Refer to the exhibit. Why did the FortiGate device drop the packet?

The correct answer is A. It matched the default implicit firewall policy. The packet was dropped because it matched the default implicit deny policy. Every FortiGate has a built-in implicit deny rule at the bottom of the policy list that drops all traffic not explicitly permitted by a preceding policy. This is a fundamental firewall security…

Submitted by kev92· Apr 18, 2026Firewall policies and authentication

Question

Exhibit

Options

AIt matched the default implicit firewall policy.
BIt matched an explicitly configured firewall policy with the action DENY.
CIt cannot reach the next-hop IP.
DIt failed the RPF check.

How the community answered

(32 responses)

A
91% (29)
B
3% (1)
C
3% (1)
D
3% (1)

Explanation

The packet was dropped because it matched the default implicit deny policy. Every FortiGate has a built-in implicit deny rule at the bottom of the policy list that drops all traffic not explicitly permitted by a preceding policy. This is a fundamental firewall security principle - deny by default. The exhibit's output (typically from a flow debug or packet capture) would show policy ID 0 or 'implicit deny' as the matching policy. Choice B is incorrect - an explicitly configured DENY policy would show a specific non-zero policy ID. Choice C (unreachable next-hop) would appear as a routing failure, not a policy drop. Choice D (RPF check failure) would show a specific RPF drop reason in the debug output, not a policy match.

Topics

#Firewall Policies#Implicit Deny#Packet Drop#Troubleshooting

Community Discussion

No community discussion yet for this question.

Full FCP_FGT_AD-7.6 Practice