NSE4 Firewall Policies and NAT Practice Question
An administrator is configuring a firewall policy on a FortiGate to allow internal users to access a web server on the internet. The administrator wants to log all traffic that matches this policy. Which logging option should be enabled on the policy to log traffic at the session start and end?
⚠ Common exam trap
Test-takers frequently confuse 'Log Allowed Traffic - All Sessions' with 'Generate Logs when Session Starts', which only logs the beginning of a session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log Allowed Traffic - All Sessions
To log all allowed traffic including session start and end, the administrator should enable 'Log Allowed Traffic' and select 'All Sessions'. This setting ensures that every session matching the policy is logged, providing comprehensive visibility. Other options like logging only security events or only session start do not meet the requirement. Capture Packets is for troubleshooting, not logging. This configuration is essential for auditing and monitoring network activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Log Allowed Traffic - All Sessions
Why this is correct
This is correct because selecting 'All Sessions' under 'Log Allowed Traffic' causes the FortiGate to log every session that matches the policy, including the start and end of the session. This provides a complete record of allowed traffic. It is the appropriate setting when the administrator wants to log all traffic for auditing or troubleshooting purposes.
- ✗
Generate Logs when Session Starts
Why it's wrong here
This option, when enabled, generates a log entry only at the start of a session. It does not log the end of the session. While it can be useful for tracking session initiation, it does not provide the full session details that the administrator wants. The requirement is to log both start and end, so this alone is insufficient.
- ✗
Log Allowed Traffic - Security Events
Why it's wrong here
This option logs only security events such as intrusions or virus detections, not all allowed traffic. It is used when you want to log only when a security profile detects a threat. For logging all sessions, this option would not capture the start and end of each session. It is not the correct choice for comprehensive traffic logging.
- ✗
Capture Packets
Why it's wrong here
Capture Packets is a diagnostic feature that captures packet data for troubleshooting, not a logging option for traffic sessions. It does not create log entries for session start and end. Enabling it would consume resources and is not intended for regular traffic logging. It is not the correct setting for this requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.