The NOC's FortiGate holds a static route for 10.20.0.0/16 out the primary fibre link to the regional aggregation site, and a second static route for 10.20.4.0/24 out the cellular backup modem, covering one specific substation inside that larger block. A workstation at the NOC sends a packet to 10.20.4.50. Which route does the FortiGate use to forward it?

Route selection in FortiOS follows longest-prefix match first: when a destination address falls inside more than one route's network, the route with the longest (most specific) subnet mask wins, before administrative distance or priority are ever consulted. Here 10.20.4.50 falls inside both the /16 and the /24, but the /24 is more specific, so it is installed as the matching route regardless of which link it points to. Administrative distance only breaks ties between routes of the same prefix length pointing to the same destination — it never overrides a more specific prefix, so the second distractor describes the wrong stage of the decision. Configuration order is irrelevant to forwarding; FortiOS re-evaluates the routing table on changes rather than favoring whichever entry was typed first. ECMP load-balancing across both links would only apply if two routes had the identical destination prefix, distance, and priority, which is not the case with a /16 and a /24. To verify this in the field, check the FortiGate's routing table for the exact destination and confirm the /24 entry, not the /16, is marked as the selected route.