NSE4 Firewall Policies and NAT Practice Question
An administrator is troubleshooting a FortiGate firewall policy that is supposed to allow HTTP traffic from the internal network to the internet. The policy is configured with source 'all', destination 'all', service 'HTTP', and action 'ACCEPT'. However, users report that HTTP traffic is being blocked. The administrator checks the policy list and sees that the policy is enabled. What is the most likely reason for the block?
⚠ Common exam trap
The trap here is assuming that an enabled allow policy will always permit traffic, ignoring the sequential evaluation order where an earlier deny policy can override it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is placed below a more specific deny policy that matches the traffic.
Firewall policies on a FortiGate are processed sequentially from top to bottom. The first policy that matches the traffic determines the action. If a deny policy appears earlier in the list and matches the same source, destination, and service, the traffic will be blocked regardless of a later allow policy. Therefore, the most likely cause is that the allow policy is positioned below a conflicting deny policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service 'HTTP' is not defined in the FortiGate services list.
Why it's wrong here
FortiGate includes predefined services like HTTP (TCP/80). If it were missing, the policy would not be configurable with that service, and the administrator would see an error. Since the policy is configured with service 'HTTP', it is defined. This is not the cause of the block.
- ✓
The policy is placed below a more specific deny policy that matches the traffic.
Why this is correct
Firewall policies are evaluated top-down, and the first matching policy is applied. If a deny policy appears above the allow policy and matches the same traffic (e.g., source 'all', destination 'all', service 'ALL'), then HTTP traffic will be blocked before reaching the allow policy. The administrator should check the policy order and move the allow policy above any conflicting deny policy.
- ✗
The policy has NAT disabled, so return traffic cannot find its way back.
Why it's wrong here
NAT affects source address translation for outbound traffic, but without NAT, the internal IP would be used and might still work if routing is correct. However, the issue is that traffic is blocked, not that return traffic fails. The policy action is ACCEPT, so NAT status does not cause a block in the forward direction.
- ✗
The policy does not have a schedule applied, so it is always active.
Why it's wrong here
A policy without a schedule is always active, which would allow traffic at any time. That would not cause a block. In fact, if a schedule were applied and the current time was outside the schedule, the policy would be inactive and traffic might be blocked, but here no schedule is applied, so this is not the reason.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.