A packet enters wan2, while strict-src-check is enabled and the best active route to its source uses wan1. The packet is rejected before a useful forward session establishes. Which explanation fits?

Choose the single best answer.

A.A source-NAT pool is required for every incoming packet.
B.Strict source validation rejects the mismatched best return path.
C.The destination prefix is automatically blackholed.
D.The firewall rejects all secondary WAN traffic by design.

Show the answer and explanation

✓ Correct answer

Strict source validation rejects the mismatched best return path.

Strict RPF requires the best return path to agree with the incoming interface. This is a source-validation issue, not proof of a destination blackhole, a universal secondary-WAN prohibition or a blanket NAT requirement. Investigate routing/asymmetry before weakening checks.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.