View all questions & answers for the NSE 4 - FortiOS 7.6 Administrator Exam Materials exam
NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #70 Discussion
Community Explanations & Comments (7)
Mahboab Ali Ghaleb
1 year ago
Selected: A, C
also B is Correct
Ahmed Ezzat
1 year ago
Selected: B, C
Why B is wrong?
Sanjay Jairaj
1 year ago
Selected: B, C
Option D is clearly wrong. With strict RPF enabled, the FortiGate checks that the return path to the source would use the same interface the packet arrived on
defencedev.com
. For a source of 10.10.10.10, the routing table shows the return path is via the 10.10.10.0/24 route on port 3. If such a packet arrives on port 2, the return path doesn’t match and strict RPF drops it.
Option A is not considered correct in the exam, even though it can appear reasonable. When strict RPF is disabled, FortiGate uses loose RPF, which permits a packet as long as there is a route back to the source
defencedev.com
. In this case the only route back to 10.100.110.10 is the default route via port 2, not the incoming port 3. Exam guidance takes a conservative view that, without a more specific route to the source (and with no RPF enabled on that interface), such a packet would not be accepted. Hence, the exam omits Option A and selects only B and C as the correct answers.
defencedev.com
. For a source of 10.10.10.10, the routing table shows the return path is via the 10.10.10.0/24 route on port 3. If such a packet arrives on port 2, the return path doesn’t match and strict RPF drops it.
Option A is not considered correct in the exam, even though it can appear reasonable. When strict RPF is disabled, FortiGate uses loose RPF, which permits a packet as long as there is a route back to the source
defencedev.com
. In this case the only route back to 10.100.110.10 is the default route via port 2, not the incoming port 3. Exam guidance takes a conservative view that, without a more specific route to the source (and with no RPF enabled on that interface), such a packet would not be accepted. Hence, the exam omits Option A and selects only B and C as the correct answers.
Guilherme Bastos
3 months ago
Selected: B, C
The correct answer is B and C;
A) is incorrect because RPF looks for route back to the source IP using the same port, as in pg 130 of the study guide: "Feasible path: Formerly known as loose, it’s the default mode. In this mode, FortiGate verifies that the
routing table contains a route that matches the source address of the packet and the incoming interface.
The matching route doesn’t have to be the best route in the routing table for that source address. It just has
to match the source address and the incoming interface of the packet."
When the packet 10.100.110.10 arrives at port 3, the only route back available is the default route on port 2, it is dropped because the ports don't match.
A) is incorrect because RPF looks for route back to the source IP using the same port, as in pg 130 of the study guide: "Feasible path: Formerly known as loose, it’s the default mode. In this mode, FortiGate verifies that the
routing table contains a route that matches the source address of the packet and the incoming interface.
The matching route doesn’t have to be the best route in the routing table for that source address. It just has
to match the source address and the incoming interface of the packet."
When the packet 10.100.110.10 arrives at port 3, the only route back available is the default route on port 2, it is dropped because the ports don't match.
Ahmed El Hasseen El Tom El Shaikh Berair
3 months ago
Selected: A, C
70
Anonymous User
2 months ago
Selected: B, C
Statement B is true because the source IP falls back to the default route, which points to port2, passing the strict RPF requirement for that interface and
C is true because when strict RPF is disabled, the firewall accepts the packet as long as a valid routing path back to the source exists on port2
C is true because when strict RPF is disabled, the firewall accepts the packet as long as a valid routing path back to the source exists on port2
Based on the routing table shown in the exhibit, which two statements are true? (Choose two answers)
Brave-Dump Community Votes