Practice Free NSE4_FGT_AD-7.6 Exam Online Questions

Question #1

Refer to the exhibit.

What can you conclude from the log shown in the exhibit?

A . The IPS socket buffer is full and IPS engine needs more memory to create new sessions.
B . The IPS socket buffer is full and IPS engine cannot decode a packet.
C . The IPS scan is paused by the IPS diagnostic command with bypass mode option 5.
D . The IPS session scan is paused and reevaluating the packet because of a dirty flag.

Question #2

A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.

Which step is not part of the expected process?

A . The DC agent sends login event data directly to FortiGate.
B . FortiGate determines user identity based on the IP address in the FSSO list.
C . The collector agent forwards login event data to FortiGate.
D . The user logs into the windows domain.

Reveal Solution Hide Solution

Question #3

Refer to the exhibits.

An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending.

What can be the two possible reasons? (Choose two answers)

A . Upstream FortiGate IP must be set to 10.0.11.254.
B . SAML Single Sign-On must be set to Manual.
C . HQ-ISFW-2 must be authorized on HQ-ISFW.
D . Management IP must be set to 10.0.13.254.

Reveal Solution Hide Solution

Question #4

Refer to the exhibits.

The system performance output and default configuration of high memory usage thresholds on a FortiGate device are shown.

Based on the system performance output, what are the two possible outcomes? (Choose two.)

A . Administrators can access FortiGate only through the console port.
B . FortiGate has entered conserve mode.
C . FortiGate drops new sessions.
D . Most Voted Administrators cannot change the configuration

Reveal Solution Hide Solution

Question #5

An administrator manages a FortiGate model that supports NTurbo How does NTurbo acceleration enhance antivirus performance?

A . For flow-based inspection. NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
B . For flow-based inspection. NTurbo creates two inspection sessions on the FortiGate device.
C . For proxy-based inspection. NTurbo offloads traffic to the content processor.
D . For proxy-based inspection. NTurbo buffers the whole file and then sends it to the antivirus engine.

Reveal Solution Hide Solution

Question #6

An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.

Which DPD mode on FortiGate meets this requirement?

A . On Demand
B . Enabled
C . On Idle
D . Usabled

Reveal Solution Hide Solution

Question #7

Which two components are part of the secure internet access (SIA) agent-based mode on FortiSASE? (Choose two.)

A . FortiSASE Firewall-as-a-Service (FWaaS)
B . The proxy auto-configuration (PAC) file
C . VPN policies
D . FortiExtender

Reveal Solution Hide Solution

Question #8

An administrator wants to address shadow IT visibility challenges and prevent users from sending sensitive files outside the organization without proper approval.

Which FortiSASE method should the administrator implement to achieve these goals? (Choose one answer)

A . Secure SD-WAN access (SSD-WAN)
B . Secure private access (SPA)
C . Secure SaaS access (SSA)
D . Secure internet access (SIA)

Reveal Solution Hide Solution

Question #9

How does FortiExtender connect to FortiSASE in a site-based, remote internet access method?

A . FortiExtender uses a Virtual Extensible LAN (VXLAN)-over-IPsec connection.
B . FortiExtender establishes a secure SSL connection using FortiClient.
C . FortiExtender first connects to a FortiGate LAN extension through a secure web gateway (SWG).
D . FortiExtender uses the proxy auto-configuration <PAC) file and an explicit web proxy to connect.

Reveal Solution Hide Solution

Question #10

Exhibits:

You are asked to implement an antivirus profile for files downloaded through FTP, HTTP, and HTTPS.

While testing, you are successful with HTTP and FTP protocols, but FortiGate does not block the file download over HTTPS.

What could be the cause?

A . The feature set in the antivirus profile is not set to Flow-based.
B . Web filter is not enabled on the firewall policy to complement the antivirus profile.
C . The action on the firewall policy is not set to deny.
D . The SSL inspection mode in the firewall policy is not deep content inspection.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

“To perform SSL inspection on traffic flowing through the FortiGate device, you must allow the traffic with a firewall policy and apply an SSL inspection profile to the policy. Note that an SSL inspection profile alone will not trigger a security inspection. You must combine it with other security profiles like Antivirus, Web Filter, Application Control, or IPS.”

“By default, firewall policies are set with the no-inspection SSL profile. Therefore, any encrypted traffic flows through uninspected… For antivirus or IPS control, you should use a deep-inspection profile.”

“When you use deep inspection, FortiGate impersonates the recipient of the originating SSL session, and then decrypts and inspects the content to find threats and block them. It then re-encrypts the content and sends it to the real recipient. Deep inspection protects from attacks that use HTTPS and other commonly used SSL-encrypted protocols…”

Technical Deep Dive:

The correct answer is D. HTTP and FTP are working because FortiGate can inspect those payloads directly with the antivirus profile. HTTPS is different because the traffic is encrypted. If the firewall policy uses only certificate inspection or another non-decrypting SSL mode, FortiGate can identify certificate/SNI information, but it cannot see the downloaded file contents. Without decrypting the HTTPS session, the antivirus engine never receives the payload to scan, so EICAR or other malware can pass.

Why the other options are wrong:

A is not the issue here. The exhibit shows the antivirus profile and policy are already aligned for proxy-based operation, and the failure is specific to HTTPS visibility.

B is wrong because web filter is not required for antivirus scanning.

C is wrong because firewall policies commonly use ACCEPT with security profiles; the antivirus engine can still block the file after policy match. The study guide explicitly says ACCEPT allows the session and then applies antivirus scanning and other packet-processing features.

To fix it, apply deep-inspection on the firewall policy:

config firewall policy

edit <policy-id>

set ssl-ssh-profile "deep-inspection"

set av-profile "HTTP_AV_Profile"

next

end

On real FortiGate hardware, this also has performance implications. Simple flow handling can often stay on accelerated paths, but full SSL deep inspection forces decryption and content scanning through the inspection engine, increasing CPU/WAD workload.

1 2 3 4

Exams