NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate administrator observes that traffic from an internal user to the internet is being blocked. The firewall policy allows the traffic, and the user can ping external hosts. The administrator runs 'diagnose debug flow' for the user's IP and sees 'session denied by forward policy check'. What is the MOST likely cause?
⚠ Common exam trap
Watch out — candidates often confuse 'forward policy check' with local-in policies or security profiles, but the debug flow message specifically points to the firewall policy lookup stage, where the implicit deny is the default action when no explicit allow policy matches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is an implicit deny policy blocking the traffic
The 'session denied by forward policy check' message in a debug flow output indicates that the session was explicitly denied by a firewall policy check, not by a security profile or rate-limiting mechanism. Since the firewall policy allows the traffic, the most likely cause is the implicit deny policy at the end of the policy list, which blocks any traffic that does not match an explicit allow policy. The ability to ping external hosts suggests ICMP is allowed by a separate policy, while TCP/UDP traffic for other services is hitting the implicit deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
There is an implicit deny policy blocking the traffic
Why this is correct
The forward policy check indicates that no explicit policy matches the traffic, so it is denied by the implicit deny.
- ✗
The antivirus profile has detected a threat and is blocking the session
Why it's wrong here
Antivirus blocking would show a different error, such as 'denied by AV profile'.
- ✗
The user's traffic is being rate-limited by a traffic shaper
Why it's wrong here
Rate limiting would not deny the session; it would shape it.
- ✗
The user's source IP is in a local-in policy that denies the traffic
Why it's wrong here
Local-in policies affect traffic destined to the FortiGate itself, not forwarded traffic.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.