nerdexam
Fortinet

NSE4 · Question #225

Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set…

The correct answer is B. As long as port1 is up, all the traffic to 172.20.1.0/24 will be routed by the static route number 1. If C. The FortiGate unit will NOT create a session entry in the session table when the traffic is being. Route 1 is preferred over the blackhole route (route 2) if port1 is operational due to the FortiGate's routing precedence, and traffic matching a blackhole route is dropped without creating a session.

Submitted by viktor_hu· Apr 18, 2026VPN and Routing

Question

Examine the static route configuration shown below; then answer the question following it. config router static edit 1 set dst 172.20.1.0 255.255.255.0 set device port1 set gateway 172.11.12.1 set distance 10 set weight 5 next edit 2 set dst 172.20.1.0 255.255.255.0 set blackhole enable set distance 5 set weight 10 next end Which of the following statements correctly describes the static routing configuration provided? (Select all that apply.)

Options

  • AAll traffic to 172.20.1.0/24 will always be dropped by the FortiGate unit.
  • BAs long as port1 is up, all the traffic to 172.20.1.0/24 will be routed by the static route number 1. If
  • CThe FortiGate unit will NOT create a session entry in the session table when the traffic is being
  • DThe FortiGate unit will create a session entry in the session table when the traffic is being routed
  • ETraffic to 172.20.1.0/24 will be shared through both routes.

How the community answered

(32 responses)
  • A
    9% (3)
  • B
    81% (26)
  • D
    3% (1)
  • E
    6% (2)

Why each option

Route 1 is preferred over the blackhole route (route 2) if `port1` is operational due to the FortiGate's routing precedence, and traffic matching a blackhole route is dropped without creating a session.

AAll traffic to 172.20.1.0/24 will always be dropped by the FortiGate unit.

Traffic will only be dropped by the blackhole route (route 2) if route 1 is not active (e.g., if `port1` is down); otherwise, traffic is routed via route 1.

BAs long as port1 is up, all the traffic to 172.20.1.0/24 will be routed by the static route number 1. IfCorrect

FortiGate routing prioritizes routes with an associated up interface over blackhole routes, even if the blackhole has a lower administrative distance. Therefore, as long as `port1` is up, route 1 (with destination `172.20.1.0/24` via `port1`) will be used. If `port1` goes down, route 1 becomes inactive, and route 2 (the blackhole) would then become the active route.

CThe FortiGate unit will NOT create a session entry in the session table when the traffic is beingCorrect

When a blackhole route (`set blackhole enable`) is used, the FortiGate silently discards traffic destined for that network. Since the traffic is immediately dropped and not forwarded or processed further, no session entry is created in the session table.

DThe FortiGate unit will create a session entry in the session table when the traffic is being routed

Traffic routed via a blackhole route is silently discarded, and the FortiGate does not create a session entry for such discarded traffic to conserve resources.

ETraffic to 172.20.1.0/24 will be shared through both routes.

The FortiGate will select a single best route based on its routing table logic (administrative distance, metric, interface status); it does not share traffic between two static routes for the same destination in this manner.

Concept tested: Static route precedence, blackhole route behavior, session table interaction

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/33917/static-routing

Topics

#Static Routing#Blackhole Route#FortiGate Routing#Session Management

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice