Blocking FQDNs with Wildcard Address Objects on FortiGate
An administrator needs to block access to specific websites based on their FQDN (e.g., *.example.com). The FortiGate should match the destination domain regardless of the IP address the domain resolves to. Which type of address object should the admin use in the firewall policy destination?
Quick Answer
The correct answer is the Wildcard FQDN address object. This object type is specifically designed to block access to domains matching a pattern like *.example.com, because it enforces policy based on the destination domain name rather than the IP address the domain resolves to. The FortiGate achieves this by inspecting the SNI field in the TLS handshake or the Host header in HTTP traffic, allowing it to match the FQDN pattern regardless of backend IP changes. On the Fortinet NSE 4 exam, this concept tests your understanding of DNS-based policy enforcement and the distinction between FQDN, wildcard FQDN, and IP-based address objects—a common trap is confusing a standard FQDN object (which resolves to a single IP) with a wildcard FQDN object (which matches a domain pattern). Remember the memory tip: “Wildcard FQDN matches the pattern, not the packet’s IP.”
⚠ Common exam trap
Many exam-takers confuse a standard FQDN object with a Wildcard FQDN object, assuming the FQDN object supports wildcard patterns or dynamic IP resolution, when in fact it only resolves to a static IP at policy installation time and cannot match patterns like *.example.com.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wildcard FQDN object
A Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Geography object
Why it's wrong here
Geography objects match by country.
- ✗
Subnet object
Why it's wrong here
Subnet objects match IP ranges, not domain names.
- ✓
Wildcard FQDN object
Why this is correct
Wildcard FQDN supports patterns with * to match multiple domains.
- ✗
FQDN object
Why it's wrong here
FQDN object matches a single specific domain, not a wildcard pattern.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator needs to block access to a specific website using FQDN address objects. Which TWO steps are necessary?
medium- ✓ A.Create an FQDN address object for the website
- ✓ B.Add a firewall policy with destination set to the FQDN object and action DENY
- C.Create a wildcard FQDN address object
- D.Configure a DNS filter to block the FQDN
- E.Create a VIP for the website
Why A: Creating an FQDN address object (Option A) is necessary because it allows the firewall to resolve the fully qualified domain name to an IP address dynamically, enabling policy enforcement based on the domain rather than a static IP. Adding a firewall policy with destination set to that FQDN object and action DENY (Option B) is required to actually block traffic to the website by matching the resolved IP addresses against the policy. Without both steps, the firewall cannot identify and deny traffic to the specific website using FQDN-based control.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.