NSE4 Firewall Policies and NAT Practice Question
An administrator is troubleshooting why traffic from a specific subnet (192.168.10.0/24) to the internet is not being matched by the expected firewall policy. The policy list shows an allow policy for this traffic at ID 10, but there is a deny policy at ID 5 for any traffic from 192.168.0.0/16. Which TWO statements are correct?
⚠ Common exam trap
Candidates often assume firewall policies use a 'most specific match' logic like routing, but FortiGate strictly uses sequential first-match based on policy ID order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The deny policy at ID 5 is matching the traffic before the allow policy at ID 10
FortiGate firewall policies are evaluated sequentially from top to bottom based on their policy ID. Since policy ID 5 (deny for 192.168.0.0/16) appears before policy ID 10 (allow for 192.168.10.0/24), traffic from 192.168.10.0/24 is matched by the broader deny policy first, and the allow policy is never reached. This is a fundamental behavior of FortiGate's policy lookup order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The deny policy at ID 5 is matching the traffic before the allow policy at ID 10
Why this is correct
Because FortiGate evaluates firewall policies in ascending order of policy ID, the deny at ID 5 is checked before the allow at ID 10. The source 192.168.10.0/24 is entirely within the broader 192.168.0.0/16 object used by the deny policy, so the traffic satisfies all matching criteria of ID 5 and is denied immediately, never reaching ID 10.
- ✗
The allow policy at ID 10 will override the deny policy because it is more specific
Why it's wrong here
This option assumes a longest-prefix or 'most specific match' rule, but FortiGate does not use that logic. A packet is matched against the first policy whose source, destination, service, and interface criteria are all satisfied; if that policy is a deny, the session is terminated and subsequent policies, including a more specific allow, are not evaluated.
- ✗
The traffic will be matched by the implicit deny at the end of the policy list
Why it's wrong here
The implicit deny policy is only evaluated if no explicit firewall policy matches the traffic. Because ID 5 explicitly matches and denies this source range, the session ends at that point and is never passed down to the implicit rule at the bottom of the list, so the implicit deny is irrelevant to this failure.
- ✗
The administrator should enable 'policy override' on the allow policy
Why it's wrong here
FortiGate has no configuration option named 'policy override' that lets a later allow bypass an earlier deny. Policy lookup is strictly sequential by ID, so the only ways to make the allow effective are to modify the earlier deny policy's match conditions or to reposition the allow policy before ID 5.
- ✓
The administrator should change the deny policy's source to exclude 192.168.10.0/24 or move the allow policy above ID 5
Why this is correct
The correct remediation is to ensure the deny policy no longer matches this traffic before the allow policy is considered. This can be done by changing ID 5's source to exclude 192.168.10.0/24, or by moving the allow policy above ID 5, which causes the allow to be evaluated first and permits the traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.