While reviewing logs, an administrator discovers that an incoming email was processed using policy IDs 0:4:9:INTERNAL. Which two statements describe what this policy ID means? (Choose two.)

Question

Options

• AAccess control policy number 9 was used.
• BThe FortiMail configuration is missing an access delivery rule.
• CThe email was processed using IP-based policy ID 4.
• DFortiMail is applying the default behavior for relaying inbound email.

• A
  30% (13)
• B
  14% (6)
• C
  56% (24)

Explanation

In FortiMail, a policy ID is structured as session_policy:IP_policy:recipient_policy:disposition. Breaking down 0:4:9:INTERNAL: the 4 confirms an IP-based policy with ID 4 was applied (C is correct), and INTERNAL is the disposition flag indicating FortiMail is using its default relay behavior for inbound email (D is correct).

A is wrong because 9 refers to the recipient policy ID, not the access control (session) policy - the session/access control policy is the first field, which is 0.

B is wrong because a 0 in the session policy field simply means the default access control behavior was applied, not that a rule is missing or misconfigured.

Memory tip: Think of the four fields as S-I-R-D - Session : IP : Recipient : Disposition. If you remember "Sir D" (like a knighted policy dispatcher), you can always map each position in the policy ID string correctly on the exam.

No community discussion yet for this question.