NSE4 System and Network Administration Practice Question
An administrator is troubleshooting a connectivity issue. A ping from the FortiGate to 8.8.8.8 succeeds, but traffic from internal hosts to the internet is failing. The firewall policy allows the traffic. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a successful ping from the FortiGate implies end-to-end connectivity, overlooking that the internal hosts' default gateway configuration is independent of the FortiGate's own routing table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The internal hosts have the wrong default gateway configured
Since the FortiGate can ping 8.8.8.8, its default route and internet connectivity are working. The issue is that internal hosts cannot reach the internet, which points to a Layer 3 forwarding problem at the host level. The most likely cause is that the internal hosts have the wrong default gateway configured, so their traffic is not being sent to the FortiGate for routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default route on the FortiGate is missing
Why it's wrong here
For the FortiGate to successfully ping 8.8.8.8, it must have a valid route to that destination—usually a default route pointing to its next-hop gateway. If the default route were missing, the FortiGate would return 'Destination host unreachable' because no route exists for the packet. Thus, the administrator's test proves the FortiGate's routing is operational, so this cannot explain why internal hosts fail to connect.
- ✓
The internal hosts have the wrong default gateway configured
Why this is correct
Hosts forward traffic to destinations outside their subnet via their configured default gateway; in this network, that gateway should be the FortiGate's internal interface IP. If the hosts point to a different or nonexistent IP, their packets for internet destinations are sent to a device that cannot forward them, so the traffic never reaches the FortiGate. Even though the FortiGate can ping 8.8.8.8, the hosts remain isolated, which precisely matches the reported symptoms.
- ✗
DNS resolution is failing
Why it's wrong here
The administrator's connectivity test to 8.8.8.8 uses a raw IP address, so a DNS failure would have no impact on that test. DNS is only required when resolving hostnames to IPs; if DNS were broken, pinging an IP would still work perfectly. Since the problem is that clients cannot reach external destinations even by IP, the cause is strictly routing or forwarding, not name resolution.
- ✗
The FortiGate's interface to the internal network is down
Why it's wrong here
If the interface were down, the FortiGate likely wouldn't be able to ping from itself either, but it could still ping if the internal interface is separate? Actually ping from FortiGate uses its own routing, so internal interface down would not affect pinging 8.8.8.8 if default route is via port1. So internal interface could be down and still ping. But then internal hosts wouldn't reach the FortiGate. So this is plausible. However, the most likely is wrong gateway.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.