The answer is an address group. This is the correct object type because FortiGate firewall policies require a single source object, and an address group allows you to logically bundle multiple internal subnets—such as 192.168.1.0/24 and 10.0.0.0/16—into one reusable group, which you can then set as the source in a single policy to permit outbound DNS traffic on UDP port 53. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of object-based policy management versus creating separate policies for each subnet, a common trap being to mistakenly use a single address object with a wildcard or a virtual IP. A strong memory tip: think of an address group as a “bucket” for subnets—just as you wouldn’t carry each apple separately, you group them to simplify the load.
NSE4 Firewall Policies and NAT Practice Question
This NSE4 practice question tests your understanding of firewall policies and nat. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator needs to allow outbound DNS traffic (UDP port 53) from multiple internal subnets to the internet. Which object type should be used to group the subnets into a single source in the firewall policy?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Address group
An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
VIP group
Why it's wrong here
VIP groups are used for destination NAT (port forwarding), not for grouping source subnets.
✗
Schedule group
Why it's wrong here
Schedule groups group time-based schedules, not addresses.
✓
Address group
Why this is correct
Address groups combine multiple address objects (subnets, IP ranges, FQDNs) into one object, which can be used as source or destination in a policy.
Related concept
Read the scenario before looking for a memorised answer.
✗
Service group
Why it's wrong here
Service groups group services (ports/protocols), not IP addresses.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse address groups with service groups, mistakenly thinking that grouping subnets is done via service objects, but service groups only define protocols and ports, not IP addresses.
Detailed technical explanation
How to think about this question
Under the hood, FortiGate address groups are stored as a list of address objects in the firewall policy configuration; when a policy matches traffic, the source address is checked against all members of the group using a longest-prefix-match or exact-match logic. A subtle behavior is that address groups can contain other address groups (nested groups), but this is limited to a depth of 10 levels to prevent performance issues. In a real-world scenario, an administrator might use an address group to consolidate all internal RFC 1918 subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) into a single source for an outbound DNS policy, ensuring all internal clients can resolve external domains without multiple policy entries.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Firewall Policies and NAT — This question tests Firewall Policies and NAT — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Address group — An address group is the correct object type to group multiple internal subnets into a single source in a firewall policy. In FortiGate, address groups allow you to combine multiple IP addresses or subnets (IPv4 or IPv6) into a logical group, which can then be referenced as the source in a single firewall policy. This simplifies administration by reducing the number of policies needed to allow outbound DNS traffic from multiple subnets.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.