A broad internet rule precedes a narrow training-application rule. The narrow rule’s traffic counters remain empty. Which change should be evaluated with controlled tests?

Choose the single best answer.

A.Disable source-NAT on every internet policy.
B.Put the intended specific rule before the matching broad rule.
C.Lower the narrow rule’s firewall policy ID only.
D.Replace the route with a blackhole.

Show the answer and explanation

✓ Correct answer

Put the intended specific rule before the matching broad rule.

Rule sequence can allow the broad selector to take traffic before the specific requirement. Policy numbering is a different mechanism. Blackholing or globally disabling NAT changes reachability without fixing the rule-order issue.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.