Practice Free NSE4_FGT_AD-7.6 Exam Online Questions – Page 2

Question #11

An administrator wants to form an HA cluster using the FGCP protocol.

Which two requirements must the administrator ensure both members fulfill? (Choose two answers)

A . They must have the same HA group ID.
B . They must have the heartbeat interfaces in the same subnet.
C . They must have the same number of configured VDOMs.
D . They must have the same hard drive configuration.

Reveal Solution Hide Solution

Correct Answer: A, D
A, D

Explanation:

“To successfully form an HA cluster, you must ensure that the members have the same:

• Model: hardware model or VM model

• Firmware version

• Licensing: includes the FortiGuard license, virtual domain (VDOM) license, FortiClient license, and so on

• Hard drive configuration: the same number and size of drives and partitions

• Operating mode: the operating mode―NAT mode or transparent mode―of the management VDOM.”

“From a configuration and setup point of view, you must ensure that the HA settings on each member have the same group ID, group name, password, and heartbeat interface settings. Try to place all heartbeat interfaces in the same broadcast domain, or for two-member clusters, connect them directly.”

Technical Deep Dive:

The correct answers are A and D.

A is correct because FGCP cluster formation requires matching HA parameters, and group ID is explicitly one of them. If the group ID differs, the units will not consider each other part of the same cluster during HA discovery and election.

D is correct because FortiGate HA expects hardware parity in critical platform characteristics, including hard drive configuration. If disk layout differs, the members do not satisfy the HA formation prerequisites.

B is incorrect because the study guide does not require heartbeat interfaces to be in the same IP subnet. The requirement is that heartbeat links be in the same broadcast domain, or directly connected in a two-node design. In practice, heartbeat links are Layer 2 adjacency links; IP subnet matching is not the stated requirement.

C is incorrect because the guide does not say both units must start with the same number of configured VDOMs.

What must match is the licensing level and the operating mode of the management VDOM. After cluster formation, the primary synchronizes its configuration to the secondary.

A practical verification set before forming FGCP HA is:

get system status

show system ha

diagnose sys ha status

Operationally, FGCP then uses the heartbeat links for member discovery, health monitoring, election, and config/session synchronization. On supported hardware, session forwarding and HA processing can still benefit from FortiGate’s ASIC-assisted architecture, but HA state, config sync, and election logic remain control-plane functions handled by FortiOS.

Question #12

What are three key routing principles in SD-WAN? (Choose three answers)

A . By default, SD-WAN rules are skipped if the included SD-WAN members do not have a valid route
to the destination.
B . SD-WAN rules have precedence over any other type of routes.
C . Regular policy routes have precedence over SD-WAN rules.
D . By default, SD-WAN rules are skipped if only one route to the destination is available.
E . By default, SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

Reveal Solution Hide Solution

Correct Answer: A, C, E
A, C, E

Explanation:

“This slide shows the SD-WAN rule lookup process. SD-WAN rules are essentially policy routes.”

“FortiGate performs a forwarding information base (FIB) lookup for the packet destination IP (dstip). If the resolved interface for the fib-best-match isn’t an SD-WAN member, then FortiGate moves on to the next rule. This behavior follows the key routing principle: SD-WAN rules are skipped if the best route to the destination isn’t an SD-WAN member.”

“If the resolved interface is an SD-WAN member, then FortiGate looks for one or more acceptable members in the oif list… An acceptable member is an alive member that has a route to the destination. This behavior follows the key routing principle: SD-WAN rules are skipped if none of the configured members in the rule have a valid route to the destination.”

“Because regular policy routes have precedence over any other routes…”

“Also note that policy routes have precedence over SD-WAN rules, and over any routes in the FIB.”

Technical Deep Dive:

The correct answers are A, C, and E.

A is correct because an SD-WAN rule is not enough by itself. A selected member must also be alive and have a valid route to the destination. If none of the members referenced by the rule can actually reach the destination, the rule is skipped.

C is correct because a regular policy route is evaluated before SD-WAN rules. This is a classic exam trap. FortiGate treats SD-WAN steering like policy-route logic, but standard policy routes still win if they match and are valid.

E is correct because FortiGate first checks the FIB best match. If that best route resolves to an interface that is not an SD-WAN member, FortiGate skips the SD-WAN rule and continues.

Why the others are wrong:

B is false because SD-WAN rules do not have precedence over everything; regular policy routes do.

D is false because the number of available routes is not the deciding rule. Even with only one route,

SD-WAN can still steer traffic if the routing and member conditions are met.

Operationally, think of SD-WAN routing in this order: policy route check → SD-WAN rule lookup → standard FIB fallback.

On FortiGate, the practical validation commands are:

get router info routing-table all

diagnose sys sdwan service

diagnose firewall proute list

That combination lets you confirm whether a packet is being captured by a policy route, whether an SD-WAN rule has acceptable members, and what the FIB currently resolves for the destination.

Question #13

You have created a web filter profile named restrictmedia-profile with a daily category usage quota.

When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.

What could be the reason?

A . The web filter profile is already referenced in another firewall policy.
B . The firewall policy is in no-inspection mode instead of deep-inspection.
C . The naming convention used in the web filter profile is restricting it in the firewall policy.
D . The inspection mode in the firewall policy is not matching with web filter profile feature set.

Reveal Solution Hide Solution

Question #14

What is the primary FortiGate election process when the HA override setting is enabled? (Choose one answer)

A . Connected monitored ports > Priority > HA uptime > FortiGate serial number
B . Connected monitored ports > Priority > System uptime > FortiGate serial number
C . Connected monitored ports > HA uptime > Priority > FortiGate serial number
D . Connected monitored ports > System uptime > Priority > FortiGate serial number

Reveal Solution Hide Solution

Question #15

Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

A . The collector agent uses a Windows API to query DCs for user logins.
B . The NetSessionEnum function is used to track user logouts.
C . NetAPI polling can increase bandwidth usage in large networks.
D . The collector agent must search Windows application event logs.

Reveal Solution Hide Solution

Question #16

There are multiple dialup IPsec VPNs configured in aggressive mode on the HQ FortiGate. The requirement is to connect dial-up users to their respective department VPN tunnels.

Which phase 1 setting you can configure to match the user to the tunnel?

A . Local Gateway
B . Dead Peer Detection
C . Peer ID
D . IKE Mode Config

Reveal Solution Hide Solution

Question #17

When configuring the connection between FortiGate and FortiAnalyzer, which option indicates that reliable traffic is enabled? (Choose one answer)

A . The connection status shows a green check icon
B . The interface status is set to up
C . A padlock icon appears in the connection settings
D . The logging mode is set to real-time

Reveal Solution Hide Solution

Question #18

Refer to the exhibit to view the firewall policy.

Why would the firewall policy not block a well-known virus, for example EICAR? (Choose one answer)

A . The action on the firewall policy is not set to DENY.
B . Web filter is not enabled, so the firewall policy does not complement the antivirus profile.
C . The firewall policy is not configured in proxy-based inspection mode.
D . The firewall policy does not apply deep content inspection.

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

“The only security features you can apply using SSL certificate inspection mode are web filtering and

application control… Note that while offering some level of security, certificate inspection does not allow FortiGate to inspect the flow of encrypted data.”

“To perform SSL inspection on traffic flowing through the FortiGate device, you must allow the traffic with a firewall policy and apply an SSL inspection profile to the policy… For antivirus or IPS control, you should use a deep-inspection profile.”

“When you use deep inspection, FortiGate impersonates the recipient of the originating SSL session, and then decrypts and inspects the content to find threats and block them. It then re-encrypts the content and sends it to the real recipient.”

Technical Deep Dive:

The exhibit shows that the policy is allowing HTTPS and the SSL/SSH inspection profile is certificate-inspection, not deep-inspection. That is the key issue. With certificate inspection, FortiGate can inspect only SSL metadata such as the certificate and SNI/hostname context; it cannot decrypt the HTTPS payload itself. Because EICAR is detected by antivirus through payload inspection, FortiGate must see the file contents. Without deep SSL inspection, the antivirus engine never gets the decrypted payload, so the file can pass even though the antivirus profile is attached.

Option A is incorrect because FortiGate firewall policies often use ACCEPT + security profile enforcement; the session can still be blocked by antivirus after policy match. Option B is incorrect because web filter is not required for antivirus detection. Option C is incorrect because the real requirement is deep SSL inspection, not specifically proxy-based mode; full SSL inspection is the deciding factor here.

In practice, to block EICAR over HTTPS, you would apply a deep-inspection SSL profile to the policy, for example:

config firewall policy

edit <policy-id>

set inspection-mode flow

set av-profile "default"

set ssl-ssh-profile "deep-inspection"

next

end

On real hardware, this also matters for performance design. Simple firewall/NAT sessions are often NP fast-pathed, but once you enable deep SSL inspection and content scanning, traffic is typically handed to CPU/WAD/content-inspection path for decryption and scanning, so throughput is lower than certificate-inspection or no-inspection.

Question #19

Refer to the exhibit.

The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile. An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.

What are two solutions for satisfying the requirement? (Choose two answers)

A . Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
B . Configure a web override rating for download.com and select Malicious Websites as the subcategory.
C . Configure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.
D . Set the Freeware and Software Downloads category Action to Warning.

Reveal Solution Hide Solution

Correct Answer: A, B
A, B

Explanation:

“In FortiOS, there are three main components of web filtering:

• Web content filtering…

• URL filtering: uses URLs and URL patterns to block or exempt web pages from specific sources…

• FortiGuard Web Filtering service…”

“In the web filter profile, Fortiguard category filtering enhances the web filter features. Rather than block or allow websites individually, it looks at the category that a website has been rated with. Then, FortiGate takes action based on that category, not based on the URL.”

“If you consider that a particular URL does not have the correct category, you can ask to re-evaluate the rating in the Fortinet URL Rating Submission website. You can also override a web rating for an exceptional URL in the FortiGate configuration.”

“Static URL filtering is another web filter feature, which provides more granularity. Configured URLs in the URL filter are checked from top to bottom against the visited websites. If FortiGate finds a match, it applies the configured action.”

“To find the exact match, URL filtering has three pattern types: Simple, Regular Expressions, and Wildcard.”

“So, with these different features, what is the inspection order?

If you have enabled many of them, the inspection order flows as follows:

The local static URL filter

FortiGuard category filtering…”

Technical Deep Dive:

The correct answers are A and B.

A is correct because a static URL filter gives per-URL granularity. Since the category Freeware and Software Downloads is currently allowed in the profile, adding a local static URL filter entry for download.com with Block lets FortiGate deny only that site while continuing to allow the rest of the category. This also aligns with the documented inspection order, where the local static URL filter is checked before FortiGuard category filtering.

B is also correct because a web rating override can reclassify a specific exceptional URL. If download.com is re-rated into a blocked category such as Malicious Websites, it will be blocked by the profile while other sites in Freeware and Software Downloads remain allowed.

Why the others are wrong:

C is not the intended web-filter solution. A firewall policy with an FQDN object operates at policy/routing resolution level, not as a category-aware web filtering exception.

D is wrong because changing the whole category to Warning affects all sites in that category, not just download.com.

In production, the cleaner design is usually: keep the category allowed, then add a local URL-filter exception or a web-rating override for the specific site. For HTTPS traffic, remember FortiGate still needs enough SSL inspection visibility to identify the hostname correctly.

A representative CLI approach for URL filtering is:

config webfilter urlfilter

edit 1

config entries

edit 1

set url "download.com"

set type wildcard

set action block

next

end

next

end

This is the most deterministic way to block one site without penalizing the rest of the category.

Question #19

Refer to the exhibit.

A . Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.
B . Configure a web override rating for download.com and select Malicious Websites as the subcategory.
C . Configure a separate firewall policy with action Deny and an FQDN address object for *.download.com as destination address.
D . Set the Freeware and Software Downloads category Action to Warning.

Reveal Solution Hide Solution

1 2 3 4

Exams