NSE4 Firewall Policies and NAT Practice Question
A network administrator configures a firewall policy allowing HTTP traffic from the internal network (10.0.0.0/8) to the internet. After applying the policy, users report they can browse the web, but the FortiGate logs show that all sessions are using the 'implicit deny' policy ID 0. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume a policy with correct source/destination addresses will match regardless of the interface setting, but FortiOS strictly enforces interface matching, and a mismatch causes the policy to be ignored, leading to the implicit deny being hit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source interface on the policy is set to the WAN interface instead of the internal interface
If the source interface on the firewall policy is set to the WAN interface instead of the internal interface, traffic arriving from the internal network (10.0.0.0/8) on the internal interface will not match that policy. The FortiGate then falls through to the implicit deny policy (ID 0), which logs and drops the session. Since HTTP traffic is still reaching the internet, it suggests that another mechanism (such as a default route or NAT) is allowing the traffic, but the policy matching fails due to the interface mismatch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The source interface on the policy is set to the WAN interface instead of the internal interface
Why this is correct
If the source interface is wrong, the traffic will not match this policy. The administrator may have a different policy (or the implicit allow) allowing the traffic, but the logs show the implicit deny is being hit because the correct policy is not matched.
- ✗
Central NAT is enabled and overriding the policy-based NAT
Why it's wrong here
Central NAT does not affect policy matching; it only changes NAT behavior.
- ✗
The policy has a schedule applied that is currently inactive
Why it's wrong here
If the schedule were inactive, the traffic would be denied, not allowed.
- ✗
The policy is placed after the implicit deny rule
Why it's wrong here
The implicit deny is always last; policies cannot be placed after it.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.