NSE4 Firewall Policies and NAT Practice Question
Which address object type allows you to match traffic based on the domain name in the HTTPS SNI field?
⚠ Common exam trap
It's easy for candidates to confuse Wildcard FQDN with standard FQDN, assuming both can match subdomains, but only Wildcard FQDN supports the asterisk (*) wildcard for pattern matching in the SNI field.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wildcard FQDN
The Wildcard FQDN address object type in FortiGate allows you to match traffic based on the domain name in the HTTPS Server Name Indication (SNI) field. Unlike a standard FQDN, which matches the exact domain, the Wildcard FQDN supports patterns like *.example.com, enabling policy enforcement for subdomains and dynamic hostnames within a domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Geography
Why it's wrong here
Geography-based address objects identify traffic by the country or region of an IP address, using geolocation databases. FortiGate matches based on the source or destination IP's geographic metadata, not on any domain or hostname. This makes it impossible to use a geography object to match traffic based on SNI or the actual website requested, since all IPs in a country are grouped together regardless of the service.
- ✓
Wildcard FQDN
Why this is correct
A Wildcard FQDN object, such as *.example.com, matches domain names using a pattern and can be compared against the Server Name Indication (SNI) field in TLS handshakes. This allows FortiGate to filter traffic based on the domain name a client requests before the connection is decrypted. It is the only address object type among these options that natively supports SNI matching, making it the correct answer when domain-based traffic identification is needed.
- ✗
Subnet
Why it's wrong here
A subnet address object defines a contiguous block of IP addresses using a network prefix, for example 192.168.1.0/24. FortiGate matches traffic solely on Layer 3 destination or source IP addresses found in the packet header. It has no visibility into domain names or TLS SNI information, so it cannot match traffic based on the hostname or website being accessed—only the IP address range.
- ✗
FQDN
Why it's wrong here
A standard FQDN object, like www.example.com, is resolved by DNS to one or more IP addresses, and FortiGate then matches traffic to those resolved addresses. Although it is derived from a domain, the matching is performed using IP addresses, not the SNI field or the hostname in the packet. Consequently, a regular FQDN object cannot match traffic based on the domain name in a TLS handshake, especially if the resolved IPs differ from the actual SNI or if DNS caching is involved.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.