NSE4_FGT_AD-7.6 Exam Questions and Answers

QUESTION: 9

Refer to the exhibit.

Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode? (Choose two.)

FortiGate drops new sessions requiring inspection.
Administrators must restart FortiGate to allow new sessions.
Administrators cannot change the configuration.
FortiGate skips quarantine actions.

Answer(s): C,D

Reveal Solution Next Question

An administrator has configured a dialup IPsec VPN on FortiGate with add-route enabled. However, the static route is not showing in the routing table.
Which two statements about this scenario are correct? (Choose two.)

The administrator must use a policy route instead of a static route for add-route to work properly.
The administrator must ensure phase 2 is successfully established
The administrator must define the remote network correctly in the phase 2 selectors.
The administrator must enable a dynamic routing protocol on the dialup interface.

Answer(s): B,C

Explanation:

With a dialup IPsec VPN on FortiGate, when add-route is enabled, FortiGate will only install the corresponding route when it has enough negotiated information from the tunnel. In FortiOS 7.6, that means the route is tied to the Phase 2 (Quick Mode) selectors and is created dynamically when the IPsec SA is actually up.
B . The administrator must ensure phase 2 is successfully established

This is required. FortiGate does not install the add-route route just because Phase 1 exists or because the configuration is present. The route is added when the tunnel is effectively usable, which requires Phase 2 (IPsec SA) to be up. If Phase 2 is not established, there is no active SA and FortiGate will not inject the related route into the routing table.

So, if the static route is not showing, one correct explanation is that Phase 2 is not up.

C . The administrator must define the remote network correctly in the phase 2 selectors

This is also required. For dialup tunnels, FortiGate derives what route to add from the remote subnet(s) defined in the Phase 2 selector (proxy ID). If the remote network in Phase 2 is missing, incorrect, or too broad/too narrow in a way that prevents negotiation, the tunnel either won't come up (so no route), or the route that would be installed won't match what the administrator expects.

So, another correct explanation is that the Phase 2 remote network is not correctly defined, preventing the correct route from being created.

Why the other options are incorrect

A . Policy route instead of a static route
Add-route does not require policy routes. It is specifically a feature that injects a route (route-table entry) associated with the IPsec tunnel/SA and the Phase 2 selector networks.
D . Enable a dynamic routing protocol
Dynamic routing protocols (OSPF/BGP/RIP) are not required for add-route. Add-route is independent of dynamic routing and works by installing routes locally based on the negotiated selectors.

Reveal Solution Next Question

QUESTION: 11

Refer to the exhibit.

A RADIUS server configuration is shown.

An administrator added a configuration for a new RADIUS server While configuring, the administrator enabled Include in every user group What is the impact of enabling Include in every user group in a RADIUS configuration?

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

Answer(s): A

Explanation:

Based on the FortiOS 7.6 Authentication and User Group documentation, the correct answer is A .

Meaning of "Include in every user group" (FortiOS 7.6)

When configuring a RADIUS server on FortiGate, enabling Include in every user group has a very specific and documented effect:

The configured RADIUS server object is automatically added to all FortiGate user groups.

As a result, any user who successfully authenticates against that RADIUS server becomes a valid member of every FortiGate user group, unless additional group filtering (such as RADIUS attributes) is applied.

This simplifies configuration when the same external authentication source must be accepted across multiple firewall policies that reference different user groups.

This behavior is explicitly described in the FortiOS 7.6 Administrator Guide under RADIUS authentication servers and user groups.

Why Option A is Correct

FortiGate user groups can include:

Local users

LDAP servers

RADIUS servers

Enabling Include in every user group causes FortiGate to:

Insert the RADIUS server into all existing and future FortiGate user groups

Therefore, all users authenticating via this RADIUS server are implicitly allowed in every FortiGate user group.

This is exactly what option A describes.

Why the Other Options Are Incorrect

B: FortiGate does not push users or groups into the RADIUS server. Authentication is always initiated by FortiGate toward RADIUS.

C: FortiGate does not manage or modify RADIUS-side group definitions.

D: LDAP and RADIUS user groups are separate authentication mechanisms; this setting does not merge or affect LDAP groups.

Reveal Solution Next Question

QUESTION: 12

You have created a web filter profile named restrictmedia-profile with a daily category usage quota.

When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.

What could be the reason?

The web filter profile is already referenced in another firewall policy.
The firewall policy is in no-inspection mode instead of deep-inspection.
The naming convention used in the web filter profile is restricting it in the firewall policy.
The inspection mode in the firewall policy is not matching with web filter profile feature set.

Answer(s): D

Explanation:

In FortiOS 7.6, web filter profiles are inspection-mode dependent. Certain advanced web filtering features--such as daily category usage quota--are only supported when the firewall policy is operating in proxy-based inspection mode.

Why the profile is not visible

The profile restrictmedia-profile includes a daily category usage quota.

Daily quotas are a proxy-based web filtering feature.

If the firewall policy is configured with:

Inspection mode: Flow-based

Then FortiGate will not display proxy-only web filter profiles in the Web Filter drop-down list.

FortiGate automatically filters the available profiles based on feature compatibility with the policy's inspection mode.

This behavior is explicitly documented in the FortiOS 7.6 Web Filtering and Inspection Mode Compatibility sections.

Why the other options are incorrect

A . Already referenced in another firewall policy
Web filter profiles can be reused across multiple policies. This does not hide them.

B . Firewall policy is in no-inspection mode instead of deep-inspection SSL inspection depth affects HTTPS visibility, not whether a web filter profile appears in the drop- down list.
C . Naming convention restriction
FortiOS does not restrict profile selection based on naming conventions.

Reveal Solution Next Question

QUESTION: 13

Refer to the exhibits.

A diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device are shown.

Two PCs. PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.

Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)

In the system settings, set Multiple Interface Policies to enable.
in the IP pool configuration, set end ipto 100.65.0.112.
In the firewall policy, set match-vip to enable using CLI.
In the IP pool configuration, set type to overload.

Answer(s): B,D

Explanation:

From the exhibits:

The firewall policy has NAT enabled and is configured to Use Dynamic IP Pool.

The selected IP pool (Internet-pool) is configured as:

Type: One-to-One

External IP Range: 100.65.0.110100.65.0.111 (only two public IPs)

PC1 and PC2 can access the internet because each one-to-one NAT mapping consumes one public IP from the pool.
When PC3 is added, there is no third public IP available in the pool, so FortiGate cannot allocate a one-to-one mapping for PC3 and the session fails.

FortiOS behavior here is standard: with one-to-one IP pools, the available pool size limits how many distinct internal sources can be translated concurrently (depending on allocation and sessions), and a pool with only two IPs will not reliably support three separate hosts needing translations.

Therefore, the administrator can fix this in two valid ways:

B . In the IP pool configuration, set end ip to 100.65.0.112.

This expands the pool by adding an additional public IP address, making three public IPs available (.110, .111, .112), so PC3 can be assigned an address for one-to-one NAT.

D . In the IP pool configuration, set type to overload.

Changing the pool type to overload enables PAT (many-to-one), allowing multiple internal hosts (PC1, PC2, PC3) to share the pool address(es) using different source ports. This removes the "one public IP per internal host" limitation inherent to one-to-one pools.

Why the other options are not correct:

A . Multiple Interface Policies is unrelated to IP pool exhaustion and does not solve NAT allocation limits.
C . match-vip affects VIP matching behavior for destination NAT/virtual IP usage and does not address the source NAT pool shortage causing PC3 to fail.

Reveal Solution Next Question

QUESTION: 14

Which two statements are correct when the FortiGate device enters conserve mode? (Choose two.)

FortiGate refuses to accept configuration changes.
FortiGate halts complete system operation and requires a reboot to regain available resources.
FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.
FortiGate continues to run critical security actions, such as quarantine.

Answer(s): A,C

Reveal Solution Next Question

QUESTION: 15

Refer to the exhibits.

Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibits.

What would be the expected outcome in the HA cluster?

HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.
HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority
The HA cluster will become out of sync because the override setting must match on all HA members.
HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.

Answer(s): A

Explanation:

From the current HA status, HQ-NGFW-1 is the primary and HQ-NGFW-2 is the secondary.

The administrator then changes these HA parameters:

HQ-NGFW-1: set override disable, set priority 90

HQ-NGFW-2: set override enable, set priority 110

In FGCP (A-P mode), the override (preemption) feature controls whether a higher-priority unit is allowed to take over the primary role.

When override is enabled, the cluster will prefer (and can re-elect) the unit with the highest device priority to become primary (preempting a lower-priority primary when conditions trigger re-election behavior as defined by FGCP).

Here, HQ-NGFW-2 has:

override enabled higher priority (110) than HQ-NGFW-1 (90)

Therefore, the expected result is that HQ-NGFW-2 becomes the primary.

Why the other options are incorrect:

B is incorrect because it claims HQ-NGFW-2 has lower priority (it is higher: 110 > 90).

C is incorrect because a mismatch in the override setting is not what causes the "configuration out of sync" condition shown in get system ha status (that is about synchronized configuration databases, not a requirement that override values must match to remain in-sync).

D is incorrect because HA settings like override/priority are not synchronized in the way regular configuration objects are; they are device-level HA parameters.

Reveal Solution Next Question

QUESTION: 16

Refer to the exhibit

A firewall policy to enable active authentication is shown.

When attempting to access an external website using an active authentication method, the user is not presented with a login prompt.
What is the most likely reason for this situation?

No matching user account exists for this user.
The Remote-users group must be set up correctly in the FSSO configuration.
The Remote-users group is not added to the Destination
The Service DNS is required in the firewall policy.

Answer(s): D

Explanation:

Based on the exhibit and FortiOS 7.6 Active Authentication (captive portal) behavior, the most likely reason the user is not presented with a login prompt is that DNS is missing from the firewall policy.

What the exhibit shows

The firewall policy configured for active authentication includes:

Source: HQ_SUBNET and Remote-users

Destination: all

Services:

HTTP

HTTPS

ALL_ICMP

Security Profiles: Web filter and SSL inspection enabled

Authentication: Active (user group referenced)

DNS is not included as a service in the policy.

Why DNS is required for active authentication

In FortiOS 7.6, active authentication (captive portal) works as follows:

The user attempts to access a website using a URL (for example, www.example.com).

The client must first perform a DNS lookup to resolve the domain name.

FortiGate intercepts the initial HTTP/HTTPS request and redirects the user to the authentication portal.

If DNS traffic is blocked or not allowed:

The hostname cannot be resolved.

The HTTP/HTTPS request never properly occurs.

FortiGate has nothing to intercept, so the login prompt is never triggered.

This is explicitly documented in the FortiOS 7.6 Authentication and Captive Portal requirements, which state that DNS must be permitted for captive portalbased authentication to function correctly.

Why the other options are incorrect

A . No matching user account exists for this user

Incorrect.

If the user account did not exist, the login page would still appear, but authentication would fail after credentials are entered.

B . The Remote-users group must be set up correctly in the FSSO configuration

Incorrect.

This policy is using active authentication, not FSSO.

FSSO configuration is irrelevant for active authentication login prompts.

C . The Remote-users group is not added to the Destination

Incorrect.

User groups are applied in the Source field for authentication-based policies.

Destination does not accept user groups.

Reveal Solution Next Question

Fortinet NSE4_FGT_AD-7.6 Exam (page: 2)
Fortinet NSE 4 - FortiOS 7.6 Administrator
Updated on: 02-Jan-2026

QUESTION: 9

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

Fortinet NSE4_FGT_AD-7.6 Exam (page: 2) Fortinet NSE 4 - FortiOS 7.6 Administrator Updated on: 02-Jan-2026

QUESTION: 9

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

Fortinet NSE4_FGT_AD-7.6 Exam (page: 2)
Fortinet NSE 4 - FortiOS 7.6 Administrator
Updated on: 02-Jan-2026