- The Exam at a Glance: Format, Fees and Rules
- How the Five Domains Divide the Exam
- Domain 1: Deployment and System Configuration (20-25%)
- Domain 2: Firewall Policies and Authentication (20-25%)
- Domain 3: Content Inspection (25-30%)
- Domain 4: Routing (10-15%)
- Domain 5: VPNs (10-15%)
- How the Questions Are Written
- Sequencing the Domains in Your Prep
- Where the Credential Gets Used
- Frequently Asked Questions
- Content inspection is the heaviest domain at 25-30%, so security profiles deserve the most lab hours.
- The exam has 50-55 questions in 100 minutes, with no partial credit and no penalty for wrong answers.
- Routing and VPNs are each only 10-15%, but both appear in troubleshooting scenarios that cross domains.
- The exam fee is USD 200 excluding tax as of October 21, 2026, rising to USD 210 on November 2, 2026.
The Exam at a Glance: Format, Fees and Rules
Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) validates that you can deploy, configure and troubleshoot FortiGate firewalls running FortiOS 7.6.0. The official scope also touches FortiGate CNF, FortiGate-VM in public clouds, and FortiSASE fundamentals, so expect the exam to treat FortiGate as a platform that lives in more than one place. If you are still orienting yourself, What Is NSE4_FGT_AD-7.6? covers the naming and purpose.
Here is the delivery and policy picture, drawn from Fortinet's published exam policies:
| Item | What Fortinet Publishes |
|---|---|
| Questions | 50-55, multiple-choice and drag-and-drop |
| Time limit | 100 minutes (an extra 15 minutes covers non-testing appointment activities and is separate from the exam timer) |
| Languages | English and Japanese |
| Delivery | Pearson VUE test centers or OnVUE online proctoring |
| Fee | USD 200 excluding tax on October 21, 2026; USD 210 from November 2, 2026 |
| Prerequisites | None required to sit the exam |
| Retake wait | 15 days after a failed attempt |
| Validity | Two-year NSE 4 FortiOS certification plus a version-specific exam badge |
Scoring deserves attention. Pass/fail depends on overall performance, and only wholly correct answers earn credit. There is no partial credit and no deduction for incorrect answers, which means you should never leave a question blank. A numeric passing threshold has not been verified in current public sources, so treat any specific percentage you see online with suspicion. Our breakdown in NSE4_FGT_AD-7.6 Passing Score 2026 explains what is and is not confirmed. The same caution applies to pass-rate claims, which are examined in NSE4_FGT_AD-7.6 Pass Rate 2026: What the Data Shows.
How the Five Domains Divide the Exam
Fortinet publishes weight ranges rather than fixed percentages. The ranges overlap in practice because the sum of the minimums and maximums brackets 100%, so use them to rank your effort, not to predict exact question counts.
| Domain | Weight | Prep Priority |
|---|---|---|
| Deployment and system configuration | 20-25% | High: foundation for everything else |
| Firewall policies and authentication | 20-25% | High: core daily FortiGate work |
| Content inspection | 25-30% | Highest: largest single domain |
| Routing | 10-15% | Moderate: heavy on troubleshooting |
| VPNs | 10-15% | Moderate: config detail matters |
Three domains together account for roughly 65-80% of the exam. A candidate who is strong on deployment, policies and content inspection but thin on routing and VPNs can still land in a workable position, but the reverse is much riskier. For a longer walkthrough of the same structure, see our companion piece NSE4_FGT_AD-7.6 Exam Domains 2026: Complete Guide to All 5 Content Areas.
Domain 1: Deployment and System Configuration (20-25%)
This domain covers getting a FortiGate onto the network and keeping it manageable. It is the domain where hands-on experience pays off fastest, because every later domain assumes the device is correctly set up.
Deployment and system configuration
Expect questions on initial setup, administrative access, and operating modes, plus the fundamentals of high availability and the Security Fabric.
- Initial setup: interfaces, administrative access protocols, and admin profiles with least-privilege roles
- Operating modes: NAT mode versus transparent mode, and when each is appropriate
- FortiGuard connectivity, licensing status and update behavior
- High availability: active-passive versus active-active, cluster synchronization, and failover triggers
- Security Fabric: root and downstream FortiGates, and how fabric devices share telemetry
- Configuration management: backups, revisions, and VDOM concepts
- Platform scope: how FortiGate-VM in public clouds and FortiGate CNF differ from a hardware appliance at the concept level
A recurring exam pattern here is the "what is the effect of this setting" question. You will see a setting described or shown in an excerpt and have to identify the resulting behavior, such as which administrator can see which VDOM or why an HA member is not synchronizing. Memorizing menu paths is less useful than understanding cause and effect.
Domain 2: Firewall Policies and Authentication (20-25%)
Policy logic is the heart of FortiGate administration, and this domain tests it with scenarios rather than definitions. Policy order, match criteria and NAT behavior are the most common failure points for candidates who only read about the product.
Firewall policies and authentication
You need to read a policy table and predict which traffic matches which rule, and you need to understand how users are identified.
- Policy matching: top-down evaluation, source and destination objects, services, schedules, and implicit deny
- NAT: source NAT with interface address versus IP pools, and destination NAT through virtual IPs
- Policy types and inspection mode: flow-based versus proxy-based, and why the choice affects available features
- Authentication: local users, LDAP and RADIUS integration, and user groups in policies
- Single sign-on options and how identified users map to policy matches
- Logging and monitoring: reading logs and the session table to confirm which policy handled traffic
Authentication questions tend to be about the interaction between components: which server the FortiGate queries, what happens when the server is unreachable, and how group membership drives policy selection. This is also where FortiSASE fundamentals can surface, since remote users authenticated through a cloud service still follow policy logic you must recognize.
Domain 3: Content Inspection (25-30%)
This is the largest domain, and it is where the FortiGate separates itself from a simple packet filter. If you only have limited lab time, spend the largest share here.
Content inspection
The exam expects you to configure security profiles, attach them to policies, and diagnose why traffic was or was not blocked.
- Security profiles: antivirus, web filtering, application control, intrusion prevention, and DNS filtering
- SSL/SSH inspection: certificate inspection versus deep inspection, CA certificate trust, and exemptions
- Why deep inspection is required before many profiles can examine encrypted payloads
- Inspection modes: how flow-based and proxy-based processing change profile behavior
- Profile groups and how profiles are applied through firewall policies
- FortiGuard categories, rating overrides, and local categories
- Logging inspection events and interpreting blocked-traffic evidence
The most common conceptual trap is SSL inspection. Candidates often know that a web filter blocks a category but cannot explain why HTTPS content still passed. Understanding when the FortiGate sees only the certificate and SNI versus the full decrypted stream is the single most valuable idea in this domain. Troubleshooting questions frequently give you a log entry or a profile excerpt and ask what change would produce the desired block.
Because this domain carries the most weight, it is also the one most likely to appear in questions that blend with Domain 2. A policy question may hinge on which profile is attached, and a content question may hinge on policy order.
Domain 4: Routing (10-15%)
Routing is the smaller domain but a disproportionate source of anxiety, mostly because candidates underestimate it. The scope is practical: how a FortiGate decides where to send a packet and how to influence that decision.
Routing
Focus on static routing behavior, route selection, and basic dynamic routing and SD-WAN concepts at the administrator level.
- Static routes: distance, priority, and how the routing table chooses among candidates
- Routing table versus policy routes, and which takes precedence in forwarding decisions
- Reverse path forwarding checks and why asymmetric traffic gets dropped
- SD-WAN fundamentals: members, zones, health checks and rules that steer traffic
- Basic dynamic routing concepts such as OSPF and BGP neighbor and route exchange behavior
- Troubleshooting with routing table output and flow debugging
Exam items here often present a routing table excerpt and ask why a destination is unreachable or which route will win. Knowing distance versus priority, and being able to spot a missing return route, covers a large share of what is asked.
Domain 5: VPNs (10-15%)
VPN questions reward precision. A single mismatched parameter breaks a tunnel, and the exam likes to show you the evidence of exactly that.
VPNs
Know how IPsec tunnels are built, what must match on both ends, and how to read negotiation failures.
- IPsec phases: phase 1 (IKE) versus phase 2, and the parameters that must match
- Site-to-site configuration, including selectors, proposals and policy requirements for tunnel traffic
- Remote access VPN concepts and client behavior
- Required supporting configuration: routes toward the tunnel and firewall policies permitting traffic
- Troubleshooting with IKE debug output, tunnel status and mismatch identification
- How remote connectivity relates to FortiSASE fundamentals at the concept level
A reliable pattern is the "tunnel is up but traffic does not flow" scenario. The answer is usually a missing route or policy rather than an IKE problem, which ties this domain back to Domains 2 and 4.
Key Takeaway
Routing and VPNs together are only 20-30% of the exam, but their questions are often troubleshooting scenarios that draw on policy and routing knowledge at the same time. Treat them as applied skills, not isolated chapters.
How the Questions Are Written
Fortinet describes the items as multiple-choice and drag-and-drop questions built on operational scenarios, configuration excerpts, and troubleshooting evidence. That wording tells you what to practice.
- Operational scenarios: a short business need followed by a question about which feature or configuration meets it.
- Configuration excerpts: CLI or GUI snippets you must interpret, often with a single wrong value.
- Troubleshooting evidence: logs, debug output, routing tables or session information from which you must infer the fault.
- Drag-and-drop: ordering or matching items, scored all-or-nothing.
With 50-55 questions in 100 minutes you have a little under two minutes per item on average. Excerpt-heavy questions consume more time, so move steadily and flag long ones for review. For an honest read on how demanding this feels in practice, see How Hard Is the NSE4_FGT_AD-7.6 Exam?
Sequencing the Domains in Your Prep
Fortinet recommends the associated course, 1-2 years of networking experience, 0-1 year of network security, and at least six months working with FortiGate. If you fall short on hands-on time, the lab matters more than extra reading. Here is one domain-ordered plan built around dependencies rather than generic study habits:
Deployment and system configuration
- Build a lab FortiGate, set interfaces and admin access, configure HA and fabric basics
- Everything later depends on a correctly working base
Firewall policies and authentication
- Build policy sets, NAT, VIPs and LDAP/RADIUS users
- Verify matches through logs and the session table
Content inspection
- Attach each security profile to policies and test blocks
- Compare certificate inspection to deep inspection until the difference is obvious
Routing and VPNs
- Break and fix static routes, then build and deliberately misconfigure an IPsec tunnel
- Practice reading debug output
Mixed review
- Timed scenario sets across all domains, with extra reps on content inspection
Content inspection gets two weeks because it is the largest domain and the most lab-dependent. For a broader plan, read the NSE4_FGT_AD-7.6 Study Guide 2026, and use the NSE4_FGT_AD-7.6 cheat sheet for revision during practice only, since notes are not allowed at the actual exam.
Where the Credential Gets Used
NSE 4 FortiOS is an administrator-level credential, so it lines up with roles that operate FortiGate devices day to day: network security administrators, firewall engineers, security operations staff, and support or managed-security-provider engineers who manage customer FortiGates. Organizations that standardize on Fortinet, along with Fortinet partners and integrators, are the most natural audience. The credential is valid for two years, and Fortinet lists several renewal paths, including passing a later NSE 4 FortiOS exam version, completing an eligible later-version recertification course and online assessment while the prior proctored exam is under two years old, achieving or renewing NSE 7, or passing an NSE 8 practical exam. An expired certification means meeting the initial requirements again.
For role-focused detail, see NSE4_FGT_AD-7.6 Jobs, and if you are weighing the investment, Is the NSE4_FGT_AD-7.6 Certification Worth It? covers the reasoning without inventing salary numbers.
When you are ready to test yourself against realistic scenario questions, work through the NSE4_FGT_AD-7.6 practice exams by domain first, then in mixed timed sets. Eligibility details are in NSE4_FGT_AD-7.6 Requirements 2026.
Frequently Asked Questions
Content inspection is the largest at 25-30%. Deployment and system configuration and Firewall policies and authentication are each 20-25%, while Routing and VPNs are each 10-15%.
The exam has 50-55 multiple-choice and drag-and-drop questions in 100 minutes. An additional 15 minutes for non-testing appointment activities is separate from the exam timer.
No. Only wholly correct answers receive credit, with no partial credit, and incorrect answers carry no deduction, so answer every question. A numeric passing threshold has not been verified in current public sources.
There are no prerequisites to take the exam, though Fortinet recommends the associated course and at least six months of FortiGate experience. The fee was USD 200 excluding tax on October 21, 2026, increasing to USD 210 on November 2, 2026.
Yes, the exam is available through Pearson VUE test centers or OnVUE, and OnVUE prohibits books and notes. After a failed attempt you must wait 15 days before retaking.