Exam NSE4_FGT-7.2 topic 1 question 64 discussion

The two statements that describe how the RPF check is used are A and C. RPF stands for Reverse Path Forwarding. It is a security mechanism that protects FortiGate and the network from IP spoofing attacks. The RPF check is run on the first sent packet of any new session. This is because the first packet is the only packet that contains the source IP address of the sender.

Found this also which explains C litteraly. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reverse-path-forwarding-check-not-working-for/ta-p/230015

Correct answer are A & D, because as indicated by its name "reverse patch check" is done on the first reply packet of any new session.

A. The RPF check is a mechanism that protects FortiGate and the network from IP spoofing attacks. C. The RPF check is run on the first sent packet of any new session. FortiGate Infrastructure 7.2 Study Guide (p.41): "The RPF check is a mechanism that protects FortiGate and your network from IP spoofing attacks by checking for a return path to the source in the routing table." "FortiGate performs an RPF check only on the first packet of a new session. That is, after the first packet passes the RPF check and FortiGate accepts the session, FortiGate doesn’t perform any additional RPF checks on that session." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

ref infrastructure page 41, first and second paragraph

The answer are A and C