NSE4 System and Network Administration Practice Question
A FortiGate has two internet connections: port1 (ISP1) and port2 (ISP2). An administrator configures two static default routes with equal distance and priority. Traffic to a specific public IP is observed going out port1, but the admin wants it to go out port2. What should be configured?
⚠ Common exam trap
Test-takers frequently assume ECMP or route metrics can selectively steer a single destination, but policy routing is the only method that overrides the routing table for specific traffic without affecting other flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a policy route to direct the specific destination to port2
Policy routes (also called PBR) override the routing table for specific traffic matches. Since both default routes have equal distance and priority, the FortiGate uses ECMP or the route with the lowest cost by default. A policy route can match the specific destination IP and force the traffic out port2, bypassing the routing table lookup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use ECMP with source-based hashing
Why it's wrong here
ECMP with source-based hashing distributes new sessions by hashing source and destination IPs, so it can keep a session on the same path but cannot ensure that every session to one specific destination always exits through port2. Because the hash is computed across both port1 and port2 for equal-cost default routes, a given remote IP may land on either link at different times or for different source addresses. This makes it unsuitable for granular, deterministic traffic steering.
- ✓
Configure a policy route to direct the specific destination to port2
Why this is correct
A policy route is evaluated before the routing table, so matching the specific destination and setting the output interface to port2 overrides the default route for only that traffic. You can specify source, destination, and optionally protocol or port criteria, while all other traffic continues to follow the normal administrative-distance-selected default route. This gives exact policy-based control without affecting other destinations.
- ✗
Increase the administrative distance of the default route on port1
Why it's wrong here
Increasing the administrative distance on the port1 default route simply makes port1's default route less preferred than port2's default route, which moves the entire default internet-bound traffic flow to port2. It does not contain any match criteria, so it cannot single out one destination IP; it also requires an equal-cost or failover relationship and does not provide granularity. Therefore, it is the wrong tool for directing only a specific IP.
- ✗
Configure a blackhole route
Why it's wrong here
A blackhole route intentionally discards packets that match the destination prefix by installing a route with the blackhole action, usually to stop routing loops or suppress unwanted traffic. It does not forward packets out to port2 or any physical interface, so it cannot satisfy the requirement to reach the specific destination via ISP2. Additionally, coupling it with a policy route isn't relevant here, since the blackhole route alone would drop the traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.