NSE4 Firewall Policies and NAT Practice Question
A company has a FortiGate with multiple VDOMs. An admin creates a firewall policy in the root VDOM to allow traffic from a subnet to the internet. The traffic is not matching the policy. What is the most likely cause?
⚠ Common exam trap
Many candidates assume a policy in the root VDOM applies to all traffic by default, not realizing that VDOMs create strict administrative boundaries where policies are only effective within their own VDOM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is in a different VDOM than the policy
In a multi-VDOM FortiGate, each VDOM operates as an independent virtual firewall with its own routing table, policies, and interfaces. A firewall policy created in the root VDOM only applies to traffic that enters and exits interfaces assigned to that root VDOM. If the traffic originates from or is destined to an interface belonging to a different VDOM, it will never match the root VDOM policy, causing the traffic to be dropped or handled by the correct VDOM's policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The traffic is in a different VDOM than the policy
Why this is correct
Each VDOM on a FortiGate operates as an independent virtual firewall with its own routing table, policy set, and interface associations. A firewall policy configured in the root VDOM only examines traffic whose ingress and egress interfaces belong to that same VDOM. If the traffic flows through interfaces assigned to VDOM2, the root policy is never evaluated, so the traffic is instead subject to VDOM2's own policy list, and the mismatch explains why the policy has no effect.
- ✗
The internet-facing interface is not part of any VDOM
Why it's wrong here
In FortiGate, every physical interface, VLAN subinterface, and logical tunnel must be assigned to a VDOM; there is no unassigned state. An interface that does not belong to any VDOM cannot pass traffic at all, and it would be impossible to create a firewall policy referencing it because policies require valid VDOM-specific interface objects. Therefore, this cannot be the cause of the policy not matching traffic, as the interface would not be operational.
- ✗
The subnet object is defined in the wrong address group
Why it's wrong here
Even if a subnet object is placed in the wrong address group, that only affects which source or destination addresses the policy matches. The policy itself still exists within a specific VDOM and applies to traffic in that VDOM, so address-group misconfiguration would cause the policy to match the wrong traffic or be bypassed by other policies, not to be ignored across VDOMs. The failure to apply is fundamentally due to the VDOM boundary, not the grouping of the subnet object.
- ✗
The policy is placed at the bottom of the list
Why it's wrong here
FortiGate evaluates firewall policies in sequential order based on policy ID, with the first matching policy taking effect. If a policy is placed at the bottom of the list, an earlier policy with overlapping criteria will be matched first, potentially denying or forwarding traffic in a different way. However, policy order only affects evaluation within the same VDOM's policy set; a bottom-placed policy in the correct VDOM would still be evaluated if no earlier match occurs, so this does not explain why the policy is completely absent from the traffic path across VDOMs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.