Using FQDN Address Objects for Dynamic Destination IPs
An administrator needs to configure a firewall policy that allows internal users to access a specific web server on the internet using its domain name. The web server's IP address may change. Which type of address object should be used as the destination in the policy?
Quick Answer
The answer is the FQDN address object. This is the correct choice because an FQDN address object allows the firewall to dynamically resolve a domain name to its current IP addresses at the time of policy evaluation, ensuring the policy remains effective even when the web server’s destination IP changes. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how FortiGate handles dynamic IP scenarios in firewall policies, often appearing in questions about cloud-hosted or CDN-backed services where IPs are not static. A common trap is selecting a subnet or IP range object, which would break when the server’s IP changes. Remember the memory tip: “FQDN for the flier, subnet for the sitter”—use FQDN when the destination IP is subject to change, and a subnet only when the IP is fixed.
⚠ Common exam trap
A common mix-up: candidates confuse FQDN objects with static DNS entries or assume a subnet object is sufficient, overlooking the dynamic IP change scenario that FQDN objects are specifically designed to handle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FQDN address object
An FQDN (Fully Qualified Domain Name) address object allows the firewall to resolve the domain name to an IP address dynamically. This is essential when the web server's IP address may change, as the firewall will periodically perform DNS resolution to update the destination IP in the policy, ensuring continuous access without manual reconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP Range object that covers the entire public IP space
Why it's wrong here
An IP range spanning the entire public address space matches every internet destination, granting far broader access than the one web server required. Such ranges suit broad egress rules, not a single host identified by a domain name that changes.
- ✗
Subnet object with the current IP address
Why it's wrong here
A subnet object pins the destination to a fixed address range, so when the web server's IP changes the policy silently stops matching. A fully qualified domain name object resolves the domain dynamically, which is exactly what a changing IP requires.
- ✓
FQDN address object
Why this is correct
An FQDN address object resolves the domain name to its current IP addresses and refreshes them via DNS, so the policy keeps working when the server's address changes. A static IP object would break on change, failing the requirement that the destination track the domain.
- ✗
Geography object
Why it's wrong here
Geography objects match traffic by country or region derived from IP geolocation, not by a specific server's domain name. They suit blocking or allowing whole regions, whereas a single web server whose address changes needs a fully qualified domain name object.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator needs to create a firewall policy that allows outbound traffic to the internet but denies access to a specific list of malicious IP addresses. The malicious IP list is updated frequently. Which address object type should be used for the destination addresses to block?
easy- A.IP Range address object
- ✓ B.FQDN address object
- C.Geography address object
- D.Subnet address object
Why B: FQDN address objects can resolve to a list of IP addresses that change dynamically, making them suitable for frequently updated IP lists. Subnet objects are static.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.