NSE4 System and Network Administration Practice Question
An administrator configures a policy route to force traffic from a specific source subnet to use a particular WAN interface. After applying the configuration, the traffic still uses the default route. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse policy routes with static routes or assume that a policy route applies globally, when in fact the incoming interface is a critical matching condition that must be correctly configured for the policy to take effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy route's incoming interface is incorrectly configured
Policy routes are evaluated based on the incoming interface specified in the rule. If the incoming interface is misconfigured (e.g., set to 'any' or the wrong physical interface), the FortiGate will not match the traffic against the policy route, causing it to fall through to the routing table and use the default route. The policy route must explicitly match the interface on which the traffic enters the FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The static default route has a lower administrative distance than the policy route
Why it's wrong here
Administrative distance (AD) only ranks routes within the routing table, such as static, OSPF, or BGP routes. Policy routes are evaluated before the routing table lookup, so for matching traffic, a policy route always overrides the best-route selection. Therefore, the default route's lower AD is irrelevant because the FortiGate never consults the routing table for traffic that matches a policy route.
- ✗
The FortiGate's VDOM is enabled and the policy route is in the wrong VDOM
Why it's wrong here
If the FortiGate runs with VDOMs enabled, each VDOM has its own set of policy routes, and they only apply to traffic entering on interfaces that belong to that VDOM. A policy route placed in the wrong VDOM won't see the traffic, but this is less common than an interface mismatch within the correct VDOM. The typical symptom is that the traffic is not force-routed at all, which points to checking the incoming interface definition rather than VDOM placement.
- ✓
The policy route's incoming interface is incorrectly configured
Why this is correct
Policy routes are matched based on the incoming interface alongside source and destination criteria. If the configured incoming interface does not match the physical or logical interface on which the traffic actually enters, the FortiGate will skip the policy route and fall back to the routing table. For example, specifying port1 while traffic arrives on port2 means the policy is never evaluated, so the traffic follows the default route instead.
- ✗
The policy route has a lower priority than the static default route
Why it's wrong here
The priority (or sequence number) of a policy route determines the evaluation order among multiple policy routes, not whether it overrides the routing table. When a policy route matches, it takes precedence over any static route, including the default route, regardless of its metric or administrative distance. A lower priority (higher numeric value) simply means the route is checked later, but if it matches, it still forces the traffic as intended.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.