPN Phase 1 or Phase 2 configuration
The name of the Gateway or the tunnel is not the same as in the remote
device. - CORRECT ANSWER ✔✔- There is no connection between
the IP addresses of the external interface of each device
No traffic was sent to the IP address on the other side of the tunnel.
2|Page
,There is a difference in the VPN Phase 1 or Phase 2 configuration
Which of these options are private IPv4 addresses you can assign to a
trusted interface, as described in RFC 1918, Address Allocation for
Private Internets(3)
192.168.50.1/24
10.50.1.1/16
198.51.100.1/24
172.16.0.1/16
192.0.2.1/24 - CORRECT ANSWER ✔✔- 192.168.50.1/24
10.50.1.1/16
172.16.0.1/16
For which of these third party authentication methods must you specify a
search base?(2)
RADIUS
Active Directory
SecurID
LDAP - CORRECT ANSWER ✔✔- Active Directory
LDAP
3|Page
, You have a privately addressed email server behind your Firebox. If you
want to make sure that all traffic from this server to the Internet appears
to come from the public IP address 203.0.113.25, regardless of policies,
which form of NAT would you use?(1)
In the SMTP policy that handles traffic from the email server, select the
optin to apply dynamic NAT to all traffic in the policy and set the source
IP address 203.0.113.25
Create a global dynamic NAT rule for traffic from the email server and
set the source IP address to 203.0.113.25
Create a static NAT action for traffic to the email server, and set the
source IP address to 203.0.113.25 - CORRECT ANSWER ✔✔- Create a
global dynamic NAT rule for traffic from the email server and set the
source IP address to 203.0.113.25
Set the Dynamic NAT Source IP Address in a Network Dynamic NAT
rule If you want to set the source IP address for traffic that matches a
dynamic NAT rule, regardless of any policies that apply to the traffic,
select Network > NAT, and add a network dynamic NAT rule that
specifies the source IP address. The source IP address you specify must
be on the same subnet as the primary or secondary IP address of the
interface the traffic leaves. (Page 123 - Fireware Essentials Student
Guide)
Match each type of NAT with the correct description:
Conserves IP addresses and hides the internal topology of your network.
(Choose one)
1-to1 NAT
Dynamic NAT
4|Page
ESSENTIALS PRACTICE QUIZ
(100+ EXAM PRACTICE QUESTIONS
AND CORRECT ANSWERS LATEST 2026)
What is the best pattern to block an Adobe PDF document in FTP
uploads?
*{DF
*.p*
.*df
*.pdf - CORRECT ANSWER ✔✔- *.pdf
What do you need to know to set up a VPN between 2 devices?(4)
The IPSec certificate and the pre-shared key
The public IP or domain information of the VPN remote gateway
The configuration of phase 1 and phase 2 of the VPN remote gateway
The private network address on the remote device where you want to
send traffic
The name of the gateway and tunnel on the remote VPN gateway -
CORRECT ANSWER ✔✔- The IPSec certificate and the pre-shared
key.
1|Page
,The public IP or domain information of the VPN remote gateway
The configuration of phase 1 and phase 2 of the VPN remote gateway
The private network address on the remote device where you want to
send traffic
For each VLAN interface, how many untagged networks can you have?
Dependent on the firewall model
Four
One
Unlimited - CORRECT ANSWER ✔✔- One
You have configured a BOVPN and have just saved the configuration on
both devices. When you look at the tunnel status in Firebox System
Manager, the tunnel does not appear active. What could have caused
this? (3)
There is no connection between the IP addresses of the external interface
of each device
No traffic was sent to the IP address on the other side of the tunnel
There is a difference in the VPN Phase 1 or Phase 2 configuration
The name of the Gateway or the tunnel is not the same as in the remote
device. - CORRECT ANSWER ✔✔- There is no connection between
the IP addresses of the external interface of each device
No traffic was sent to the IP address on the other side of the tunnel.
2|Page
,There is a difference in the VPN Phase 1 or Phase 2 configuration
Which of these options are private IPv4 addresses you can assign to a
trusted interface, as described in RFC 1918, Address Allocation for
Private Internets(3)
192.168.50.1/24
10.50.1.1/16
198.51.100.1/24
172.16.0.1/16
192.0.2.1/24 - CORRECT ANSWER ✔✔- 192.168.50.1/24
10.50.1.1/16
172.16.0.1/16
For which of these third party authentication methods must you specify a
search base?(2)
RADIUS
Active Directory
SecurID
LDAP - CORRECT ANSWER ✔✔- Active Directory
LDAP
3|Page
, You have a privately addressed email server behind your Firebox. If you
want to make sure that all traffic from this server to the Internet appears
to come from the public IP address 203.0.113.25, regardless of policies,
which form of NAT would you use?(1)
In the SMTP policy that handles traffic from the email server, select the
optin to apply dynamic NAT to all traffic in the policy and set the source
IP address 203.0.113.25
Create a global dynamic NAT rule for traffic from the email server and
set the source IP address to 203.0.113.25
Create a static NAT action for traffic to the email server, and set the
source IP address to 203.0.113.25 - CORRECT ANSWER ✔✔- Create a
global dynamic NAT rule for traffic from the email server and set the
source IP address to 203.0.113.25
Set the Dynamic NAT Source IP Address in a Network Dynamic NAT
rule If you want to set the source IP address for traffic that matches a
dynamic NAT rule, regardless of any policies that apply to the traffic,
select Network > NAT, and add a network dynamic NAT rule that
specifies the source IP address. The source IP address you specify must
be on the same subnet as the primary or secondary IP address of the
interface the traffic leaves. (Page 123 - Fireware Essentials Student
Guide)
Match each type of NAT with the correct description:
Conserves IP addresses and hides the internal topology of your network.
(Choose one)
1-to1 NAT
Dynamic NAT
4|Page
