StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 410 of 440 · medium

A route-based VPN policy references a tunnel virtual interface. An older note says its action must be IPsec. Which action model is appropriate here?

Choose the single best answer.

  1. A.Always use the legacy policy-based Action IPsec instead.
  2. B.Use DENY because encrypted packets do not need an accepting policy.
  3. C.Use Exempt as the firewall action for every encrypted service.
  4. D.Use an ACCEPT forward policy for the route-based interface design.
Show the answer and explanation

✓ Correct answer

  • Use an ACCEPT forward policy for the route-based interface design.

Route-based policies accept traffic toward/from the tunnel interface. Legacy policy-based Action IPsec is a different model. Denial or a security-profile exemption does not supply ordinary route-based forwarding authorization.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.