StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 403 of 440 · medium

Why does bidirectional IPsec protection involve directional SA state?

Choose the single best answer.

  1. A.All traffic uses one TCP session over port 50.
  2. B.Only the initiating gateway can ever encrypt packets.
  3. C.An IPsec SA is unidirectional, so a pair handles the two directions.
  4. D.An SA is only a GUI policy label and carries no cryptographic state.
Show the answer and explanation

✓ Correct answer

  • An IPsec SA is unidirectional, so a pair handles the two directions.

Directional SAs carry the cryptographic state for each direction. They are not merely policy labels; ESP is not TCP port 50, and both gateways can send protected traffic using the relevant SA.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.