NSE4 Firewall Policies and NAT Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Wildcard FQDN

  Why it's wrong here

  Wildcard FQDN address objects match traffic using domain name patterns containing wildcards, such as *.example.com, and rely on DNS to resolve those names to IP addresses at the time of matching. Their decision logic is exclusively name-based, so they cannot determine or enforce policies based on the source or destination country of an IP address. This makes them unsuitable for geography-based traffic matching.

• ✗

  FQDN

  Why it's wrong here

  FQDN address objects match traffic to a specific fully qualified domain name, like www.example.com, by resolving that name to its current IP address through DNS. They identify hosts by domain identity rather than the physical or geopolitical location of the IP address, so they cannot differentiate traffic originating from or destined to a particular country. Because a single domain can resolve to IPs in multiple countries via CDNs or geo-DNS, an FQDN object is not the right tool for geographic matching.

• ✓

  Geography

  Why this is correct

  Geography address objects in FortiOS match traffic based on the country, continent, or region associated with an IP address, using the built-in GeoIP database. These objects directly support policies such as geo-blocking or allowing traffic from a specific nation, without requiring the administrator to enumerate IP ranges. This is the only object type in the list whose matching logic is explicitly based on the geopolitical location of the packet endpoints, making it the correct answer.

• ✗

  Subnet

  Why it's wrong here

  Subnet address objects match traffic by specifying an exact IP range in CIDR notation, such as 192.168.1.0/24. While an administrator could theoretically define a subnet that falls within a particular country's IP allocation, the object itself contains no geographic awareness and cannot automatically associate an address with a nation. Maintaining country-accurate subnet lists manually is impractical and error-prone, so subnets are not the appropriate type for matching traffic based on geography.

Go deeper

Related to this question