NSE4 System and Network Administration Practice Question
After upgrading FortiGate firmware from 6.0 to 7.2, an administrator notices that a static route pointing to a next-hop IP 10.0.0.1 is no longer working. The route is present in the configuration but the FortiGate shows it as 'not active'. What is the MOST likely cause?
⚠ Common exam trap
Candidates often assume a static route will be active as long as the configuration is present and the remote gateway is reachable, but FortiGate (and most routers) require the next-hop IP to be directly connected for the route to be installed in the routing table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The next-hop IP is not directly connected to any FortiGate interface
In FortiOS 7.2, a static route is considered 'active' only if the next-hop IP is reachable via a directly connected interface. If the next-hop IP 10.0.0.1 is not on a directly connected subnet, the route will be present in the configuration but marked as 'not active'. This is a fundamental routing principle: the next hop must be directly reachable (i.e., the router must have an ARP entry for it) for the route to be installed in the routing table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FortiGate now requires a default administrative distance of 10 for static routes
Why it's wrong here
FortiGate has always used a default administrative distance of 10 for static routes since before version 6.0, and this value is unchanged in 7.2. Administrative distance is a route-selection preference among multiple routes to the same destination, not a condition for route activation. An inactive route is not caused by a specific AD value; AD of 10 would only make the static route preferable over other routes with higher distances, not render it inactive.
- ✗
The route was deleted during the upgrade and needs to be re-added
Why it's wrong here
A FortiGate firmware upgrade preserves the running configuration, including static routes, unless the upgrade requires a full configuration rebuild or you explicitly restore from scratch. Even if a route were missing, it would appear as absent from the routing table, not as an existing route in the 'inactive' state. In this scenario the route is present but inactive, so deletion is not the cause.
- ✓
The next-hop IP is not directly connected to any FortiGate interface
Why this is correct
FortiGate static routes require the next-hop IP (gateway) to be on a directly connected subnet of the outgoing interface. If the gateway is not directly connected to any FortiGate interface, the route cannot be resolved via ARP or neighbor discovery, so FortiGate marks the route as inactive and does not install it in the forwarding table. This is the most common and specific cause of an inactive static route after a configuration change or upgrade that alters interface IPs or subnet masks.
- ✗
The remote gateway is down
Why it's wrong here
A remote gateway being down does not automatically deactivate a static route on FortiGate because the routing daemon does not continuously probe next-hop reachability for every static route by default. As long as the outgoing interface is administratively up and the route is otherwise valid, the route remains active in the routing table; traffic will be black-holed or fail, but the route itself will not be marked inactive. The 'remote gateway is down' condition would not produce an inactive route status, so it is not the correct explanation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.