NSE4 Firewall Policies and NAT Practice Question
A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?
⚠ Common exam trap
It's easy for candidates to assume all traffic from the same subnet is treated identically, overlooking that FortiGate policy matching is first-match and can differentiate based on other attributes like source port or user identity, leading to inconsistent profile application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic
When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate is using a proxy server that caches different results for different users
Why it's wrong here
A proxy server that caches different results for different users is not the cause here because FortiGate's explicit proxy would require per-user proxy policies and authentication, and a transparent proxy does not cache content in a way that would alter policy decision outcomes. Even if proxy caching were in play, web filter profiles are still applied at the policy layer before any cache lookup, so the symptom of inconsistent filtering would not result from cache variance alone.
- ✗
The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent
Why it's wrong here
The FortiGuard rating being inconsistent for the same URL or category is extremely unlikely because FortiGuard uses a centralized, globally consistent rating database. A web filter profile set to 'allow' would not cause some users to see blocked content and others to see allowed content for the same destination, since the profile's action is static per policy, not per user.
- ✗
The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing
Why it's wrong here
An FQDN destination that resolves to different IPs via DNS load balancing could theoretically cause different behavior, but FortiGate resolves FQDNs once and caches the IP for the policy; subsequent sessions reuse that cached resolution. Furthermore, DNS load balancing typically serves the same set of servers to all users, and even if different IPs were returned, the web filter profile applied would still be the same for traffic matching the same policy, so this cannot explain per-user filtering differences.
- ✓
Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic
Why this is correct
This is the correct answer because FortiGate firewall policies are matched in order of policy ID (and any explicit sequencing), and the first matching policy is enforced. If a higher-priority policy (lower policy ID) matches certain users' traffic (e.g., based on source IP, user group, or interface) and that policy lacks a web filter profile, those users bypass the intended filtering entirely, while others match the intended lower-priority policy that has the restrictive web filter profile.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.