A cloud FortiGate-VM's public GUI is reachable, but protected workload traffic never appears in a correctly scoped new-session capture. What should be checked first?

Choose the single best answer.

A.Only the management local-in policy that already permits the successful GUI connection
B.Only the guest forwarding policy before establishing that workload traffic reaches the VM
C.Workload subnet routing and cloud traffic steering to the appliance
D.Only the management-subnet route while ignoring protected-workload routes

Show the answer and explanation

✓ Correct answer

Workload subnet routing and cloud traffic steering to the appliance

Verify the workload traffic path and native transit restrictions. Management reachability tests another path; an appliance policy cannot inspect traffic that never arrives, and management-only routes do not establish workload steering.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.