StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 430 of 440 · hard

Inbound decrypt counters increase, but the expected decrypted packet is not delivered to the local LAN host. Which checks are most relevant?

Choose the single best answer.

  1. A.Only whether the public peer is reachable over UDP 500.
  2. B.The assumption that decryption automatically authorizes every LAN destination.
  3. C.Increasing the Phase 1 DH group without checking forwarding.
  4. D.The local post-decryption route/policy path, selector/context and host delivery.
Show the answer and explanation

✓ Correct answer

  • The local post-decryption route/policy path, selector/context and host delivery.

Observed decryption narrows the failure to subsequent handling or delivery. Rechecking only initial IKE reachability or increasing DH strength ignores local forwarding. Decryption does not override policy or ensure host receipt.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.