View the exhibit: Given the output showing a real-time debug, which statement describes why the update is failing?

Question

Options

• AThe update should be using port 53 or port 8888, instead of port 443.
• BThe administrator should use the execute update-wf command instead.
• CFortiGate is unable to establish a TCP connection with FDS.
• DFortiGate is unable to resolve the required FQDN (service.fortiguard.net) for antivirus and IPS

• A
  8% (3)
• B
  5% (2)
• C
  75% (30)
• D
  13% (5)

Explanation

Option C is correct because the real-time debug output shows FortiGate attempting to reach the FortiGuard Distribution Server (FDS) but failing at the TCP connection stage - the three-way handshake never completes. Without that TCP session, no update data can be transferred, regardless of what is being updated.

Why the other options are wrong:

• A is incorrect because port 443 is a valid and commonly used port for FortiGuard updates (alongside 8888 and 53 as fallbacks). The debug failure is at the connection level, not a port mismatch.
• B is incorrect because execute update-wf is for Web Filtering updates specifically; swapping commands wouldn't fix an underlying connectivity failure visible in the debug.
• D is incorrect because DNS resolution (FQDN lookup) occurs before the TCP connection attempt. If DNS had failed, the debug would show a name resolution error - not a TCP establishment failure.

Memory tip: Think of the sequence: DNS → TCP → Data. The debug pinpoints where the failure occurs. If FortiGate resolved the FQDN but still can't connect, the breakdown is at the TCP layer - likely a firewall rule, routing issue, or the FDS being unreachable from that interface.

No community discussion yet for this question.