Block Traffic from Geographic Region: Using Geography Address Object

Quick Answer

The answer is the Geography address object type. This is correct because FortiGate firewalls leverage a built-in GeoIP database to classify IP addresses by their registered country or region, allowing policies to match traffic based on geographic location without manually listing subnets. When an admin needs to block all traffic from a specific geographic region, the Geography address object serves as the source in the firewall policy, enabling the firewall to evaluate each packet’s originating IP against the GeoIP data and deny it accordingly. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how to implement location-based access control efficiently, often appearing in policy configuration scenarios where candidates must choose between Geography, FQDN, or IP Range objects. A common trap is selecting the IP Range object, which would require manually compiling every subnet in a region—a tedious and error-prone approach. Memory tip: think “Geo = global, no manual list needed.”