NSE4 Firewall Policies and NAT Practice Question
A FortiGate has two firewall policies: Policy ID 1 (source: 10.0.1.0/24, destination: 203.0.113.0/24, action: allow, NAT: enabled) and Policy ID 2 (source: 10.0.1.0/24, destination: all, action: allow, NAT: enabled, IP pool: pool1). A user from 10.0.1.10 sends traffic to 203.0.113.5. Which policy will the traffic match and why?
⚠ Common exam trap
Test-takers frequently assume a broader or more inclusive policy (like 'destination all') will override a more specific one, but FortiGate's first-match logic means policy order, not specificity, determines which policy is applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy ID 1 because it is the first matching policy in the list
Policy ID 1 is correct because FortiGate uses a sequential, first-match policy evaluation model. Traffic from 10.0.1.10 to 203.0.113.5 matches the source and destination of Policy ID 1 exactly, and since it appears first in the policy list, it is applied immediately. Once a match is found, no further policies are evaluated, even if a later policy (like Policy ID 2) also matches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both policies will be applied because the traffic matches both
Why it's wrong here
FortiGate evaluates traffic against policies in a top-down sequence and stops at the first entry that fully matches the session's criteria. Because Policy ID 1 already matches, Policy ID 2 is never consulted for this session, so both policies are not applied. The firewall applies only one policy per session, and that decision is made during the initial SYN packet; subsequent packets reuse the session's policy.
- ✗
Policy ID 2 because it has a broader destination and is more inclusive
Why it's wrong here
In FortiGate, policy precedence is determined solely by the order in the policy list, not by how broad or specific the destination or other criteria are. Policy ID 2, despite having a broader destination, is evaluated only if earlier policies do not match. Since Policy ID 1 matches first, it is selected, and Policy ID 2's inclusiveness is irrelevant.
- ✓
Policy ID 1 because it is the first matching policy in the list
Why this is correct
FortiGate performs a sequential lookup from the top of the policy list, and the first policy whose source, destination, service, user, and other attributes match the packet becomes the winner. Here, Policy ID 1 meets the session's source and destination, so the lookup terminates immediately. Consequently, Policy ID 1 is the only rule applied, even if later rules are equally or more general.
- ✗
Neither policy; implicit deny will block the traffic
Why it's wrong here
The implicit deny rule is the final rule in FortiGate's policy lookup, triggered only when no preceding policy matches the traffic. Because Policy ID 1 exactly matches this session's source and destination, the firewall allows the traffic and never reaches the implicit deny. Therefore, the traffic is not blocked, and the session is established under the matching policy.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.