NSE4 Firewall Policies and NAT Practice Question
An administrator needs to ensure that a firewall policy applies only during business hours (Monday to Friday, 9:00 AM to 6:00 PM). What object should be configured and applied to the policy?
⚠ Common exam trap
A common mix-up: candidates confuse a schedule object with a service group or traffic shaper, mistakenly thinking time-based access can be achieved via port grouping or QoS policies, whereas FortiGate explicitly requires a schedule object for time-of-day policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Schedule object
A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service group
Why it's wrong here
A service group is simply a named collection of protocol/port definitions (for example, TCP/443 and UDP/53) that firewalls use to match traffic by destination service. It contains no time-of-day or day-of-week information, so referencing a service group in a policy does nothing to limit when that policy is active. Even with the correct service group, the policy would still be evaluated 24/7 unless a schedule is also attached to the policy — therefore it cannot meet a time-based requirement.
- ✗
Address group
Why it's wrong here
An address group is used to aggregate IP addresses, FQDNs, or geographic entries into a single source or destination identity object for policy matching. It is purely a network-layer identity construct and has no temporal dimension, so it cannot enforce that the policy applies only during certain hours. To make a policy time-aware, the administrator must attach a schedule object; an address group only helps narrow which hosts are affected, not when they are affected.
- ✓
Schedule object
Why this is correct
A schedule object is the FortiGate construct designed specifically to define when a policy is valid and enforceable, using either a recurring weekly/daily pattern or a one-time date and time range. By attaching a schedule object such as 'Business Hours' (e.g., 08:00–18:00, Monday–Friday) to the policy, FortiGate will evaluate and apply that policy only within the defined window; outside that window the policy is skipped entirely. This is exactly what the administrator needs to ensure the policy applies only at the intended times.
- ✗
Traffic shaper
Why it's wrong here
A traffic shaper controls bandwidth allocation by setting maximum rates, guaranteed bandwidth, or priority levels for matching traffic after the policy has been hit. It has no mechanism to block or allow a policy based on time of day, and it cannot make a policy automatically stop applying outside business hours. A shaper only moderates the flow of traffic that is already permitted by the policy, so attaching a shaper would neither restrict nor schedule policy activation.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.