Exam FCP_FGT_AD-7.4 topic 1 question 28 discussion

The debug line that matters is the last one: ``` ... fw_forward_handler ... msg="Denied by forward policy check (policy 0)" ``` * **“policy 0”** is FortiGate’s built-in **implicit deny rule**. – Whenever no user-configured firewall policy matches a packet, the FortiGate moves to policy 0 and drops it. Because the packet was rejected by **policy 0**, we know: * It did **not** hit any explicit (numbered) policy you created. * It wasn’t dropped for RPF or routing reasons—those would show different messages. So the correct reason is: **D. It matched the default implicit firewall policy.**

Don't get confused with the word "check", the important part is (policy 0), that's the implicit policy

D is correct. It's clear, "Denied by forward policy check (policy 0)"

It's D

D is correct

D is correct - traffic is denied by implicit firewall rule

Policy id 0 is the default drop policy. so D is correct

Denied by forward policy check means it matched a deny policy, in this case it has ID 0 so it is the implicit deny

D because the output shows "Denied by forward policy check (policy 0)" which is the implicit policy