The tunnel’s outbound encrypt counter rises during a client test, but the inbound decrypt counter remains unchanged. Which branch should be investigated next?

Choose the single best answer.

A.Remote processing, host response and return-path delivery of protected replies.
B.Assume the local LAN received replies because outbound encryption increased.
C.Restart the IKE process before inspecting remote forwarding or reply evidence.
D.Treat the peer’s successful IKE event as proof of inbound user payload.

Show the answer and explanation

✓ Correct answer

Remote processing, host response and return-path delivery of protected replies.

The counters show outbound protection without observed inbound protected responses. Investigate the remote forward/host/return path. Outbound encryption or IKE establishment is not local LAN response evidence, and restarting IKE before checking the missing reply path does not isolate that forwarding failure.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.