Quick Answer

The answer is to create a firewall policy with action DENY and logging enabled, placed above the implicit deny rule. This works because the implicit deny rule at the bottom of the policy list is a built-in, unmodifiable catch-all that cannot have logging toggled on; it silently drops unmatched traffic. By inserting an explicit deny policy with logging enabled above it, you intercept traffic that would otherwise fall through to the implicit rule, allowing the firewall to generate logs for those denied sessions. On the Fortinet NSE 4 exam, this question tests your understanding of policy evaluation order and the limitations of the implicit deny—a common trap is assuming you can simply enable logging on the implicit rule itself. Remember the memory tip: “If you want to log the drop, put an explicit deny on top.”