Firewall Policies and NAT →easyMultiple ChoiceObjective-mapped

NSE4 Firewall Policies and NAT Practice Question

Which of the following is the default action of a FortiGate firewall policy if no policy matches the traffic?

⚠ Common exam trap

Test-takers frequently confuse the default action of a firewall with the default action of a router (which forwards traffic) or assume that FortiGate logs all denied traffic by default, but neither is true; the implicit deny is silent unless explicitly configured to log.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deny

FortiGate firewall policies operate on a 'first-match' basis, and if no policy matches the traffic, the default action is to deny the traffic. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall. The implicit deny rule is automatically applied at the end of the policy list and cannot be removed or modified.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Log and drop
Why it's wrong here
Logging requires explicit configuration; implicit deny does not log by default.
✗
Redirect to authentication
Why it's wrong here
Authentication is not a default action.
✗
Accept
Why it's wrong here
Accept is not the default; it must be explicitly configured.
✓
Deny
Why this is correct
Traffic that does not match any policy is implicitly denied.

Visual reference

Go deeper

NSE4 Firewall Policies and NAT Practice Question

Why each option matters

Option-by-option breakdown

Related to this question