A SYN enters FortiGate, but no expected outbound SYN appears. Which tool can expose the firewall's route/policy/NAT decision for the CPU-processed test?

Choose the single best answer.

A.Only a routing-table listing, without inspecting policy/session decisions
B.Only the final traffic-log action, without inspecting the processing trace
C.A narrowly filtered debug-flow trace
D.Only an external server capture that cannot show FortiGate internal decisions

Show the answer and explanation

✓ Correct answer

A narrowly filtered debug-flow trace

Debug flow shows CPU processing decisions across route, policy, NAT and drops. A route listing or final log has narrower scope; a remote capture does not expose internal decision stages.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.