NSE4 Firewall Policies and NAT Practice Question
A network administrator has configured a firewall policy allowing traffic from the internal network (10.0.0.0/8) to the internet. Users report that some websites are not loading. The administrator runs 'diagnose firewall iprope list 100000' and sees the policy listed with a hit count of zero. What is the MOST likely cause?
⚠ Common exam trap
Test-takers frequently assume a zero hit count means the policy is not working due to misconfiguration or routing, but the real issue is policy ordering and the top-down match-first behavior of FortiGate firewalls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is placed below a more specific or broader policy that matches the same traffic
A hit count of zero indicates the firewall policy has never matched any traffic. When a more specific or broader policy exists above it in the sequence, the FortiGate processes policies top-down and stops at the first match, so the lower policy never gets evaluated. This is the most likely cause given that the policy is present but unused.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source interface or destination interface is incorrectly configured
Why it's wrong here
Incorrectly configured source or destination interfaces prevent the policy from being a candidate for matching, because FortiGate selects a policy by comparing the actual ingress/egress interfaces with the configured interface pair. However, if this policy's interface pair were wrong, traffic would simply skip it and be evaluated against lower-priority policies, meaning a zero hit count would also be observed but only if no subsequent policy matches. The more plausible explanation for zero hits while traffic flows is that an earlier policy with a matching interface pair is superseding this rule, not that the interface pair is misconfigured.
- ✗
The policy has a schedule that does not match the current time
Why it's wrong here
A schedule that does not match the current time would render the policy inactive during this period, and FortiGate would not increment the hit count for it. Yet a schedule mismatch is a single, easily verifiable variable, and it would only cause zero hits if the schedule object or system time is incorrect. In contrast, policy precedence is a structural issue that silently shadows this rule without any error, making it the more likely root cause when all other parameters (interfaces, addresses, ports) appear correct.
- ✓
The policy is placed below a more specific or broader policy that matches the same traffic
Why this is correct
FortiGate firewall policies are evaluated top-down and the first policy that matches all configured criteria (source, destination, interface, and service) is executed; lower policies are never reached if a higher policy matches the same traffic. This means a broader policy placed above this specific rule—for example, an any-to-any policy—will shadow it, causing this rule's hit count to remain zero. Since FortiGate uses first-match rather than best-match, rule ordering is critical, and moving this rule above the broad policy would restore its visibility and hit count.
- ✗
The FortiGate has a routing issue preventing traffic from reaching the internet
Why it's wrong here
A routing issue impacts the forwarding plane after policy matching has already occurred; FortiGate performs the policy lookup first and then consults the routing table to determine egress. If a packet matches a policy with action 'accept', the hit counter is incremented even if the subsequent route lookup fails and the packet is dropped. Therefore, a routing problem would not explain zero hits on this policy—traffic would still increment its count before being dropped, so the absence of hits points earlier in the pipeline, specifically to policy preprocessing and ordering.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.