The multi-site university team is verifying its fix for an incident where a private prefix should never escape through the public default route if its dedicated tunnel becomes unavailable. Which specific observation most convincingly demonstrates the required FortiGate behavior?
During tunnel loss the restricted prefix is discarded rather than forwarded through the generic default route. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. This is directly observable evidence for the blackhole route for fail-closed traffic requirement, rather than a generic appliance-health indicator.
That observation is a useful test for default route gateway, but not decisive proof of blackhole route for fail-closed traffic. A default route supplies forwarding for destinations without a more specific route. The recorded acceptance check must demonstrate the actual requirement.
A result about equal-cost multipath routes can be true while the blackhole route for fail-closed traffic defect persists. ECMP uses eligible routes of equal preference for multipath forwarding according to configured behavior. It does not validate the tested dependency.
That observation is a useful test for policy route precedence, but not decisive proof of blackhole route for fail-closed traffic. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. The recorded acceptance check must demonstrate the actual requirement.
After an approved policy change, administrators correct a problem where after a VPN route withdrawal, traffic for a confidential network risks following a less-specific Internet route. Which test result should their acceptance record contain?
During tunnel loss the restricted prefix is discarded rather than forwarded through the generic default route. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. This is directly observable evidence for the blackhole route for fail-closed traffic requirement, rather than a generic appliance-health indicator.
This verifies a different control: administrative distance backup. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The stated incident requires evidence of its own packet, identity or policy behavior.
A result about policy route precedence can be true while the blackhole route for fail-closed traffic defect persists. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. It does not validate the tested dependency.
This verifies a different control: missing return route. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The stated incident requires evidence of its own packet, identity or policy behavior.
An auditor reviewing a supply-chain company deployment finds that a private prefix should never escape through the public default route if its dedicated tunnel becomes unavailable. The team claims this is resolved; which concrete evidence would substantiate that claim?
During tunnel loss the restricted prefix is discarded rather than forwarded through the generic default route. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. This is directly observable evidence for the blackhole route for fail-closed traffic requirement, rather than a generic appliance-health indicator.
A result about default route gateway can be true while the blackhole route for fail-closed traffic defect persists. A default route supplies forwarding for destinations without a more specific route. It does not validate the tested dependency.
That observation is a useful test for longest prefix match, but not decisive proof of blackhole route for fail-closed traffic. IP route selection prefers the most-specific matching prefix before other selection criteria. The recorded acceptance check must demonstrate the actual requirement.
This verifies a different control: static route wrong next hop. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The stated incident requires evidence of its own packet, identity or policy behavior.
If a customer support center leaves the following FortiGate issue unresolved—a private prefix should never escape through the public default route if its dedicated tunnel becomes unavailable—what is the most direct operational or security consequence?
Confidential traffic might be sent toward an inappropriate fallback next hop. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The described exposure follows from leaving the blackhole route for fail-closed traffic dependency unresolved.
It would be a concern if longest prefix match were misconfigured. Here A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The selected alternative does not follow from the observed fault.
This describes a separate default route gateway failure. A default route supplies forwarding for destinations without a more specific route. It does not identify the most direct consequence of leaving blackhole route for fail-closed traffic unresolved.
That risk is associated with missing return route rather than the failing blackhole route for fail-closed traffic dependency. Successful routed connectivity depends on both outbound forwarding and a usable return path. The present scenario establishes a different causal exposure.
During a new branch activation, engineers discover that after a VPN route withdrawal, traffic for a confidential network risks following a less-specific Internet route. What specific failure risk follows if the underlying fault remains?
Confidential traffic might be sent toward an inappropriate fallback next hop. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The described exposure follows from leaving the blackhole route for fail-closed traffic dependency unresolved.
It would be a concern if longest prefix match were misconfigured. Here A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The selected alternative does not follow from the observed fault.
That risk is associated with policy route precedence rather than the failing blackhole route for fail-closed traffic dependency. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. The present scenario establishes a different causal exposure.
It would be a concern if default route gateway were misconfigured. Here A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The selected alternative does not follow from the observed fault.
A post-incident review at a managed services provider identifies that a private prefix should never escape through the public default route if its dedicated tunnel becomes unavailable. The same control is still uncorrected. Which exposure should the risk register record?
Confidential traffic might be sent toward an inappropriate fallback next hop. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The described exposure follows from leaving the blackhole route for fail-closed traffic dependency unresolved.
This describes a separate missing return route failure. Successful routed connectivity depends on both outbound forwarding and a usable return path. It does not identify the most direct consequence of leaving blackhole route for fail-closed traffic unresolved.
That risk is associated with policy route precedence rather than the failing blackhole route for fail-closed traffic dependency. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. The present scenario establishes a different causal exposure.
This describes a separate equal-cost multipath routes failure. ECMP uses eligible routes of equal preference for multipath forwarding according to configured behavior. It does not identify the most direct consequence of leaving blackhole route for fail-closed traffic unresolved.
At a regional hospital running FortiOS 7.6, an installed route points to an unreachable gateway IP although the destination prefix is correct. Which configuration or investigative change most directly resolves this issue?
Correct the route's gateway and interface to the reachable upstream neighbor. Static routes need viable forwarding next hops on appropriate interfaces. This corrects the FortiGate behavior described by the specific static route wrong next hop fault.
This correction targets missing return route. Successful routed connectivity depends on both outbound forwarding and a usable return path. It does not repair the stated static route wrong next hop condition: an installed route points to an unreachable gateway IP although the destination prefix is correct.
Changing this could help when the fault is equal-cost multipath routes, because eCMP uses eligible routes of equal preference for multipath forwarding according to configured behavior. Here the evidence instead identifies static route wrong next hop; the recommended correction addresses that dependency.
The proposed setting concerns policy route precedence, not the actual source of failure. Static routes need viable forwarding next hops on appropriate interfaces. It would leave the cited symptom unresolved.
During a configuration recovery exercise, clients cannot reach a partner subnet after the WAN next-hop address changed. What should the FortiGate administrator change to meet the stated requirement?
Correct the route's gateway and interface to the reachable upstream neighbor. Static routes need viable forwarding next hops on appropriate interfaces. This corrects the FortiGate behavior described by the specific static route wrong next hop fault.
The proposed setting concerns blackhole route for fail-closed traffic, not the actual source of failure. Static routes need viable forwarding next hops on appropriate interfaces. It would leave the cited symptom unresolved.
This correction targets policy route precedence. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. It does not repair the stated static route wrong next hop condition: clients cannot reach a partner subnet after the WAN next-hop address changed.
Changing this could help when the fault is missing return route, because successful routed connectivity depends on both outbound forwarding and a usable return path. Here the evidence instead identifies static route wrong next hop; the recommended correction addresses that dependency.
A public library system discovers a FortiGate control gap during a new branch activation: an installed route points to an unreachable gateway IP although the destination prefix is correct; additionally, clients cannot reach a partner subnet after the WAN next-hop address changed. Which targeted correction should the team implement?
Correct the route's gateway and interface to the reachable upstream neighbor. Static routes need viable forwarding next hops on appropriate interfaces. This corrects the FortiGate behavior described by the specific static route wrong next hop fault.
The proposed setting concerns blackhole route for fail-closed traffic, not the actual source of failure. Static routes need viable forwarding next hops on appropriate interfaces. It would leave the cited symptom unresolved.
Changing this could help when the fault is default route gateway, because a default route supplies forwarding for destinations without a more specific route. Here the evidence instead identifies static route wrong next hop; the recommended correction addresses that dependency.
The proposed setting concerns missing return route, not the actual source of failure. Static routes need viable forwarding next hops on appropriate interfaces. It would leave the cited symptom unresolved.
The cloud operations team team is verifying its fix for an incident where an installed route points to an unreachable gateway IP although the destination prefix is correct. Which specific observation most convincingly demonstrates the required FortiGate behavior?
The next hop resolves on the intended interface and controlled probes reach the partner network. Static routes need viable forwarding next hops on appropriate interfaces. This is directly observable evidence for the static route wrong next hop requirement, rather than a generic appliance-health indicator.
That observation is a useful test for policy route precedence, but not decisive proof of static route wrong next hop. FortiOS policy routes may influence forwarding for matched traffic separately from conventional static routes. The recorded acceptance check must demonstrate the actual requirement.
This verifies a different control: default route gateway. Static routes need viable forwarding next hops on appropriate interfaces. The stated incident requires evidence of its own packet, identity or policy behavior.
That observation is a useful test for equal-cost multipath routes, but not decisive proof of static route wrong next hop. ECMP uses eligible routes of equal preference for multipath forwarding according to configured behavior. The recorded acceptance check must demonstrate the actual requirement.
After a weekend failover rehearsal, administrators correct a problem where clients cannot reach a partner subnet after the WAN next-hop address changed. Which test result should their acceptance record contain?
The next hop resolves on the intended interface and controlled probes reach the partner network. Static routes need viable forwarding next hops on appropriate interfaces. This is directly observable evidence for the static route wrong next hop requirement, rather than a generic appliance-health indicator.
This verifies a different control: administrative distance backup. Static routes need viable forwarding next hops on appropriate interfaces. The stated incident requires evidence of its own packet, identity or policy behavior.
A result about equal-cost multipath routes can be true while the static route wrong next hop defect persists. ECMP uses eligible routes of equal preference for multipath forwarding according to configured behavior. It does not validate the tested dependency.
That observation is a useful test for blackhole route for fail-closed traffic, but not decisive proof of static route wrong next hop. A blackhole route can provide safe fallback forwarding when an intended more-specific path disappears. The recorded acceptance check must demonstrate the actual requirement.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
