Latest Fortinet NSE4_FGT_AD-7.6 PDF and Dumps (2026) Free Exam Questions Answers
Pass Your Fortinet NSE 4 NSE4_FGT_AD-7.6 Exam on Aug 24, 2026 with 96 Questions
Fortinet NSE4_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 48
Refer to the exhibit, which shows the IPS sensor configuration.
If traffic matches this IPS sensor, which two actions is the sensor expected to take? (Choose two.)
- A. The sensor will reset all connections that match these signatures.
- B. The sensor will block all attacks aimed at Windows servers.
- C. The sensor will gather a packet log for all matched traffic.
- D. The sensor will allow attackers matching the Microsoft.Windows.iSCSI.Target.DoS signature.
Answer: B,D
Explanation:
The sensor will allow attackers matching the Microsoft.Windows.iSCSITarget.DoS signature.
The action for this specific signature is set to Monitor, which means FortiGate will only detect and log the activity but will not block or reset the session.
The sensor will block all attacks aimed at Windows servers.
The general Windows filter is configured with the Block action, so any traffic matching Windows- related attack signatures will be blocked.
NEW QUESTION # 49
Refer to the exhibit. Which two statements about the FortiGuard connection are true? (Choose two.)
- A. You can configure unreliable protocols to communicate with FortiGuard Server.
- B. The weight increases as the number of failed packets rises.
- C. FortiGate is using the default port for FortiGuard communication.
- D. FortiGate identified the FortiGuard Server using DNS lookup.
Answer: B,C
Explanation:
FortiGuard web filtering, DNS filtering, and antispam service.fortiguard.net uses a proprietary protocol over UDP port 53 or 8888 securewf.fortiguard.net uses HTTPS over ports 443, 53, or
8888.
The weight value reflects server reliability. It decreases with good performance and increases as packet loss or failures rise, meaning higher weight indicates more failures.
NEW QUESTION # 50
Refer to the exhibit.
What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
- B. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- C. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- D. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
Answer: D
Explanation:
Based on the exhibit and the FortiOS 7.6 SSL/SSH Inspection documentation, the correct answer is C.
Understanding the Exhibit Configuration
In the SSL/SSH Inspection Profile, the following settings are shown:
Inspection method: Full SSL Inspection
Server certificate SNI check: Strict
This setting directly controls how FortiGate validates the Server Name Indication (SNI) provided by the client during the TLS handshake.
FortiOS 7.6 Behavior of "Server certificate SNI check"
FortiOS supports three modes for Server certificate SNI check:
Disable
No validation between SNI and server certificate.
Enable
FortiGate checks SNI against the certificate.
If mismatch occurs, FortiGate may still allow the session with reduced validation.
Strict
FortiGate enforces a strict match.
The SNI must match either the CN (Common Name) or one of the SAN (Subject Alternative Name) entries in the server certificate.
If the SNI does not match either CN or SAN, the TLS session is immediately terminated.
The exhibit clearly shows Strict selected.
Why Option C is Correct
With Strict enabled, FortiGate rejects the TLS connection when:
The SNI does not match the CN, and
The SNI does not match any SAN entry
This results in the connection being closed, not allowed with warnings or fallback behavior.
Therefore:
C). FortiGate will close the connection if the SNI does not match the CN or SAN fields is exactly the documented behavior.
Why the Other Options Are Incorrect
A: FortiGate does not fall back to using the CN for URL filtering when Strict is enabled.
B: There is no "accept with warning" behavior in Strict mode.
D: Incorrect logical condition. FortiGate does not require mismatch with both CN and SAN simultaneously; a mismatch with either valid field set is sufficient to close the connection.
NEW QUESTION # 51
Refer to the exhibit.
A routing table is shown
An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only. What are the two criteria that the administrator can use to achieve this objective? (Choose two.)
- A. The new static route must have the distance set to 9
- B. The new static route must have the priority set to 3.
- C. The existing static route through port3 must have the distance set to 11.
- D. The new static route must have the metric set to 1.
Answer: A,C
Explanation:
From the routing table in the exhibit, there is already a static route for 172.20.1.0/24 pointing out port3 with:
Distance = 9
Priority = 2
Type = Static
In FortiOS, route selection prefers (in order) the route with the lowest administrative distance to a destination. Therefore, to make traffic to 172.20.1.0/24 go through port2 only, the administrator must ensure the port2 static route is more preferred than the existing port3 route.
Why C is correct
C . The existing static route through port3 must have the distance set to 11.
If the existing port3 route distance is increased to 11, then a new port2 route with distance 9 will be preferred (9 < 11). This makes the port3 route a backup route instead of the active one.
Why D is correct
D . The new static route must have the distance set to 9
Setting the new port2 route distance to 9 (and increasing the port3 route to 11 as in option C) ensures FortiGate selects the port2 route as the best route for 172.20.1.0/24.
Why A and B are not correct
A (priority 3): By itself it does not guarantee selection over the existing route, and FortiOS route choice is driven primarily by distance.
B (metric 1): Metric is not the primary selector for static route preference compared to administrative distance in this scenario.
So the two criteria that achieve the objective are:
Make the existing port3 route less preferred by increasing its distance (C) Ensure the new port2 route uses the preferred distance (D)
NEW QUESTION # 52
Refer to the exhibit.
What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
- B. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- C. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- D. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
Answer: D
Explanation:
Based on the exhibit and the FortiOS 7.6 SSL/SSH Inspection documentation, the correct answer is C.
Understanding the Exhibit Configuration
In the SSL/SSH Inspection Profile, the following settings are shown:
Inspection method: Full SSL Inspection
Server certificate SNI check: Strict
This setting directly controls how FortiGate validates the Server Name Indication (SNI) provided by the client during the TLS handshake.
FortiOS 7.6 Behavior of "Server certificate SNI check"
FortiOS supports three modes for Server certificate SNI check:
Disable
No validation between SNI and server certificate.
Enable
FortiGate checks SNI against the certificate.
If mismatch occurs, FortiGate may still allow the session with reduced validation.
Strict
FortiGate enforces a strict match.
The SNI must match either the CN (Common Name) or one of the SAN (Subject Alternative Name) entries in the server certificate.
If the SNI does not match either CN or SAN, the TLS session is immediately terminated.
The exhibit clearly shows Strict selected.
Why Option C is Correct
With Strict enabled, FortiGate rejects the TLS connection when:
The SNI does not match the CN, and
The SNI does not match any SAN entry
This results in the connection being closed, not allowed with warnings or fallback behavior.
Therefore:
C . FortiGate will close the connection if the SNI does not match the CN or SAN fields is exactly the documented behavior.
Why the Other Options Are Incorrect
A: FortiGate does not fall back to using the CN for URL filtering when Strict is enabled.
B: There is no "accept with warning" behavior in Strict mode.
D: Incorrect logical condition. FortiGate does not require mismatch with both CN and SAN simultaneously; a mismatch with either valid field set is sufficient to close the connection.
NEW QUESTION # 53
Refer to the exhibit.
The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team? (Choose one answer)
- A. Move NOC_Access to the top of the list to ensure all profile settings take effect.
- B. Increase the offline value of the Override Idle Timeout parameter in the NOC_Access admin profile.
- C. Increase the admintimeout value under config system accprofile NOC_Access.
- D. Ensure that all NOC_Access users are assigned the super_admin role to guarantee access.
Answer: C
Explanation:
According to the FortiOS 7.6 Administrator Study Guide, while there is a global administrative idle timeout setting that applies to all users by default (typically 5 minutes), FortiOS allows for granular control through Administrator Profiles. The Override Idle Timeout feature is specifically designed to allow different timeout values for different access profiles, which is ide1al for environments like a Network Operations Center (NOC) where persistent monitoring is required.23 To implement this, the administrator must modify the s4pecific access profile settings. By using the command config system accprofile 5and editing the NOC_Access profile, the administrator can enable the admintimeout-override and then increase the admintimeout value (Statement D). This configuration ensures that only the users assigned to that specific profile benefit from the extended session duration, maintaining a higher security posture for other administrative accounts that still follow the global timeout. Other options, such as changing the profile order (A) or assigning the super_admin role (C), do not address the specific requirement for inactivity timeout management. Option B is incorrect as "offline value" is not a standard parameter for this feature.
NEW QUESTION # 54
Refer to the exhibits.
You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)
- A. Set the action for Google in the Application and Filter Overrides section to Allow
- B. Move up Google in the Application and Filter Overrides section to set its priority lot
- C. Add "Google".com to the URL category in the security profile.
- D. Set SSL inspection to deep-content inspection.
- E. Change the Inspection mode to Flow-based
Answer: A,B
Explanation:
From the exhibits:
The firewall policy has Application Control enabled and uses certificate-inspection for SSL inspection.
The application sensor has Application and Filter Overrides with the following order (priority):
Excessive-Bandwidth with action Block
Google (vendor filter) with action Monitor
In FortiOS, Application and Filter Overrides are evaluated by priority (top-down). The first matching override is applied. If traffic matches an earlier override with Block, it will be blocked even if a later override would Monitor/Allow it.
Why Google apps fail while www.fortinet.com works:
Many Google applications can be detected as (or can trigger) the Excessive-Bandwidth behavior/signature depending on the specific service and traffic pattern.
Because Excessive-Bandwidth (Block) is above Google (Monitor), Google-related traffic may match the first rule and be blocked before the Google override is evaluated.
Access to www.fortinet.com works because that traffic is not matching the Excessive-Bandwidth override.
Therefore, to resolve:
B). Move up Google in the Application and Filter Overrides section to set its priority higher This ensures Google matches the Google override before any broader blocking override is applied.
E). Set the action for Google in the Application and Filter Overrides section to Allow This explicitly permits Google applications once the higher-priority match occurs (stronger than Monitor for troubleshooting and ensuring access).
Why the other options are not the best fit here:
A (deep-content inspection) can help identify more HTTPS applications, but the exhibit already shows a specific Google override configured; the immediate issue is the override evaluation order and action.
C relates to Web Filter URL categories, but the problem is occurring under Application Control behavior
/vendor overrides.
D (flow-based) is not required to fix an override priority/action conflict.
NEW QUESTION # 55
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device.
The WAN (port2) interface has the IP address 100.65.0.101/24.
The LAN (port4) interface has the IP address 10.0.11.254/24.
The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.11.50?
- A. 100.65.0.101
- B. 100.65.0.200
- C. 100.65.0.102
- D. 10.0.11.254
Answer: C
Explanation:
Traffic from the workstation 10.0.11.50 going to the internet matches the Internet(1) policy (LAN
→ WAN) which has NAT enabled and is configured to use the IP Pool. The IP pool specifies the external address 100.65.0.102.
FortiGate will perform source NAT (SNAT) on the outbound traffic, translating the source IP of the workstation to 100.65.0.102.
NEW QUESTION # 56
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. A session for denied traffic is created.
- B. Denied users are blocked for 30 minutes.
- C. The number of logs generated by denied traffic is reduced.
- D. Session helpers are disabled for denied traffic.
Answer: A,C
Explanation:
set ses-denied-traffic enable → ensures FortiGate creates a session entry even for denied traffic.
set block-session-timer 30 → sets the duration (30 seconds) that denied sessions remain in the session table. This prevents repeated logging for every packet in the same denied flow, thereby reducing the number of logs generated.
NEW QUESTION # 57
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port2) interface has the IP address
100.65.0.101/24.
The LAN (port4) interface has the IP address
10.0.11.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)?
- A. 100.65.0.149
- B. 100.65.0.101
- C. 100.65.0.99
- D. 100.65.0.49
Answer: C
Explanation:
From the exhibits, there are three relevant firewall policies from LAN (port4) to WAN (port2), each using a different IP pool for source NAT:
TCP traffic
Service: ALL_TCP
Destination: BR1-FGT
IP Pool: SNAT-Pool # 100.65.0.49
PING traffic
Service: PING
Destination: all
IP Pool: SNAT-Remote1 # 100.65.0.99
IGMP traffic
Service: IGMP
Destination: all
IP Pool: SNAT-Remote # 100.65.0.149
The user on HQ-PC-1 (10.0.11.50) is pinging BR1-FGT (100.65.1.111). In FortiOS, policy matching is based on (among other fields) source, destination, and service, and the first matching policy in top-down order is applied.
Because the traffic is ICMP echo (ping), it matches the policy named PING traffic (service PING, destination all). That policy explicitly uses Use Dynamic IP Pool with SNAT-Remote1, which is configured with external IP 100.65.0.99.
Therefore, the source NAT IP used for this ping is 100.65.0.99.
NEW QUESTION # 58
You have configured the FortiGate device for FSSO. A user is successful in log-in to Windows, but their access to the internet is denied. What should the administrator check first? (Choose one answer)
- A. The FortiGate FSSO active users list for user's IP address.
- B. The FortiGate firewall policy settings for SSL decryption.
- C. The Windows event viewer for failed login attempts.
- D. Whether the user is assigned to the correct AD group.
Answer: A
Explanation:
"FSSO is a software agent that enables FortiGate to identify network users for security policies or for VPN access, without asking for their username and password. When a user logs in to a directory service, the FSSO agent sends FortiGate the username, the IP address, and the list of groups that the user belongs to. FortiGate uses this information to maintain a local database of usernames, IP addresses, and group mappings."
"To display the list of FSSO users that are currently logged in, use the CLI command diagnose debug authd fsso list. For each user, the user name, user group, IP address, and the name of the workstation from which they logged in shows."
"You can monitor users who authenticate through your firewall policies using the Dashboard > Assets & Identities > Firewall Users page. It displays the user, user group, duration, IP address, traffic volume, and authentication method." Technical Deep Dive:
The first thing to verify is whether FortiGate has actually learned the user correctly in its FSSO active users table, especially the user-to-IP mapping. FSSO enforcement is identity-based, but the real-time match on live traffic still depends on FortiGate associating the traffic's source IP with the authenticated Windows user. If that mapping is missing, stale, or tied to the wrong IP because of DHCP changes, DNS update lag, or collector-agent timing, the firewall policy match can fail even though the user successfully logged in to Windows.
That is why C is the best first check.
A may be the next thing to verify if the user is present but still denied, but first you must confirm the user is even present in the FSSO table with the correct IP.
B is unrelated to the initial FSSO identity-mapping problem.
D is less likely because the Windows logon already succeeded.
Useful checks:
diagnose debug authd fsso list
diagnose debug authd fsso server-status
execute fsso refresh
These commands confirm whether FortiGate has the user, group, and IP mapping needed for policy matching.
NEW QUESTION # 59
Refer to the exhibit.
A RADIUS server configuration is shown.
An administrator added a configuration for a new RADIUS server While configuring, the administrator enabled Include in every user group What is the impact of enabling Include in every user group in a RADIUS configuration?
- A. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- B. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
- C. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
- D. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
Answer: C
Explanation:
Based on the FortiOS 7.6 Authentication and User Group documentation, the correct answer is A.
Meaning of "Include in every user group" (FortiOS 7.6)
When configuring a RADIUS server on FortiGate, enabling Include in every user group has a very specific and documented effect:
The configured RADIUS server object is automatically added to all FortiGate user groups.
As a result, any user who successfully authenticates against that RADIUS server becomes a valid member of every FortiGate user group, unless additional group filtering (such as RADIUS attributes) is applied.
This simplifies configuration when the same external authentication source must be accepted across multiple firewall policies that reference different user groups.
This behavior is explicitly described in the FortiOS 7.6 Administrator Guide under RADIUS authentication servers and user groups.
Why Option A is Correct
FortiGate user groups can include:
Local users
LDAP servers
RADIUS servers
Enabling Include in every user group causes FortiGate to:
Insert the RADIUS server into all existing and future FortiGate user groups Therefore, all users authenticating via this RADIUS server are implicitly allowed in every FortiGate user group.
This is exactly what option A describes.
Why the Other Options Are Incorrect
B: FortiGate does not push users or groups into the RADIUS server. Authentication is always initiated by FortiGate toward RADIUS.
C: FortiGate does not manage or modify RADIUS-side group definitions.
D: LDAP and RADIUS user groups are separate authentication mechanisms; this setting does not merge or affect LDAP groups.
NEW QUESTION # 60
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)
- A. Move up Google in the Application and Filter Overrides section to set its priority to 1.
- B. Change the Inspection mode to Flow-based.
- C. Set the action for Google in the Application and Filter Overrides section to Allow.
- D. Add *Google*.com to the URL category in the security profile.
- E. Set SSL inspection to deep-content inspection.
Answer: A,E
Explanation:
Move up Google in the Application and Filter Overrides section to set its priority to 1.
The "Excessive-Bandwidth" filter has a higher priority (1) and is configured to Block. Because Google applications generate significant bandwidth, they match this rule first and get blocked.
Moving the "Google" filter to priority 1 ensures that the monitor action for Google is applied before the block rule.
Set SSL inspection to deep-content inspection.
Google applications use HTTPS encryption, so the FortiGate cannot identify or control them unless SSL traffic is decrypted. Changing from certificate-inspection (which only inspects certificates) to deep-inspection allows FortiGate to fully analyze encrypted application traffic and properly apply the Application Control rules.
NEW QUESTION # 61
Which two statements are correct when FortiGate enters conserve mode? (Choose two answers)
- A. FortiGate halts complete system operation and requires a reboot to regain available resources.
- B. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.
- C. FortiGate refuses to accept configuration changes.
- D. FortiGate continues to run critical security actions, such as quarantine.
Answer: B,C
Explanation:
According to the FortiOS 7.6 Study Guide and technical documentation, conserve mode is a protective state triggered when memory utilization reaches the Extreme Threshold (typically 95% by default). When this occurs, the FortiGate implements several measures to prioritize system stability over new functionality. One of the primary restrictions is that the FortiGate refuses to accept configuration changes (Statement B). This prevents the system from initiating new processes or allocating additional memory that could lead to a total system crash.
Regarding traffic handling, the behavior is determined by specific "fail-open" settings. For the IPS engine, if the fail-open global setting is enabled, the FortiGate continues to transmit packets without IPS inspection (Statement D). This ensures that network connectivity is maintained even when the system lacks the memory resources to perform deep packet inspection. In contrast, Statement A is incorrect because the system may skip non-essential actions to save memory. Statement C is incorrect because conserve mode is designed to avoid a system halt; the device remains operational and will automatically exit conserve mode once memory usage drops below the Release Threshold (typically 82%).
NEW QUESTION # 62
When configuring firewall policies which of the following is true regarding the policy ID? (Choose two.)
- A. A firewall policy ID identifies the order of policy execution in firewall policies.
- B. A policy ID cannot be modified once a policy is created.
- C. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
- D. You can create a policy in CLI with policy ID 0
Answer: B,D
Explanation:
According to the FortiOS 7.6 Administration Guide, the firewall policy ID is a unique numerical identifier assigned to each policy for internal database tracking and management purposes. It is important to distinguish the policy ID from the policy sequence. While the FortiGate processes traffic based on a top-down approach (the sequence), the policy ID itself does not determine the order of execution (Statement A is incorrect).
In FortiOS, once a policy is committed to the configuration, the policy ID cannot be modified (Statement B). If an administrator needs to change a policy ID, they must either delete and recreate the policy or use the clone command in the CLI to copy the settings to a new ID.
Furthermore, the CLI provides a specific shortcut for policy creation: you can create a policy with ID 0 (Statement C). When the command edit 0 is used within the config firewall policy context, the FortiOS kernel automatically assigns the next available integer as the policy ID. This is a standard practice for efficient configuration via the command line. Statement D is incorrect because, while every policy must have an ID, the GUI automatically generates this value without requiring the user to manually provide or even see it during the initial creation process.
NEW QUESTION # 63
Which three statements explain a flow-based antivirus profile? (Choose three.)
- A. Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.
- B. FortiGate buffers the whole file but transmits to the client at the same time.
- C. The IPS engine handles the process as a standalone.
- D. Flow-based inspection optimizes performance compared to proxy-based inspection.
- E. If a virus is detected, the last packet is delivered to the client.
Answer: A,B,D
Explanation:
Flow-based antivirus buffers the entire file while simultaneously transmitting data to the client to minimize latency.
Flow-based inspection combines multiple scanning techniques from proxy-based modes for efficient detection.
Flow-based inspection provides better performance by processing traffic on the fly without full proxy overhead.
NEW QUESTION # 64
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?
- A. The DC agent sends login event data directly to FortiGate.
- B. The user logs into the windows domain.
- C. The collector agent forwards login event data to FortiGate.
- D. FortiGate determines user identity based on the IP address in the FSSO list.
Answer: C
Explanation:
In DC Agent Mode, the DC agent sends login event data directly to FortiGate without involving a collector agent.
NEW QUESTION # 65
Refer to the exhibit.
Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What do you conclude when adding the FTP.Login.Failed signature to the IPS sensor profile?
- A. Traffic matching the signature will be silently dropped and logged.
- B. The signature setting includes a group of other signatures.
- C. The signature setting uses a custom rating threshold.
- D. Traffic matching the signature will be allowed and logged.
Answer: A
Explanation:
Select Block to silently drop traffic matching any of the signatures included in the entry.
So, while the default action would be 'Pass' for this signature the administrator is specifically overriding that to set the Block action. To use the default action the setting would have to be
'Default'.
NEW QUESTION # 66
When configuring firewall policies which of the following is true regarding the policy ID? (Choose two.)
- A. A firewall policy ID identifies the order of policy execution in firewall policies.
- B. You can create a policy in CLI with policy ID 0.
- C. A policy ID cannot be modified once a policy is created.
- D. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
Answer: C,D
Explanation:
The policy ID assigned to a firewall policy cannot be modified after creation. When creating a policy via CLI, you can specify policy ID 0, which the system allows. The policy ID does not determine the order of execution; policy sequence in the list determines execution order.
NEW QUESTION # 67
Refer to the exhibit.
Based on the routing table shown in the exhibit, which two statements are true? (Choose two.)
- A. A packet with the source IP address 10.100.110.10 arriving on port3 is allowed if strict RPF is disabled.
- B. A packet with the source IP address 10.10.10.10 arriving on port2 is allowed if strict RPF is enabled.
- C. A packet with the source IP address 10.0.13.10 arriving on port2 is allowed if strict RPF is disabled.
- D. A packet with the source IP address 10.100.110.10 arriving on port2 is allowed if strict RPF is enabled.
Answer: A,C
NEW QUESTION # 68
A network administrator wants to set up redundant IPsec VPN tunnels on FortiGate by using two IPsec VPN tunnels and static routes.
All traffic must be routed through the primary tunnel when both tunnels are up. The secondary tunnel must be used only if the primary tunnel goes down. In addition, FortiGate should be able to detect a dead tunnel to speed up tunnel failover.
Which two key configuration changes must the administrator make on FortiGate to meet the requirements? (Choose two.)
- A. Use the VPN wizard to create an IPsec template for a redundant IPsec VPN tunnel.
- B. Enable Dead Peer Detection.
- C. In the phase1-interface, enable npu-offload to detect a dead tunnel.
- D. Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel.
Answer: B,D
Explanation:
First, create one phase 1 for each path-one phase 1 for the primary VPN and one for the backup VPN. You should also enable DPD on both ends.
Second, create at least one phase 2 definition for each phase 1.
Third, you must add at least one static route for each VPN. Routes for the primary VPN must have a lower distance (or lower priority) than the backup. This causes FortiGate to use the primary VPN while it's available.
If the primary VPN fails, then FortiGate automatically uses the backup route. Alternatively, you could use a dynamic routing protocol, such as OSPF or BGP.
NEW QUESTION # 69
What are two features of the NGFW profile-based mode? (Choose two.)
- A. NGFW profile-based mode policies support both flow inspection and proxy inspection.
- B. NGFW profile-based mode must require the use of central source NAT policy.
- C. NGFW profile-based mode supports applying applications and web filtering profiles in a firewall policy.
- D. NGFW profile-based mode can only be applied globally and not on individual VDOMs.
Answer: A,C
Explanation:
NGFW (Next Generation Firewall) profile-based mode in FortiGate allows policies to use both flow- based and proxy-based inspection modes, providing flexibility depending on security and performance requirements. Additionally, profile-based mode supports applying applications and web filtering profiles directly in a firewall policy, allowing granular control over the traffic.
NEW QUESTION # 70
Refer to the exhibit.
FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?
- A. Replace port1 and port2 with the any interface in a single firewall policy.
- B. Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.
- C. Create an Aggregate interface that includes port1 and port2 to create a single firewall policy.
- D. Select port1 and port2 subnets in a single firewall policy.
Answer: B
Explanation:
"By default, you can select only a single interface as the incoming interface and a single interface as the outgoing interface. This is because the option to select multiple interfaces, or any interface in a firewall policy, is disabled on the GUI. However, you can enable the Multiple Interface Policies option on the Feature Visibility page to disable the single interface restriction."
"You can also specify multiple interfaces, or use the any option, if you configure a firewall policy on the CLI, regardless of the default GUI setting." Technical Deep Dive:
The correct answer is D.
The policies are identical except for the incoming interface: one is for Sales and one is for Engineering. FortiGate GUI policy creation normally restricts you to one incoming interface per policy. To consolidate both into a single GUI policy, the administrator must enable Multiple Interface Policies so both port1 and port2 can be selected in the same rule.
Why the others are wrong:
A is not enough, because policy matching also includes the incoming interface, not just the source subnets.
B changes the network design and is unnecessary.
C would work too broadly by matching traffic from any interface, which is not the intended controlled consolidation.
A matching CLI-style concept would be:
config firewall policy
edit <id>
set srcintf "port1" "port2"
set dstintf "<server-interface>"
set srcaddr "Sales_Subnet" "Engineering_Subnet"
set dstaddr "<web-server>"
set service "HTTP" "HTTPS"
set action accept
next
end
That preserves a single policy while still being specific about which interfaces are allowed.
NEW QUESTION # 71
Refer to the exhibits.
An administrator configured both members of an HA cluster at the same time. After one week of monitoring, the administrator wants to verify the HA failover performance. How can the administrator force a failover?
(Choose one answer)
- A. The administrator must set the parameter override to enable on HQ-NGFW-2.
- B. The administrator must increase the HA priority on HQ-NGFW-2.
- C. The administrator must reset the HA uptime on HQ-NGFW-1.
- D. The administrator must set the monitored port1 to down on HQ-NGFW-1.
Answer: C
Explanation:
"This slide shows the order when the HA override setting is disabled, which is the default behavior."
"1. The cluster compares the number of monitored interfaces that have a status of up. The member with the most available monitored interfaces becomes the primary.
2. The cluster compares the HA uptime of each member. The member with the highest HA uptime, by at least five minutes, becomes the primary.
3. The member with the highest priority becomes the primary."
"When HA override is disabled, the HA uptime has precedence over the priority setting. This means that if you must manually fail over to a secondary device, you can do so by reducing the HA uptime of the primary FortiGate. You can do this by running the diagnose sys ha reset-uptime command on the primary FortiGate, which resets its HA uptime to 0." Technical Deep Dive:
The correct answer is A .
Both HA members are configured with set override disable , so FGCP does not prefer the higher-priority unit first. With override disabled, the election order is based on monitored interfaces , then HA uptime , then priority , and finally serial number . Since the cluster has been running for one week , the secondary unit will have a much higher HA uptime than a unit whose uptime is reset to zero. Therefore, if the administrator runs diagnose sys ha reset-uptime on the current primary HQ-NGFW-1 , FGCP re-evaluates election and the other member can take over.
Option B is wrong because enabling override only on HQ-NGFW-2 does not by itself force an immediate clean failover in this scenario and also changes election behavior rather than performing the documented manual failover action. Option C is wrong because with override disabled, priority does not beat HA uptime
. Option D can simulate a link failover , but the study guide's documented manual failover method for this exact override-disabled condition is to reset the primary's HA uptime.
Relevant CLI:
diagnose sys ha reset-uptime
get system ha status
diagnose sys ha status
This is the clean exam-aligned method to trigger a controlled HA role change.
NEW QUESTION # 72
Refer to the exhibits.
Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-
1 and HQ-NGFW-2 as shown in the exhibits.
What would be the expected outcome in the HA cluster?
- A. The HA cluster will become out of sync because the override setting must match on all HA members.
- B. HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
- C. HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.
- D. HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority
Answer: B
Explanation:
From the current HA status, HQ-NGFW-1 is the primary and HQ-NGFW-2 is the secondary.
The administrator then changes these HA parameters:
HQ-NGFW-1: set override disable, set priority 90
HQ-NGFW-2: set override enable, set priority 110
In FGCP (A-P mode), the override (preemption) feature controls whether a higher-priority unit is allowed to take over the primary role.
When override is enabled, the cluster will prefer (and can re-elect) the unit with the highest device priority to become primary (preempting a lower-priority primary when conditions trigger re-election behavior as defined by FGCP).
Here, HQ-NGFW-2 has:
override enabled
higher priority (110) than HQ-NGFW-1 (90)
Therefore, the expected result is that HQ-NGFW-2 becomes the primary.
Why the other options are incorrect:
B is incorrect because it claims HQ-NGFW-2 has lower priority (it is higher: 110 > 90).
C is incorrect because a mismatch in the override setting is not what causes the "configuration out of sync" condition shown in get system ha status (that is about synchronized configuration databases, not a requirement that override values must match to remain in-sync).
D is incorrect because HA settings like override/priority are not synchronized in the way regular configuration objects are; they are device-level HA parameters.
NEW QUESTION # 73
......
NSE4_FGT_AD-7.6 Dumps for Fortinet NSE 4 Certified Exam Questions and Answer: https://www.edudump.com/exams/Fortinet/NSE4_FGT_AD-7.6/
NSE4_FGT_AD-7.6 Free Exam Study Guide! (Updated 96 Questions): https://drive.google.com/open?id=1t859r9N3jYFvbf9_JH1cn-bgsD4Rjp5g