10 free Fortinet NSE4_FGT_AD-7.6 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 84 questions. Work through them, then open each answer to check your reasoning.
Get all 84 questions (US$39) · Download these 10 as a PDF
Question 1
The FortiGate device HQ-NGFW-1 with the IP address 10.0.13.254 sends logs to the FortiAnalyzer device with the IP address 10.0.13.125. The administrator wants to verify that reliable logging is enabled on HQ-NGFW-1.
Which exhibit helps with the verification?
✅Correct Answer: D, FortiGate management interface showing All Logging Devices (1) with device HQ-NGFW-1 at IP 10.0.13.254, FortGate-VM64-KVM platform, firmware 7.6.0.build3401, serial FGVM02TM24013342, status Up, with a green indicator for Real Time logging mode visible, disk quota usage showing 50 GB
The two FortiAnalyzer Device Manager screens are identical except for one detail: in D the Logging Mode cell for HQ-NGFW-1 at 10.0.13.254 shows Real Time with a padlock. FortiAnalyzer displays that padlock when the log stream arrives over a secured OFTP session, which FortiOS builds only on top of the reliable TCP transport, so it confirms that reliable logging is active on the FortiGate. The administrator can verify the setting from the FortiAnalyzer side without touching the FortiGate CLI, which is exactly what the question asks the exhibit to do.
Show answer and explanation
The answer and explanation for this question are in the free sample PDF.
Question 2
A network administrator has enabled full SSL inspection and web filtering on FortiGate.
When visiting any HTTPS websites, the browser reports certificate warning errors.
When visiting HTTP websites, the browser does not report errors.
What is the reason for the certificate warning errors?
Show answer and explanation
Question 3
Refer to the exhibit, which shows a firewall policy to enable active authentication.
When attempting to access an external website using an active authentication method, the user is not presented with a login prompt.
What is the most likely reason for this situation?
Show answer and explanation
Correct answer: A. The Service DNS is required in the firewall policy.
The exhibit shows a port4 to port2 policy whose Source is HQ_SUBNET together with the Remote-users group, Destination all, and Service limited to ALL_ICMP, HTTPS and HTTP. Because a user group is referenced in Source, FortiGate will challenge matching HTTP or HTTPS traffic with the captive portal. The problem is that DNS is not in the Service list, so the workstation cannot resolve the external site name. Without a resolved address the browser never generates the HTTP or HTTPS request, FortiGate never sees a session that needs authentication, and no login prompt is displayed. Adding the DNS service, or a separate policy allowing DNS, restores the redirect.
Why the other options are wrong
- B. User groups are referenced in the Source column, which is exactly where Remot-sers already appears in the exhibit; Destination holds addresses and is correctly set to all.
- C. FSSO is passive authentication and nothing in the exhibit points to an FSSO group; an active authentication policy uses a local or remote user group instead.
- D. If the account were simply missing, the captive portal page would still be presented and the credentials would then be rejected, so the absence of any prompt is not explained.
Question 4
A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view.
Why is the policy order different in these two views?
Show answer and explanation
Correct answer: A. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
The Interface Pair View organizes and displays policies based on the matching interfaces involved (grouping policies by source/destination interface pairs), while the By Sequence View shows the actual processing order in which FortiGate evaluates the rules during traffic handling. This accounts for the different ordering observed between the two views. The By Sequence View reflects the true rule evaluation sequence that impacts traffic flow and policy matching.
Why the other options are wrong
- B. By Sequence View does not group by priority; it shows actual processing order. Interface Pair View does not follow traffic logs.
- C. FortiGate does not dynamically reorder policies in Interface Pair View based on traffic patterns; both views are static.
- D. Policies are not sorted by security levels in Interface Pair View; the difference is in how the two views organize and display the same policy set.
Question 5
You have created a web filter profile named restrict_media-profile with a daily category usage quota.
When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.
What could be the reason?
Show answer and explanation
Correct answer: A. The inspection mode in the firewall policy is not matching with web filter profile feature set.
Web filter profiles with certain features, such as category usage quotas, require prox-ased inspection to function. If the firewall policy is configured for flow-based inspection rather than proxy-based inspection, the profile with quota features will not appear in the available dropdown list because the policy's inspection mode is incompatible with the profile's feature set. The profile cannot be applied to a policy that uses an incompatible inspection method.
Why the other options are wrong
- B. A web filter profile can be referenced in multiple policies; this is not a restriction on availability.
- C. Naming conventions do not prevent a profile from appearing in the dropdown.
- D. The restriction applies to flow-based versus proxy-based inspection modes, not specifically no-inspection versus deep-inspection.
Question 6
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
Show answer and explanation
Question 7
Refer to the exhibit.
A partial cloud topology is shown.
You deployed a FortiGate Cloud-Native Firewall (CNF) in AWS.
During the deployment, which components must be FortiGate CNF create to handle traffic from the EC2 instance?
Show answer and explanation
Correct answer: D. The gateway load balancer endpoint (GWLBe) in the customer virtual private cloud (VPC)
Fortinet builds and manages the CNF VPC that holds the Gateway Load Balancer and the FortiGate CNF instances. What the deployment adds inside the customer VPC is the Gateway Load Balancer endpoint (GWLBe). Traffic from the EC2 instance is routed to that endpoint, which carries it across the PrivateLink connection to the GWLB and on to the FortiGate CNF instance for inspection before it returns and exits through the internet gateway.
Why the other options are wrong
- A. The GWLB belongs to the Fortinet-managed CNF VPC and the internet gateway is existing customer infrastructure, so neither one is created in the customer VPC for this traffic flow.
- B. The customer VPC and its EC2 workload already exist, and the GWLB is built in the CNF VPC, not in the customer VPC, so this set does not describe what the deployment adds there.
- C. The customer VPC is pre-existing infrastructure not created by FortiGate CNF; only the GWLBe within that VPC is created by the CNF deployment.
Question 8
You have configured the below commands on a FortiGate.
What would be the impact of this configuration on FortiGate?
Show answer and explanation
Correct answer: C. FortiGate will enable strict RPF on all its interfaces and port1 will be exempted from RPF checks.
The configuration first enables strict-src-check globally at the system settings level, which applies strict RPF to all interfaces. Then, at the interface level for port1, the command 'set src-check disable' explicitly disables the RPF check on that specific interface. Interfac-evel configurations override global settings, so port1 will be exempted from RPF checks while all other interfaces maintain strict RPF enforcement.
Why the other options are wrong
- A. Port1 is not enabled for asymmetric routing; it is disabled from RPF checks entirely with the 'disable' command.
- B. Port1 is not configured with flexible RPF; the 'disable' command turns off RPF checking completely, not switches it to flexible mode.
- D. Interface-level configurations take precedence over global settings, so port1's 'sr-heck disable' overrides the global strict-src-check setting for that specific interface only.
Question 9
FortiGate is integrated with FortiAnalyzer and FortiManager.
When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?
Show answer and explanation
Correct answer: A. Universally Unique Identifier
The Universally Unique Identifier (UUID) is the attribute that must be included in a firewall policy to enhance functionality and enable log recording on both FortiAnalyzer and FortiManager. The UUID serves as a persistent, globally unique identifier for the policy that remains consistent across FortiGate, FortiAnalyzer, and FortiManager integrations, allowing proper correlation and tracking of logs and policy-related events across the integrated management platform.
Why the other options are wrong
- B. Log ID is not a standard policy attribute required for FortiAnalyzer and FortiManager integration.
- C. Sequence ID refers to the policy order, not a unique identifier for integration purposes.
- D. Policy ID is not the required attribute; UUID provides the universal unique identification needed for integration.
Question 10
You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy.
However, you peer-to-peer traffic on known ports is passing through the FortiGate without being blocked.
What FortiGate settings should you check to resolve this issue?
Show answer and explanation
Correct answer: C. Application and Filter Overrides
When peer-to-peer traffic on known ports passes through despite being blocked in the application control profile, the issue is typically that Application and Filter Overrides are configured to permit the traffic. These overrides take precedence over application control profiles and must be checked and adjusted to ensure the block policy is enforced.
Why the other options are wrong
- A. Replacement Messages affect how blocked traffic is reported to users, not whether traffic is blocked.
- B. Network Protocol Enforcement relates to protocol compliance, not application-level blocking of specific categories.
- D. FortiGuard category ratings determine how applications are classified, but if the profile is correctly configured, the issue lies in overrides, not ratings.
That was 10 of 84.
The full Fortinet NSE4_FGT_AD-7.6 pack has all 84 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.