NSE4 System and Network Administration Practice Question
An administrator configures a policy route to send all traffic from a specific subnet to a different next-hop. However, traffic from that subnet is still using the default route. Which configuration could be causing this?
⚠ Common exam trap
It's easy for candidates to assume policy routes apply globally to all traffic matching the source/destination, forgetting that FortiGate requires the incoming interface to be explicitly specified for policy routes to be evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy route is applied to the wrong incoming interface
Policy routes are evaluated based on the incoming interface of the traffic. If the policy route is applied to the wrong incoming interface, traffic from the specified subnet arriving on a different interface will not match the policy and will instead follow the default route. This is a common misconfiguration where the administrator assumes the policy applies globally rather than per-interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy denies the traffic before policy routing
Why it's wrong here
Policy routing is evaluated before firewall policy lookup in FortiOS, so a firewall policy cannot deny traffic prior to the policy route. Even a deny policy is only consulted after the packet has been matched to a route, meaning it cannot preempt a policy route match. Therefore, this is not a valid explanation for why traffic did not follow the policy route.
- ✓
The policy route is applied to the wrong incoming interface
Why this is correct
Policy routes are tied to a specific incoming interface, so if the traffic arrives on a different interface than the one specified in the policy route, the route will never be evaluated. The administrator must confirm that the policy route's incoming interface matches the physical port where the traffic actually enters the FortiGate. Since the policy route is not applied on the wrong interface, the traffic follows the normal routing table, and the intended policy behavior is not observed.
- ✗
The default route has a higher administrative distance
Why it's wrong here
Administrative distance is a metric used to compare static and dynamic routes within the routing table; it has no bearing on policy routes, which take precedence over all routing-table entries. Even if the default route has a higher administrative distance, it only makes that default route less preferred as a regular route, but the policy route is still processed first. Thus, the default route's AD cannot cause the policy route to be bypassed.
- ✗
The policy route destination is set to all
Why it's wrong here
Setting the destination to 'all' expands the policy route's match criteria to any destination IP, making the route more likely to apply, not less. A destination of 'all' would not cause the policy route to be skipped; instead, it would match traffic to any destination, so the issue must originate from another matching parameter such as the source interface or source address. This option is incorrect because it would actually increase the policy route's coverage rather than prevent it from being used.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.