StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 438 of 440 · hard

Phase 2 selectors intentionally cover TCP 443 between two subnet pairs. A host attempts TCP 8443 with correct routes and a broad firewall policy. Which dependency should be checked?

Choose the single best answer.

  1. A.Whether broad firewall authorization automatically expands the SA selector.
  2. B.Whether a lower route distance changes the TCP port.
  3. C.Whether the tunnel name contains HTTPS.
  4. D.Whether the negotiated selector’s service/protocol scope can carry TCP 8443.
Show the answer and explanation

✓ Correct answer

  • Whether the negotiated selector’s service/protocol scope can carry TCP 8443.

Selectors can constrain protocol/ports independently of accepting policy. Permission does not enlarge a negotiated SA, route preference does not translate ports, and descriptive names do not define selector scope.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.