nerdexam
Fortinet

NSE4 · Question #20

Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set…

The correct answer is A. All traffic to 172.20.1.0/24 is dropped by the FortiGate. C. The FortiGate unit does NOT create a session entry in the session table when the traffic is being. The configuration includes a blackhole route for 172.20.1.0/24 with a lower administrative distance (5) than the next-hop route (10), making the blackhole route preferred and causing all traffic to that destination to be dropped without creating session entries.

Submitted by anjalisingh· Apr 18, 2026Routing and SD-WAN

Question

Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set distance 10 set weight 5 next edit 2 set dst 172.20.1.0 255.255.255.0 set blackhole enable set distance 5 set weight 10 next end Which of the following statements correctly describes the static routing configuration provided? (Choose two.)

Options

  • AAll traffic to 172.20.1.0/24 is dropped by the FortiGate.
  • BAs long as port1 is up, all traffic to 172.20.1.0/24 is routed by the static route number 1. If the
  • CThe FortiGate unit does NOT create a session entry in the session table when the traffic is being
  • DThe FortiGate unit creates a session entry in the session table when the traffic is being routed by

How the community answered

(52 responses)
  • A
    81% (42)
  • B
    8% (4)
  • D
    12% (6)

Why each option

The configuration includes a blackhole route for 172.20.1.0/24 with a lower administrative distance (5) than the next-hop route (10), making the blackhole route preferred and causing all traffic to that destination to be dropped without creating session entries.

AAll traffic to 172.20.1.0/24 is dropped by the FortiGate.Correct

Route 2, a blackhole route for 172.20.1.0/24, has an administrative distance of 5. Route 1, a regular static route for the same destination, has a distance of 10. Since a lower distance is preferred, Route 2 (the blackhole) will be the active route, causing all traffic destined for 172.20.1.0/24 to be dropped.

BAs long as port1 is up, all traffic to 172.20.1.0/24 is routed by the static route number 1. If the

This statement is incorrect because Route 2 (blackhole with distance 5) will always be preferred over Route 1 (distance 10) due to its lower administrative distance, meaning traffic will be dropped, not routed by Route 1.

CThe FortiGate unit does NOT create a session entry in the session table when the traffic is beingCorrect

When traffic matches a blackhole route, it is silently dropped by the FortiGate. Blackhole routes are designed for discarding unwanted traffic efficiently, and as such, they do not create session entries in the session table.

DThe FortiGate unit creates a session entry in the session table when the traffic is being routed by

This statement is incorrect because blackhole routes are specifically designed to drop traffic without creating session entries, making the process more efficient for discarding unwanted traffic.

Concept tested: FortiGate static routes, administrative distance, and blackhole routes

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/86909/static-routes

Topics

#Static Routing#Administrative Distance#Blackhole Route#FortiGate Packet Flow

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice