Based on the routing table shown in the exhibit, which two statements are true? (Choose two answers)

A. A packet with the source IP address 10.100.110.10 arriving on port3 is allowed if strict RPF is disabled.
B. A packet with the source IP address 10.100.110.10 arriving on port2 is allowed if strict RPF is enabled.
C. A packet with the source IP address 10.0.13.10 arriving on port2 is allowed if strict RPF is disabled.
D. A packet with the source IP address 10.10.10.10 arriving on port2 is allowed if strict RPF is enabled.

Correct Answer: B,C

Brave-Dump Clients Votes

BC 66.67%

AC 33.33%

Comments

Mahboab Ali Ghaleb 2025-07-10 07:27:55

Selected Answers: A, C

also B is Correct

Ahmed Ezzat 2025-07-19 02:47:09

Selected Answers: B, C

Why B is wrong?

Sanjay Jairaj 2025-08-23 22:56:08

Selected Answers: B, C

Option D is clearly wrong. With strict RPF enabled, the FortiGate checks that the return path to the source would use the same interface the packet arrived on
defencedev.com
. For a source of 10.10.10.10, the routing table shows the return path is via the 10.10.10.0/24 route on port 3. If such a packet arrives on port 2, the return path doesn’t match and strict RPF drops it.

Option A is not considered correct in the exam, even though it can appear reasonable. When strict RPF is disabled, FortiGate uses loose RPF, which permits a packet as long as there is a route back to the source
defencedev.com
. In this case the only route back to 10.100.110.10 is the default route via port 2, not the incoming port 3. Exam guidance takes a conservative view that, without a more specific route to the source (and with no RPF enabled on that interface), such a packet would not be accepted. Hence, the exam omits Option A and selects only B and C as the correct answers.

Guilherme Bastos 2026-07-07 17:05:29

Selected Answers: B, C

The correct answer is B and C;
A) is incorrect because RPF looks for route back to the source IP using the same port, as in pg 130 of the study guide: "Feasible path: Formerly known as loose, it’s the default mode. In this mode, FortiGate verifies that the
routing table contains a route that matches the source address of the packet and the incoming interface.
The matching route doesn’t have to be the best route in the routing table for that source address. It just has
to match the source address and the incoming interface of the packet."

When the packet 10.100.110.10 arrives at port 3, the only route back available is the default route on port 2, it is dropped because the ports don't match.

Ahmed El Hasseen El Tom El Shaikh Berair 2026-07-14 10:28:23

Selected Answers: A, C

Anonymous User 2026-08-19 14:51:49

Selected Answers: B, C

Statement B is true because the source IP falls back to the default route, which points to port2, passing the strict RPF requirement for that interface and
C is true because when strict RPF is disabled, the firewall accepts the packet as long as a valid routing path back to the source exists on port2