StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 436 of 440 · hard

A FortiGate-originated ping to a remote private host fails while a correctly authorized LAN client works through the tunnel. Which two details should be checked? Select two answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Whether that local-out source fits the protected selectors and remote return path.
  2. B.Whether the successful LAN policy automatically makes all local-out sources identical.
  3. C.Whether a new VIP is mandatory for every FortiGate-originated ping.
  4. D.Whether IKEv2 requires Aggressive Mode for local-out packets.
  5. E.The source address/interface selected for the FortiGate-originated test.
Show the answer and explanation

✓ Correct answers

  • Whether that local-out source fits the protected selectors and remote return path.
  • The source address/interface selected for the FortiGate-originated test.

Local-out source selection can differ from a forwarded LAN client and must fit the tunnel/return design. A LAN success does not make every source equivalent. A VIP is not universally required, and IKEv2 has no Aggressive Mode choice.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.