Free Fortinet NSE4_FGT_AD-7.6 Practice Questions

Question 1

Which three statements about SD-WAN performance SLAs are true? (Choose three.)

1. They can be measured actively or passively.
2. They are applied in a SD-WAN rule lowest cost strategy.
3. They monitor the state of the FortiGate device.
4. All the SLA targets can be configured.
5. They rely on session loss and jitter.

Question 2

FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively.

Which two statements about the requirements of connected physical interfaces on FortiGate are true? (Choose two.)

1. Both interfaces must have directly connected routes on the routing table.
2. Both interfaces must have IP addresses assigned.
3. Both interfaces must have DHCP enabled and interfaces set to LAN and DMZ roles assigned.
4. Both interfaces must have the interface role assigned.

Question 3

A network administrator has enabled full SSL inspection and web filtering on FortiGate.

When visiting any HTTPS websites, the browser reports certificate warning errors.

When visiting HTTP websites, the browser does not report errors.

What is the reason for the certificate warning errors?

1. The matching firewall policy is set to proxy inspection mode.
2. The option invalid SSL certificates is set to allow on the SSL/SSH inspection profile.
3. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.
4. The browser does not trust the certificate used by FortiGate for SSL inspection.

Question 4

A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view.

Why is the policy order different in these two views?

1. Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.
2. By Sequence View groups policies based on rule priority, while Interface Pair View always follows the order of traffic logs.
3. The firewall dynamically reorders policies in Interface Pair View based on recent traffic patterns, but By Sequence View remains static.
4. Policies in Interface Pair View are prioritized by security levels, while By Sequence View strictly follows the administrator’s manual ordering.

Question 5

You have created a web filter profile named restrict_media-profile with a daily category usage quota.

When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.

What could be the reason?

1. The inspection mode in the firewall policy is not matching with web filter profile feature set.
2. The web filter profile is already referenced in another firewall policy.
3. The naming convention used in the web filter profile is restricting it in the firewall policy.
4. The firewall policy is in no-inspection mode instead of deep-inspection.

Question 6

An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.

Which DPD mode on FortiGate meets this requirement?

1. On Demand
2. Enabled
3. On Idle
4. Disabled

Question 7

What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

1. FortiGate does not support workstation check.
2. FortiGate directs the collector agent to use a remote LDAP server.
3. FortiGate uses the AD server as the collector agent.
4. FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

Question 8

FortiGate is integrated with FortiAnalyzer and FortiManager.

When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?

1. Universally Unique Identifier
2. Log ID
3. Sequence ID
4. Policy ID

Question 9

You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, you peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?

1. Replacement Messages for UDP-based Applications
2. Network Protocol Enforcement
3. Application and Filter Overrides
4. FortiGuard category ratings

Question 10

An administrator manages a FortiGate model that supports NTurbo.

How does NTurbo acceleration enhance antivirus performance?

1. For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.
2. For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.
3. For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
4. For proxy-based inspection, NTurbo offloads traffic to the content processor.

Question 11

How does FortiExtender connect to FortiSASE in a site-based, remote internet access method?

1. FortiExtender establishes a secure SSL connection using FortiClient.
2. FortiExtender uses the proxy auto-configuration (PAC) file and an explicit web proxy to connect.
3. FortiExtender first connects to a FortiGate LAN extension through a secure web gateway (SWG).
4. FortiExtender uses a Virtual Extensible LAN (VXLAN)-over-IPsec connection.

Question 12

An administrator wants to form an HA cluster using the FGCP protocol.

Which two requirements must the administrator ensure both members fulfill? (Choose two.)

1. They must have the same HA group ID.
2. They must have the heartbeat interfaces in the same subnet.
3. They must have the same hard drive configuration.
4. They must have the same number of configured VDOMs.

Question 13

What are two features of collector agent advanced mode? (Choose two.)

1. Advanced mode supports nested or inherited groups.
2. Advanced mode uses the Windows convention-NetBios: Domain\Username.
3. In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.
4. In advanced mode, security profiles can be applied only to user groups, not individual users.

Question 14

Which two components are part of the secure internet access (SIA) agent-based mode on FortiSASE? (Choose two.)

1. FortiExtender
2. VPN policies
3. The proxy auto-configuration (PAC) file
4. FortiSASE Firewall-as-a-Service (FWaaS)

Question 15

An administrator has configured a dialup IPsec VPN on FortiGate with add-route enabled. However, the static route is not showing in the routing table.

Which two statements about this scenario are correct? (Choose two.)

1. The administrator must ensure phase 2 is successfully established.
2. The administrator must enable a dynamic routing protocol on the dialup interface.
3. The administrator must define the remote network correctly in the phase 2 selectors.
4. The administrator must use a policy route instead of a static route for add-route to work properly.

Question 16

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

1. The collector agent must search Windows application event logs.
2. The NetSessionEnum function is used to track user logouts.
3. NetAPI polling can increase bandwidth usage in large networks.
4. The collector agent uses a Windows API to query DCs for user logins.

Question 17

Which two statements are correct when the FortiGate device enters conserve mode? (Choose two.)

1. FortiGate refuses to accept configuration changes.
2. FortiGate continues to run critical security actions, such as quarantine.
3. FortiGate halts complete system operation and requires a reboot to regain available resources.
4. FortiGate continues to transmit packets without IPS inspection when the fail -open global setting in IPS is enabled.

Question 18

When configuring firewall policies which of the following is true regarding the policy ID? (Choose two.)

1. A policy ID cannot be modified once a policy is created.
2. A firewall policy ID identifies the order of policy execution in firewall policies.
3. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
4. You can create a policy in CLI with policy ID 0.

Question 19

A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.

Which step is not part of the expected process?

1. The user logs into the Windows domain.
2. FortiGate determines user identity based on the IP address in the FSSO list.
3. The DC agent sends login event data directly to FortiGate.
4. The collector agent forwards login event data to FortiGate.

Question 20

What are two characteristics of HA cluster heartbeat IP addresses in an FortiGate device? (Choose two.)

1. Heartbeat IP addresses are used to distinguish between cluster members.
2. The heartbeat interface of the primary device in the cluster is always assigned IP address 169.254.0.1.
3. Heartbeat interfaces have virtual IP addresses that are manually assigned.
4. A change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster.