Quick Answer

The answer is to enable logging on the firewall policy, create the policy with the correct source, destination, and service, and apply an antivirus profile. This is correct because a FortiGate firewall policy must explicitly permit SMTP traffic from the internal network (10.0.0.0/8) to the DMZ mail server (172.16.0.10) on TCP port 25, with the action set to ACCEPT; without this policy, the traffic is implicitly denied. The antivirus profile is then attached to scan the SMTP payload for threats, and logging must be enabled on the policy itself to capture session details for auditing. On the Fortinet NSE 4 exam, this scenario tests your understanding of policy-based security profiles and the distinction between enabling logging on the policy versus relying on default log settings—a common trap is forgetting to toggle logging on, as default logging is often disabled. A useful memory tip is “PAL”: Policy, Antivirus, Logging—each step is mandatory for a complete, auditable SMTP traffic flow.