- The Exam at a Glance: Numbers to Memorize
- Five Domains, Five Weights
- Domain 1 Cheat Sheet: Deployment and System Configuration
- Domain 2 Cheat Sheet: Firewall Policies and Authentication
- Domain 3 Cheat Sheet: Content Inspection
- Domains 4 and 5: Routing and VPNs
- How Questions Are Built and Scored
- Registration, Fees, and Retake Rules
- Certification Lifespan and Renewal Paths
- Scheduling Domains Across Your Prep Weeks
- Quick-Answer FAQ
- The exam runs 50-55 questions in 100 minutes, delivered at Pearson VUE test centers or via OnVUE.
- Content inspection is the heaviest domain at 25-30%; weight your review time accordingly.
- Only wholly correct answers earn credit: no partial credit, and no deductions for wrong answers.
- The fee is USD 200 excluding tax, rising to USD 210 on November 2, 2026.
The Exam at a Glance: Numbers to Memorize
This page condenses what you need to know about Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) into a single scannable review. The scope is FortiOS 7.6.0, and the published objectives also touch FortiGate CNF, FortiGate-VM in public clouds, and FortiSASE fundamentals. Treat those as fundamentals-level extras layered on top of core FortiGate administration, not as separate deep-dive domains.
| Item | What to Know |
|---|---|
| Certification | Fortinet NSE 4 - FortiOS 7.6 Administrator |
| Product scope | FortiOS 7.6.0 |
| Question count | 50-55 |
| Time limit | 100 minutes |
| Languages | English and Japanese |
| Delivery | Pearson VUE test centers or OnVUE (online proctored) |
| Question types | Multiple-choice and drag-and-drop |
| Prerequisites | None required |
| Retake wait after a fail | 15 days |
| Credential validity | Two years, plus a version-specific exam badge |
For a deeper treatment of eligibility, see our NSE4_FGT_AD-7.6 requirements guide. Although there is no formal prerequisite, Fortinet recommends the associated course, 1-2 years of networking experience, 0-1 year of network security experience, and at least six months of hands-on time with FortiGate. That last item is the one most candidates underestimate: the exam rewards people who have actually navigated the GUI and CLI, not those who only read about them.
Five Domains, Five Weights
The official objectives group the exam into five headings, each with a published weight range. Memorize the ranges, because they tell you where your hours should go. A full breakdown lives in our NSE4_FGT_AD-7.6 exam domains guide.
| Domain | Weight | Priority |
|---|---|---|
| Deployment and system configuration | 20-25% | High |
| Firewall policies and authentication | 20-25% | High |
| Content inspection | 25-30% | Highest |
| Routing | 10-15% | Moderate |
| VPNs | 10-15% | Moderate |
Domain 1 Cheat Sheet: Deployment and System Configuration
This domain (20-25%) covers getting a FortiGate onto the network and keeping it healthy. Expect scenario questions that show a configuration excerpt and ask what is wrong or what will happen.
Deployment and System Configuration
Know how a FortiGate is initially configured, how it participates in a larger fabric, and how it is made resilient.
- Initial setup: interface addressing, administrative access settings, and administrator profiles that restrict what each admin can do
- Operating modes and how they change traffic handling, including the practical difference between NAT mode and transparent mode
- Virtual domains (VDOMs) and how they segment a single device into logical firewalls
- High availability concepts: cluster roles, heartbeat links, and what is and is not synchronized between members
- Fortinet Security Fabric basics: how devices discover and report to a root FortiGate
- Logging and monitoring fundamentals, including where logs are stored and how to read them when troubleshooting
- The cloud-related scope items: FortiGate CNF, FortiGate-VM in public clouds, and FortiSASE at a fundamentals level
A common trap here is confusing what must match between HA cluster members with what is configured per device. Read each question's configuration excerpt carefully before choosing; the exam is built to reward precision, not familiarity.
Domain 2 Cheat Sheet: Firewall Policies and Authentication
The second 20-25% domain is the engine of FortiGate administration. Policy evaluation order and object matching generate a large share of troubleshooting scenarios.
Firewall Policies and Authentication
Be able to predict, from a policy list and a packet description, which policy matches and what happens next.
- Policy evaluation is top-down, first match wins; implicit deny applies when nothing matches
- Policy match criteria: incoming and outgoing interfaces, source, destination, schedule, and service
- Source NAT and destination NAT (virtual IPs), including when each is applied in the traffic path
- Central NAT versus policy-based NAT and how to recognize which mode a configuration excerpt is using
- Local, remote server (such as LDAP and RADIUS), and single sign-on authentication methods
- User groups and how identity-based policies differ from IP-based policies
- Policy logging settings and how to use log entries to prove which policy handled a session
When a question shows a policy table, work through it the way the firewall does: interface pair first, then addresses, then service and schedule. Candidates who skim the interface pair often pick the wrong policy.
Domain 3 Cheat Sheet: Content Inspection
This is the largest domain at 25-30% and deserves the most review time. It is also where the exam moves from "does traffic pass?" to "what is inside the traffic, and what do we do about it?"
Content Inspection
Security profiles, inspection modes, and how they attach to policies.
- Security profiles apply to traffic only when attached to a firewall policy that allows it
- Flow-based versus proxy-based inspection: how they differ in behavior, features, and resource use
- Antivirus, web filtering, application control, intrusion prevention, and DNS filtering profiles
- SSL/TLS deep inspection versus certificate inspection, and why encrypted traffic is invisible without the former
- Certificate handling: what clients see when the FortiGate re-signs traffic and why untrusted CA warnings appear
- Profile groups and how sequencing of inspection affects what gets blocked first
- Reading UTM logs to identify which profile acted on a session
Because only fully correct answers earn credit, drag-and-drop items in this domain, such as ordering inspection stages or matching profiles to threats, require getting every element right. Practice them in that mindset.
Domains 4 and 5: Routing and VPNs
Together these two domains each carry 10-15%. They are smaller, but they are also the most "mechanical," which makes them efficient places to secure points.
Routing (10-15%)
- The routing table versus the forwarding decision: how the best route is selected, including administrative distance and priority for static routes
- Static routes, route metrics, and what happens when multiple routes to the same destination exist
- Policy-based routing and how it overrides destination-based lookups
- SD-WAN fundamentals: members, zones, and rules that steer traffic by performance criteria
- Reverse path forwarding (RPF) checks and why asymmetric paths cause dropped sessions
VPNs (10-15%)
- IPsec phase 1 and phase 2: what each negotiates and which mismatches prevent the tunnel from forming
- Site-to-site versus remote-access designs, and where policy fits on the tunnel interface
- Reading IKE debug and diagnostic output to find the failing parameter
- SSL VPN concepts and how they differ from IPsec in client requirements and use cases
For VPN troubleshooting questions, identify which phase is failing before evaluating answer options. That one habit eliminates half the distractors.
How Questions Are Built and Scored
The exam uses multiple-choice and drag-and-drop items built around operational scenarios, configuration excerpts, and troubleshooting evidence. In practice that means you will often be handed a snippet of CLI output, a policy table, or a log entry and asked to diagnose or predict. Rote memorization of definitions is not enough; you need to read evidence.
Key Takeaway
Scoring is all-or-nothing per question: only wholly correct answers receive credit, with no partial credit and no penalty for wrong answers. That means you should never leave an item blank, and on multi-select items you should commit to the full set you are confident in rather than hedging.
Pass or fail depends on overall performance. A numeric passing threshold and a candidate pass-rate statistic were not verified in the current public sources, so be wary of any site quoting a precise cut score or pass percentage as fact. We cover what is and is not known in our passing score breakdown and our pass rate analysis. If you are wondering how the question style translates into difficulty, our difficulty guide walks through it.
Registration, Fees, and Retake Rules
- Fee: USD 200 excluding tax as of October 21, 2026, increasing to USD 210 on November 2, 2026 (fee notice updated October 5, 2026). If you are close to ready, scheduling before the increase saves money.
- Delivery: Pearson VUE test centers or OnVUE. NSE 4 OnVUE eligibility remains confirmed by the October 13, 2026 delivery notice.
- OnVUE rules: books and notes are prohibited, so there is no personal cheat sheet at the exam itself. This page is for review beforehand.
- Time: 100 minutes for the exam. An additional 15 minutes covers non-testing appointment activities and is separate from the exam timer.
- After a failed attempt: a 15-day wait before retaking.
Our certification cost breakdown covers the full pricing picture, and the exam dates and scheduling guide explains booking mechanics.
Certification Lifespan and Renewal Paths
Passing the proctored exam earns the two-year NSE 4 FortiOS certification and a version-specific exam badge. To keep it active, you have several options:
- Pass a subsequent NSE 4 FortiOS exam version.
- Complete an eligible, available later-version recertification course and its online assessment, while your prior proctored exam is less than two years old.
- Achieve or renew NSE 7.
- Pass an NSE 8 practical exam.
If the certification expires, you must meet the initial requirements again. Calendar your expiry date the day you pass. For the career side of the equation, see whether the certification is worth it, review what employers pay in the salary guide, and browse roles in our jobs overview. Typical hiring contexts include network security administrators, firewall engineers, and managed security service providers supporting FortiGate estates.
Scheduling Domains Across Your Prep Weeks
If you are building a plan, sequence by dependency and weight rather than by the order of the objectives. Policies underpin inspection, and inspection carries the most points, so build toward it. For a fuller plan, use our NSE4_FGT_AD-7.6 study guide and the training overview.
Deployment and system configuration
- Build a lab, configure interfaces, admin profiles, and HA basics
- Review the cloud and FortiSASE fundamentals items
Firewall policies and authentication
- Practice policy evaluation order and NAT scenarios
- Configure local and remote authentication and identity-based policies
Content inspection (heaviest domain)
- Compare flow-based and proxy-based inspection hands-on
- Enable deep inspection and observe certificate behavior
- Read UTM logs to confirm which profile acted
Routing and VPNs
- Break and fix static routes, policy routes, and SD-WAN rules
- Bring up IPsec tunnels and read IKE diagnostics
Timed practice
- Run full-length sets under a 100-minute limit
- Revisit weak domains in proportion to their weights
Use our NSE4_FGT_AD-7.6 practice tests in the final weeks to rehearse reading configuration excerpts under time pressure. The scenario-based format is the skill to train, and the practice question bank is built for exactly that.
Quick-Answer FAQ
The exam has 50-55 questions and a 100-minute time limit. An extra 15 minutes for non-testing appointment activities is separate from the exam timer.
No. Only wholly correct answers receive credit, and there are no deductions for incorrect answers, so always provide a complete answer rather than skipping.
Content inspection, at 25-30%, is the largest. Deployment and system configuration and firewall policies and authentication follow at 20-25% each, with routing and VPNs at 10-15% each.
No. OnVUE prohibits books and notes, so your preparation must be complete before exam day.
The fee is USD 200 excluding tax as of October 21, 2026, rising to USD 210 on November 2, 2026. After a failed attempt you must wait 15 days before retaking.
Use this sheet as a final-week checklist alongside the NSE4_FGT_AD-7.6 cheat sheet companion material, and walk into the exam able to explain each domain's core mechanics from memory.