Free NSE4_FGT_AD-7.6 Practice Questions

Question 1

A newly added FortiGate deny rule has not stopped new HTTPS connections from 10.24.8.0/24 to 203.0.113.60. The relevant policies are evaluated in this order:

1. ID 84: source 10.24.0.0/16; destination 203.0.113.60; TCP/443; ACCEPT.
2. ID 7: source 10.24.8.0/24; destination 203.0.113.60; TCP/443; DENY.

Both policies match the incoming and outgoing interfaces and use the always schedule. Neither requires authentication. Other hosts in the /16 must retain access. The change review should approve:

Accepted Answer

Moving ID 7 above ID 84, retaining both source objects.

Answer

Renumbering ID 7 to ID 1 without moving it.

Answer

Setting ID 7's service to ALL in its current position.

Answer

Changing ID 84 to DENY while retaining its entire /16 source.

Question 2

Users receive a certificate warning when opening a partner website through FortiGate's full SSL inspection. Their clients already trust Fortinet_CA_SSL, but the certificate presented for this connection is signed by Fortinet_CA_Untrusted. FortiGate records resign-as-untrusted. The origin certificate's hostname and dates are valid; its private issuer is absent from FortiGate's trusted CAs. The security team has independently validated and approved that issuer.

Choose the repair that retains both inspection and certificate validation.

Accepted Answer

Import the approved origin CA chain into FortiGate's trusted CAs.

Answer

Reinstall Fortinet_CA_SSL in the affected clients' trust stores.

Answer

Set untrusted-server-certificate handling to Ignore, keeping full SSL inspection enabled.

Answer

Exclude the partner's hostname from SSL inspection on the affected policy.

Question 3

A FortiGate SD-WAN rule uses Lowest Cost (SLA). Its target requires both latency below 60 ms and packet loss below 1%. Calculate loss from the supplied 200-probe sample. Both members are alive, have valid routes, and are permitted by the firewall policy.

WAN1: configured cost 10; latency 30 ms; 4 unanswered probes out of 200.
WAN2: configured cost 20; latency 45 ms; 1 unanswered probe out of 200.

Which member qualifies for selection under these measurements?

Accepted Answer

WAN2; its 0.5% loss passes, while WAN1's 2% loss fails.

Answer

WAN1, because its lower configured cost is evaluated before the loss requirement.

Answer

WAN1, because four unanswered probes out of 200 represent 0.02% packet loss.

Answer

Either member, because both satisfy the latency target.

Question 4

During maintenance, node A rejoins a two-member active-passive FGCP cluster. Both nodes are synchronized, and all monitored interfaces are up. Override is disabled on both members, with an HA uptime margin of 300 seconds.

Node A: priority 200; HA uptime 90 seconds.
Node B: priority 100; HA uptime 7,200 seconds.

Node B remains primary despite its lower priority. What accounts for this election result?

Accepted Answer

B's HA uptime advantage exceeds the margin and is considered before priority.

Answer

Device priority does not apply to elections in active-passive mode.

Answer

Lower numerical priority wins when monitored-interface states match.

Answer

The 300-second margin prevents a returning node from becoming primary until it has waited that long.

Question 5

An external client must reach an HTTPS service at 203.0.113.44:8443. Central NAT is disabled on the FortiGate. The VIP maps TCP/8443 on that address to 10.50.1.44:443, where the DMZ server listens. The inbound ACCEPT policy has the correct interfaces, source, VIP destination, and schedule, but permits only service TCP/8443. Routing and the server's return path are verified. A trace shows DNAT to 10.50.1.44:443 followed by a forwarding-policy denial.

To preserve both the published client port and the server's listening port, the administrator should:

Accepted Answer

Keep the VIP mapping and change the policy service to TCP/443.

Answer

Change the VIP's external port from 8443 to 443.

Answer

Enable SNAT while retaining service TCP/8443 on the inbound policy.

Answer

Map the VIP to server port 8443 while leaving its external port unchanged.

Question 6

Responders confirm exploitation of an unpatched HTTPS portal behind FortiGate. TLS deep inspection is working, and IPS events identify the exploit signature in the decrypted requests. In the sensor, a broad Monitor entry appears before an individual Block entry for that signature; both entries include it. The broad entry also includes a verified false positive triggered by legitimate transactions. Attack and legitimate requests arrive through the same upstream proxy address.

What can stop the identified exploit immediately while preserving those legitimate transactions?

Accepted Answer

Move the exploit-specific Block entry ahead of the broad Monitor entry.

Answer

Change the first, broad sensor entry to Block for every signature it includes.

Answer

Quarantine the shared proxy address while the portal remains unpatched.

Answer

Add a duplicate exploit-specific Block entry after both existing sensor entries.

Question 7

Two FortiGates establish a site-to-site IKEv2 tunnel and pass traffic after the initial IKE_AUTH exchange. The IKE SA remains established, but every subsequent Child-SA rekey fails with a proposal error. The protected subnets are correctly mirrored, and both peers use aes256-sha256 for Phase 2.

FortiGate A: Phase 2 PFS enabled; DH group 14.
FortiGate B: Phase 2 PFS enabled; DH group 20.

The recurring rekey failure calls for which correction?

Accepted Answer

Configure a matching Phase 2 PFS DH group on both peers.

Answer

Stagger the Phase 2 lifetimes to prevent simultaneous rekey attempts.

Answer

Replace the mirrored Phase 2 selectors with wildcard selectors at both ends.

Answer

Enable SNAT on both LAN-to-tunnel policies.

Question 8

A FortiGate CNF instance and its AWS Gateway Load Balancer endpoint (GWLBe) are healthy. The intended security policy is attached, but a new deny rule records no hits while new test connections still reach the internet. The protected subnet's 0.0.0.0/0 route points directly to a NAT gateway. The endpoint subnet and return path are already prepared for inspection.

What deployment step was omitted?

Accepted Answer

Routing the protected subnet's internet traffic through the GWLBe.

Answer

Enabling accepted-session logging in the CNF policy.

Answer

Moving the deny rule above the permit rules.

Answer

Replacing the deny rule's source with the NAT gateway's public address.

Question 9

A supplier website matches a static URL entry set to Allow, yet FortiGate blocks it because its FortiGuard category is set to Block. Licensing and FortiGuard connectivity are healthy. The same web-filter profile has an enabled local category, Approved-Suppliers, set to Monitor.

Which exception preserves the category block for other websites and still permits antivirus inspection of this supplier's downloads?

Accepted Answer

Create a web-rating override for the supplier using Approved-Suppliers.

Answer

Set the blocked FortiGuard category to Allow in this web-filter profile.

Answer

Set the static URL action to Monitor.

Answer

Exempt the supplier from both FortiGuard category checks and antivirus inspection.

Question 10

The following IPv4 routes are active on a FortiGate, and all three egress paths are reachable:

0.0.0.0/0 - wan2 - distance 1 - priority 0
10.70.0.0/16 - wan1 - distance 5 - priority 0
10.70.8.0/24 - tunnelX - distance 20 - priority 10

A permitted new session targets 10.70.8.15. No policy route or SD-WAN rule overrides ordinary destination routing. Its first packet follows:

Accepted Answer

tunnelX; a more specific active prefix takes precedence over the less-specific routes.

Answer

wan2; its route has the smallest administrative distance in the table.

Answer

wan1; its route has lower distance and priority than the route through tunnelX.

Answer

Both wan1 and tunnelX; each has an active route covering the destination.

Free NSE4_FGT_AD-7.6 Practice Questions

Domain 1: Deployment and system configuration (20-25%)

Question 1

Question 2

Domain 2: Firewall policies and authentication (20-25%)

Question 3

Question 4

Domain 3: Content inspection (25-30%)

Question 5

Question 6

Question 7

Domain 4: Routing (10-15%)

Question 8

Question 9

Domain 5: VPNs (10-15%)

Question 10

That's 10 of 1,030