StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Source and destination NAT

Practice question 140 of 440 · medium

An external client sends a TCP SYN through a VIP. The server receives it but replies through a different router. Which condition is missing?

Choose the single best answer.

  1. A.An explicit reverse permit for every reply
  2. B.A larger VIP external port
  3. C.A return path through the FortiGate session
  4. D.A lower firewall-policy ID
Show the answer and explanation

✓ Correct answer

  • A return path through the FortiGate session

The reply must traverse the firewall holding the translation so reverse NAT produces the expected public source. A reverse permit is not normally required for established replies; port size and IDs do not repair asymmetry.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.