Quick Answer
The answer is to move the allow policy above the deny policy. This is correct because FortiGate firewalls evaluate policies in a strict top-down order, meaning the first matching policy in the list is applied to the traffic. Since the explicit deny policy sits above the allow rule, it matches the subnet first and drops the traffic before the allow policy can ever be considered. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your understanding of policy sequencing and the common trap of placing a broad deny rule above a specific allow rule. A frequent memory tip is to think of the policy list as a waterfall: the first policy that catches the traffic determines its fate, so always place your most specific allow policies near the top. Remember the mnemonic "Allow Above Deny" to avoid blocking legitimate traffic.
This NSE4 practice question tests your understanding of firewall policies and nat. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?
Add a new policy with a higher ID
Why wrong: Adding a policy with higher ID places it lower, making it less likely to match.
Move the allow policy above the deny policy
Changing order ensures the allow policy matches first.
Disable the deny policy
Why wrong: Disabling might be acceptable, but reordering is the standard fix.
Delete the deny policy
Why wrong: Deleting may not be desired; reordering is better.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Move the allow policy above the deny policy
Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Add a new policy with a higher ID
Why it's wrong here
Adding a policy with higher ID places it lower, making it less likely to match.
Move the allow policy above the deny policy
Why this is correct
Changing order ensures the allow policy matches first.
Related concept
CIDR notation defines the prefix length.
Disable the deny policy
Why it's wrong here
Disabling might be acceptable, but reordering is the standard fix.
Delete the deny policy
Why it's wrong here
Deleting may not be desired; reordering is better.
Common exam traps
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related NSE4 subnetting questions on CIDR, address ranges, and subnet selection.
Firewall Policies and NAT — study guide chapter
Learn the concepts, then practise the questions
Firewall Policies and NAT practice questions
Targeted practice on this topic area only
All NSE4 questions
1,000 questions across all exam domains
Fortinet NSE 4 Network Security Professional NSE4 study guide
Full concept coverage aligned to exam objectives
NSE4 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE4 questions linked to System and Network Administration.
Practise NSE4 questions linked to Firewall Policies and NAT.
Practise NSE4 questions linked to Authentication and VPN.
Practise NSE4 questions linked to Security Profiles.
Practise NSE4 questions linked to High Availability and Diagnostics.
Practise NSE4 questions linked to NSE4 fundamentals.
Practise NSE4 questions linked to NSE4 scenario.
Practise NSE4 questions linked to NSE4 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Firewall Policies and NAT — This question tests Firewall Policies and NAT — CIDR notation defines the prefix length..
The correct answer is: Move the allow policy above the deny policy — Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related NSE4 subnetting questions on CIDR, address ranges, and subnet selection.
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?
mediumWhy A: FortiGate matches firewall policies from top to bottom. Policy 5 is higher in the policy list order than policy 10, so traffic matches policy 5 first and never reaches policy 10.
Variation 2. A FortiGate is configured with multiple policies. The first policy allows traffic from 10.0.0.0/8 to any destination. The second policy denies traffic from 10.0.1.0/24 to any destination. What happens when a packet from 10.0.1.5 to 8.8.8.8 arrives?
hardWhy B: FortiGate firewall policies are evaluated in sequential order from top to bottom. The first policy matches source 10.0.0.0/8, which includes 10.0.1.5, and allows the traffic to any destination. Since the packet matches this policy first, it is accepted and the second policy is never evaluated. Therefore, the packet is allowed by the first policy.
Variation 3. A FortiGate has two firewall policies: Policy 1 (ID 1) allows HTTP from any to 10.0.0.0/8, and Policy 2 (ID 2) denies all traffic from 192.168.1.0/24 to any. Traffic from 192.168.1.10 to 10.0.0.5 on port 80 is received. Which policy will match first?
easyWhy A: Policy 1 (ID 1) matches first because FortiGate evaluates firewall policies in sequential order from top to bottom (lowest ID to highest ID) until a match is found. The source IP 192.168.1.10 falls within the 'any' source of Policy 1, and the destination 10.0.0.5 is within 10.0.0.0/8, with HTTP (port 80) matching the service. Since Policy 1 matches, it is applied and the traffic is accepted, even though Policy 2 would also match if reached.
Last reviewed: Jun 21, 2026
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.