Fortinet NSE4_FGT_AD-7.6 Real 2026 Braindumps Mock Exam Dumps
NSE4_FGT_AD-7.6 Exam Questions | Real NSE4_FGT_AD-7.6 Practice Dumps
NEW QUESTION # 16
When configuring firewall policies which of the following is true regarding the policy ID? (Choose two.)
- A. A firewall policy ID identifies the order of policy execution in firewall policies.
- B. A policy ID cannot be modified once a policy is created.
- C. You can create a policy in CLI with policy ID 0
- D. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.
Answer: B,C
NEW QUESTION # 17
Exhibits:
You are asked to implement an antivirus profile for files downloaded through FTP, HTTP, and HTTPS.
While testing, you are successful with HTTP and FTP protocols, but FortiGate does not block the file download over HTTPS.
What could be the cause?
- A. Web filter is not enabled on the firewall policy to complement the antivirus profile.
- B. The action on the firewall policy is not set to deny.
- C. The feature set in the antivirus profile is not set to Flow-based.
- D. The SSL inspection mode in the firewall policy is not deep content inspection.
Answer: D
Explanation:
"To perform SSL inspection on traffic flowing through the FortiGate device, you must allow the traffic with a firewall policy and apply an SSL inspection profile to the policy. Note that an SSL inspection profile alone will not trigger a security inspection. You must combine it with other security profiles like Antivirus, Web Filter, Application Control, or IPS."
"By default, firewall policies are set with the no-inspection SSL profile. Therefore, any encrypted traffic flows through uninspected... For antivirus or IPS control, you should use a deep-inspection profile. "
"When you use deep inspection, FortiGate impersonates the recipient of the originating SSL session, and then decrypts and inspects the content to find threats and block them . It then re-encrypts the content and sends it to the real recipient. Deep inspection protects from attacks that use HTTPS and other commonly used SSL-encrypted protocols..." Technical Deep Dive:
The correct answer is D . HTTP and FTP are working because FortiGate can inspect those payloads directly with the antivirus profile. HTTPS is different because the traffic is encrypted. If the firewall policy uses only certificate inspection or another non-decrypting SSL mode, FortiGate can identify certificate/SNI information, but it cannot see the downloaded file contents. Without decrypting the HTTPS session, the antivirus engine never receives the payload to scan, so EICAR or other malware can pass.
Why the other options are wrong:
* A is not the issue here. The exhibit shows the antivirus profile and policy are already aligned for proxy- based operation, and the failure is specific to HTTPS visibility.
* B is wrong because web filter is not required for antivirus scanning.
* C is wrong because firewall policies commonly use ACCEPT with security profiles; the antivirus engine can still block the file after policy match. The study guide explicitly says ACCEPT allows the session and then applies antivirus scanning and other packet-processing features.
To fix it, apply deep-inspection on the firewall policy:
config firewall policy
edit < policy-id >
set ssl-ssh-profile " deep-inspection "
set av-profile " HTTP_AV_Profile "
next
end
On real FortiGate hardware, this also has performance implications. Simple flow handling can often stay on accelerated paths, but full SSL deep inspection forces decryption and content scanning through the inspection engine, increasing CPU/WAD workload.
NEW QUESTION # 18
Refer to the exhibits.
The SSL VPN connection fails when a user attempts to connect to it.
What should the user do to successfully connect to the SSL VPN?
- A. Change the SSL VPN portal to the tunnel.
- B. Change the idle-timeout.
- C. Change the SSL VPN port on the client.
- D. Change the server IP address.
Answer: C
Explanation:
In the FortiGate SSL-VPN settings, the VPN is configured to listen on port 11443, as shown in the
"Listen on Port" field. However, the VPN client is attempting to connect to https://10.200.1.1:443/, which uses the default HTTPS port (443) instead of the configured port.
To successfully connect, the user must change the SSL VPN port on the client to 11443 so that it matches the listening port defined on the FortiGate device.
NEW QUESTION # 19
An administrator wants to form an HA cluster using the FGCP protocol. Both FortiGate devices are configured with the set override enable command. Arrange the criteria in the order in which the FGCP protocol uses them to elect the primary FortiGate. Select the criteria in the left column, hold and drag it to a blank position in the column on the right. Place the four correct steps in order, placing the first step in the first position. Once you place a step, you can move it again if you want to change your answer before moving to the next question. You need to drop four criteria in the work area. Select and drag the screen divider to change the viewable area of the source and work areas. (Choose four answers)
Answer:
Explanation:
Explanation:
"This slide shows the different criteria that a cluster considers during the primary FortiGate election process.
The criteria order evaluation depends on the HA override setting."
For the default case shown in the guide:
"1. The cluster compares the number of monitored interfaces that have a status of up. The member with the most available monitored interfaces becomes the primary.
2. The cluster compares the HA uptime of each member...
3. The member with the highest priority becomes the primary.
4. The member with the highest serial number becomes the primary."
For this question's case:
"If the HA override setting is enabled, the priority is considered before the HA uptime ." Technical Deep Dive:
Because override is enabled , the election order changes from the default sequence. The first criterion is still Connected monitored ports , because interface health is evaluated first. After that, Priority moves ahead of HA uptime . If those still do not decide the winner, FortiGate uses the serial number as the final tie-breaker.
Therefore the correct order is:
1. Connected monitored ports
2. Priority
3. HA uptime
4. FortiGate serial number
This distinction matters in production. With set override enable, you are effectively making HA priority authoritative over uptime, so the preferred unit will reclaim the primary role when it comes back online. That is useful for deterministic primary selection, but it can also cause an additional failover event when the preferred chassis returns to service. The guide explicitly notes this tradeoff.
In practice, the relevant HA checks and verification commands are:
show system ha
get system ha status
diagnose sys ha status
These let you confirm override status, device priority, monitored interfaces, and recent election results. From a control-plane perspective, FGCP election logic is handled by FortiOS over heartbeat links, while data-plane forwarding after election continues using the cluster's virtual MAC behavior and synchronized HA state.
NEW QUESTION # 20
Refer to the exhibit.
What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- B. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
- C. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- D. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
Answer: B
Explanation:
Based on the exhibit and the FortiOS 7.6 SSL/SSH Inspection documentation, the correct answer is C.
Understanding the Exhibit Configuration
In the SSL/SSH Inspection Profile, the following settings are shown:
Inspection method: Full SSL Inspection
Server certificate SNI check: Strict
This setting directly controls how FortiGate validates the Server Name Indication (SNI) provided by the client during the TLS handshake.
FortiOS 7.6 Behavior of "Server certificate SNI check"
FortiOS supports three modes for Server certificate SNI check:
Disable
No validation between SNI and server certificate.
Enable
FortiGate checks SNI against the certificate.
If mismatch occurs, FortiGate may still allow the session with reduced validation.
Strict
FortiGate enforces a strict match.
The SNI must match either the CN (Common Name) or one of the SAN (Subject Alternative Name) entries in the server certificate.
If the SNI does not match either CN or SAN, the TLS session is immediately terminated.
The exhibit clearly shows Strict selected.
Why Option C is Correct
With Strict enabled, FortiGate rejects the TLS connection when:
The SNI does not match the CN, and
The SNI does not match any SAN entry
This results in the connection being closed, not allowed with warnings or fallback behavior.
Therefore:
C). FortiGate will close the connection if the SNI does not match the CN or SAN fields is exactly the documented behavior.
Why the Other Options Are Incorrect
A: FortiGate does not fall back to using the CN for URL filtering when Strict is enabled.
B: There is no "accept with warning" behavior in Strict mode.
D: Incorrect logical condition. FortiGate does not require mismatch with both CN and SAN simultaneously; a mismatch with either valid field set is sufficient to close the connection.
NEW QUESTION # 21
Refer to the exhibit.
Which two statements about the FortiGuard connection are true? (Choose two.)
- A. The weight increases as the number of failed packets rises
- B. FortiGate is using the default port for FortiGuard communication.
- C. FortiGate identified the FortiGuard Server using DNS lookup.
- D. You can configure unreliable protocols to communicate with FortiGuard Server.
Answer: A,B
Explanation:
Based on the diagnose debug rating output provided in the exhibit and the standard behavior of the FortiGuard connection mechanism in FortiOS 7.6:
Weight Calculation (Statement A is True):
In FortiOS, the rating server selection process uses a weight-based system.
According to official documentation, the weight increases with failed packets (lost responses) and decreases with successful packets.
This mechanism ensures that servers with poor reliability are penalized by having higher weights, effectively pushing them to the bottom of the preference list.
Default Port Communication (Statement D is True):
The exhibit explicitly shows the communication is using HTTPS on port 8888.
In FortiOS 7.6 (and legacy versions like 6.2/6.4), FortiGuard filtering supports specific protocols and ports:
HTTPS on ports 443, 53, and 8888, where 8888 is considered a default port for FortiGuard queries.
Ports 53 and 8888 are standard for both UDP and TCP/HTTPS FortiGuard communications to avoid common firewall blocks on standard web ports.
Why other options are incorrect:
Statement B (Unreliable protocols): While you can configure UDP (which is unreliable), the exhibit specifically shows HTTPS is being used, which is a reliable (TCP-based) protocol.
Statement C (DNS lookup): In the " Flags " column of the server list, a server found via DNS lookup would be marked with the " D " flag. The exhibit shows the flag as " I " (indicating the last INIT request was sent to this server) and a numeric " 2, " but the " D " flag is absent. Additionally, the IP 10.0.1.241 is a private address, suggesting it is a manually configured FortiManager or local override server rather than a public server found via global DNS lookup.
NEW QUESTION # 22
Refer to the exhibits.
The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device.
Based on the system performance output, what are the two possible outcomes? (Choose two.)
- A. FortiGate has entered conserve mode.
- B. Administrators can access FortiGate only through the console port.
- C. Administrators can change the configuration.
- D. FortiGate drops new sessions.
Answer: A,D
Explanation:
"Three different configurable thresholds define when FortiGate enters and exits conserve mode. If memory usage goes above the percentage of total RAM defined as the red threshold, FortiGate enters conserve mode."
"If memory usage keeps increasing, it might exceed the extreme threshold. While memory usage is above this highest threshold, all new sessions are dropped."
"What actions does FortiGate take to preserve memory while in conserve mode?
* FortiGate does not accept configuration changes, because they might increase memory usage."
"However, if the memory usage exceeds the extreme threshold, new sessions are always dropped, regardless of the FortiGate configuration." Technical Deep Dive:
The system performance output shows Memory: 2042076k total, 1837868k used (90%). The configured thresholds shown are:
green = 82
red = 88
extreme = 89
Because memory usage is 90%, it is:
Above the red threshold (88%) → so FortiGate has entered conserve mode
Above the extreme threshold (89%) → so all new sessions are dropped
That makes A and D correct.
Why the others are wrong:
B is not stated anywhere in the study guide as an automatic outcome of conserve mode.
C is the opposite of what the guide says. In conserve mode, FortiGate does not accept configuration changes.
A useful verification command is:
diagnose hardware sysinfo conserve
Operationally, once a FortiGate crosses the red threshold, it starts protecting itself by limiting behavior that could increase memory usage. Once it crosses the extreme threshold, it becomes more severe and drops new sessions to keep the system from becoming unstable.
NEW QUESTION # 23
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?
- A. The user logs into the windows domain.
- B. The collector agent forwards login event data to FortiGate.
- C. FortiGate determines user identity based on the IP address in the FSSO list.
- D. The DC agent sends login event data directly to FortiGate.
Answer: B
Explanation:
In DC Agent Mode, the DC agent sends login event data directly to FortiGate without involving a collector agent.
NEW QUESTION # 24
Refer to the exhibit showing a debug flow output.
Which two conclusions can you make from the debug flow output? (Choose two.)
- A. The debug flow is for UDP traffic.
- B. The default gateway is configured on port2.
- C. The RPF check fails.
- D. The matching firewall policy denies the traffic.
Answer: B,D
Explanation:
The default gateway is configured on port2 → The debug output shows find a route:
flag=00000000 gw-0.0.0.0 via port2, which indicates that the default route (0.0.0.0/0) points out port2.
The matching firewall policy denies the traffic → The log line Denied by forward policy check (policy 2) confirms that policy 2 matched and explicitly dropped the traffic.
NEW QUESTION # 25
Refer to the exhibit. How can the administrator view the log messages shown in the exhibit?
(Choose two.)
- A. By right clicking the Implicit deny policy
- B. Filtering by Policy UUID and Application Name in the log entry
- C. Through FortiGate CLI command diagnose log test
- D. Through Security event log page
Answer: B,D
Explanation:
The log shown is a UTM application control log, which can be viewed through the Security Event log page. The administrator can also filter logs by the Policy UUID and Application Name to find specific entries like the one in the exhibit.
NEW QUESTION # 26
Refer to the exhibits.
A diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device are shown.
Two PCs. PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.
Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)
- A. In the system settings, set Multiple Interface Policies to enable.
- B. in the IP pool configuration, set end ipto 100.65.0.112.
- C. In the IP pool configuration, set type to overload.
- D. In the firewall policy, set match-vip to enable using CLI.
Answer: B,C
Explanation:
From the exhibits:
The firewall policy has NAT enabled and is configured to Use Dynamic IP Pool.
The selected IP pool (Internet-pool) is configured as:
Type: One-to-One
External IP Range: 100.65.0.110-100.65.0.111 (only two public IPs)
PC1 and PC2 can access the internet because each one-to-one NAT mapping consumes one public IP from the pool. When PC3 is added, there is no third public IP available in the pool, so FortiGate cannot allocate a one- to-one mapping for PC3 and the session fails.
FortiOS behavior here is standard: with one-to-one IP pools, the available pool size limits how many distinct internal sources can be translated concurrently (depending on allocation and sessions), and a pool with only two IPs will not reliably support three separate hosts needing translations.
Therefore, the administrator can fix this in two valid ways:
B). In the IP pool configuration, set end ip to 100.65.0.112.
This expands the pool by adding an additional public IP address, making three public IPs available (.110, .
111, .112), so PC3 can be assigned an address for one-to-one NAT.
D). In the IP pool configuration, set type to overload.
Changing the pool type to overload enables PAT (many-to-one), allowing multiple internal hosts (PC1, PC2, PC3) to share the pool address(es) using different source ports. This removes the "one public IP per internal host" limitation inherent to one-to-one pools.
Why the other options are not correct:
A). Multiple Interface Policies is unrelated to IP pool exhaustion and does not solve NAT allocation limits.
C). match-vip affects VIP matching behavior for destination NAT/virtual IP usage and does not address the source NAT pool shortage causing PC3 to fail.
NEW QUESTION # 27
Refer to the exhibit.
An administrator has created a new firewall address to use as the destination for a static route. Why is the administrator not able to select the new address in the Destination field of the new static route? (Choose one answer)
- A. In the new firewall address, the FQDN address must first be resolved.
- B. In the new firewall address, Routing configuration must be enabled.
- C. In the new static route, the administrator must first set the interface to port2.
- D. In the new static route, the administrator must select Named Address.
Answer: B
Explanation:
"If you create a firewall address object with the type Subnet or FQDN, you can use that firewall address as the destination of one or more static routes. First, enable Routing configuration in the firewall address configuration. After you enable it, the firewall address object becomes available for use in the Destination drop-down list for static routes with named addresses." Technical Deep Dive:
The correct answer is D. The exhibit shows an FQDN address object (www.fortinet.com), but Routing configuration is disabled. FortiGate does not make that object available as a selectable destination for named static routes until this option is enabled.
Why the others are wrong:
A is incomplete. Even if the static route uses Named Address, the object still will not appear unless Routing configuration is enabled on the address object.
B is not the first requirement from the study guide. DNS resolution matters operationally for FQDN objects, but the documented reason it does not appear in the drop-down is the missing Routing configuration setting.
C is unrelated. The interface does not have to be set to port2 first just to make the address object selectable.
In practice, the fix is:
config firewall address
edit "Fortinet"
set type fqdn
set fqdn "www.fortinet.com"
set allow-routing enable
next
end
After that, the object becomes available in the static route Destination field when using a named address.
NEW QUESTION # 28
Refer to the exhibit.
Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?
- A. FortiGate. with less than 2 GB RAM. does not support the Antivirus scan feature.
- B. The Feature Set for the profile is Flow-based but it must be Proxy-based
- C. None of the inspected protocols are active in this profile.
- D. Antivirus scan is disabled under System -> Feature visibility
Answer: C
Explanation:
In FortiOS 7.6, the Antivirus scan master switch in an antivirus profile becomes available only after at least one supported protocol is enabled for inspection.
What the exhibit shows
A new antivirus profile named FTP_AV_Profile
Feature set: Flow-based
Antivirus scan switch is grayed out
All Inspected Protocols (HTTP, SMTP, POP3, IMAP, FTP, CIFS) are currently disabled Why the Antivirus scan switch is grayed out In FortiOS antivirus profiles:
The Antivirus scan toggle is a dependent control
It cannot be enabled unless at least one inspected protocol is selected This prevents enabling AV scanning when there is no traffic type to scan This behavior is documented in the FortiOS 7.6 Antivirus Profile configuration section.
Once you enable a protocol (for example, FTP), the Antivirus scan switch becomes active and configurable.
Why option B is correct
B . None of the inspected protocols are active in this profile.
All protocol toggles are OFF
Therefore, FortiGate disables (grays out) the Antivirus scan option
This is expected and correct behavior
Why the other options are incorrect
A . Antivirus scan is disabled under Feature visibility
Incorrect. Feature Visibility controls whether Antivirus appears in the GUI, not whether the scan switch is enabled inside a profile.
C . Feature set must be Proxy-based
Incorrect. Antivirus scanning is supported in both flow-based and proxy-based modes.
D . Less than 2 GB RAM does not support Antivirus scan
Incorrect. Memory size affects performance and offloading, not basic AV scan availability.
NEW QUESTION # 29
Refer to the exhibits.
An administrator creates a new address object on the root FortiGate (Local-FortiGate) in the security fabric. After synchronization, this object is not available on the downstream FortiGate (ISFW).
What must the administrator do to synchronize the address object?
- A. Change the csfsetting on ISFW (downstream) to set configuration-sync local.
- B. Change the csfsetting on ISFW (downstream) to set authorization-request-type certificate.
- C. Change the csfsetting on Local-FortiGate (root) to set fabric object-unification default.
- D. Change the csfsetting on both devices to set downstream-access enable.
Answer: C
Explanation:
The CLI command fabric-object-unification is available only on the root FortiGate device. When set to local, global objects are not synchronized to downstream devices in the Security Fabric.
The default value is default.
NEW QUESTION # 30
Refer to the exhibit.
Which two statements about the FortiGuard connection are true? (Choose two.)
- A. The weight increases as the number of failed packets rises
- B. FortiGate is using the default port for FortiGuard communication.
- C. FortiGate identified the FortiGuard Server using DNS lookup.
- D. You can configure unreliable protocols to communicate with FortiGuard Server.
Answer: A,B
Explanation:
Based on the diagnose debug rating output provided in the exhibit and the standard behavior of the FortiGuard connection mechanism in FortiOS 7.6:
Weight Calculation (Statement A is True):
In FortiOS, the rating server selection process uses a weight-based system.
According to official documentation, the weight increases with failed packets (lost responses) and decreases with successful packets.
This mechanism ensures that servers with poor reliability are penalized by having higher weights, effectively pushing them to the bottom of the preference list.
Default Port Communication (Statement D is True):
The exhibit explicitly shows the communication is using HTTPS on port 8888.
In FortiOS 7.6 (and legacy versions like 6.2/6.4), FortiGuard filtering supports specific protocols and ports:
HTTPS on ports 443, 53, and 8888, where 8888 is considered a default port for FortiGuard queries.
Ports 53 and 8888 are standard for both UDP and TCP/HTTPS FortiGuard communications to avoid common firewall blocks on standard web ports.
Why other options are incorrect:
Statement B (Unreliable protocols): While you can configure UDP (which is unreliable), the exhibit specifically shows HTTPS is being used, which is a reliable (TCP-based) protocol.
Statement C (DNS lookup): In the "Flags" column of the server list, a server found via DNS lookup would be marked with the "D" flag. The exhibit shows the flag as "I" (indicating the last INIT request was sent to this server) and a numeric "2," but the "D" flag is absent. Additionally, the IP 10.0.1.241 is a private address, suggesting it is a manually configured FortiManager or local override server rather than a public server found via global DNS lookup.
NEW QUESTION # 31
Which two statements are true regarding FortiGate HA configuration synchronization? (Choose two.)
- A. Incremental configuration synchronization can occur only from changes made on the primary FortiGate device.
- B. Checksums of devices will be different from each other because some configuration items are not synced to other HA members.
- C. Incremental configuration synchronization can occur from changes made on any FortiGate device within the HA cluster.
- D. Checksums of devices are compared against each other to ensure configurations are the same.
Answer: C,D
Explanation:
After the initial synchronization is complete, whenever a change is made to the configuration of an HA cluster device (primary or secondary), incremental synchronization sends the same configuration change to all other cluster devices over the HA heartbeat link.
NEW QUESTION # 32
You have configured the below commands on a FortiGate.
What would be the impact of this configuration on FortiGate?
- A. FortiGate will enable strict RPF on all its interfaces and porti will be exempted from RPF checks.
- B. Port1 will be enabled with flexible RPF. and all other interfaces will be enabled for strict RPF
- C. FortiGate will enable strict RPF on all its interfaces and porti will be enable for asymmetric routing.
- D. The global configuration will take precedence and FortiGate will enable strict RPF on all interfaces.
Answer: A
NEW QUESTION # 33
An administrator has configured the following settings:
What are the two results of this configuration? (Choose two.)
- A. A session for denied traffic is created.
- B. Session helpers are disabled for denied traffic.
- C. The number of logs generated by denied traffic is reduced.
- D. Denied users are blocked for 30 minutes.
Answer: A,C
Explanation:
set ses-denied-traffic enable → ensures FortiGate creates a session entry even for denied traffic.
set block-session-timer 30 → sets the duration (30 seconds) that denied sessions remain in the session table. This prevents repeated logging for every packet in the same denied flow, thereby reducing the number of logs generated.
NEW QUESTION # 34
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
- A. The collector agent must search Windows application event logs.
- B. NetAPI polling can increase bandwidth usage in large networks.
- C. The collector agent uses a Windows API to query DCs for user logins.
- D. The NetSessionEnum function is used to track user logouts.
Answer: B
Explanation:
NetAPI polling mode involves frequent queries to domain controllers, which can cause increased bandwidth usage, especially in large networks with many login events.
NEW QUESTION # 35
Refer to the exhibit. Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?
- A. The signature setting includes a group of other signatures.
- B. FortiGate allows this low severity signature packet and creates a log.
- C. FortiGate stores a local copy of the packet that matches the signature.
- D. The signature setting uses a custom rating threshold
Answer: C
Explanation:
When you add a signature to an IPS sensor, the sensor's override settings take precedence over the default signature action in the FortiGuard database.
This means:
The IPS profile's action (Block) overrides the base signature's action (Pass).
The signature "FTP.Login.Failed" is still low severity, but because it's enabled and logging is on, FortiGate blocks it and logs the event (including packet data)..
NEW QUESTION # 36
Refer to the exhibit. Review the intrusion prevention system (IPS) profile signature settings shown in the exhibit.
What can you conclude about the signature when adding the FTP.Login.Failed signature to the IPS Sensor profile?
- A. FortiGate allows this low severity signature packet and creates a log.
- B. FortiGate stores a local copy of the packet that matches the signature.
- C. The signature setting includes a group of other signatures.
- D. The signature setting uses a custom rating threshold
Answer: A
Explanation:
The IPS signature FTP.Login.Failed is configured with the action Pass and Packet logging = Enable. This means FortiGate will allow traffic that matches this signature but will also log the event, since the severity is low and blocking is not applied.
NEW QUESTION # 37
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. Facebook access is blocked based on the category filter settings.
- B. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
- C. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- D. YouTube search is allowed based on the Google Application and Filter override settings.
Answer: B,D
Explanation:
Facebook belongs to the Social Media application category, which is set to Block in the application sensor. Therefore, any Facebook application traffic is blocked by category.
YouTube Search may fall under Google services or General Interest depending on how traffic is parsed (especially with SSL deep inspection).
The Google application override is set to Monitor, which means traffic is allowed, just logged.
The Video/Audio category (which includes YouTube video playback) is blocked, but this does not block YouTube Search, which is just browsing and searching on the site, is not blocked by the Video/Audio category unless the actual video stream starts.
NEW QUESTION # 38
The HTTP inspection process in web filtering follows a specific order when multiple features are enabled in the web filter profile.
Which order must FortiGate use when the web filter profile has features such as safe search enabled?
- A. Static domain filter, SSL inspection filter, and external connectors filters
- B. FortiGuard category filter and rating filter
- C. Static URL filter, FortiGuard category filter, and advanced filters
- D. DNS-based web filter and proxy-based web filter
Answer: C
Explanation:
Remember that the web filtering profile has several features. So, if you have enabled many of them, the inspection order flows as follows:
1. The local static URL filter
2. FortiGuard category filtering (to determine a rating)
3. Advanced filters (such as safe search or removing Active X components).
NEW QUESTION # 39
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?
- A. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
- B. HQ-NGFW-2 with the parameter priority setting
- C. HQ-NGFW-1 with the parameter override setting
- D. HQ-NGFW-2 with the parameter memory-failover-threshold setting
Answer: C
Explanation:
The HA configuration shows that override is disabled (set override disable), but despite this, HQ- NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ- NGFW-1 is the primary device.
NEW QUESTION # 40
......
Fortinet NSE4_FGT_AD-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Verified NSE4_FGT_AD-7.6 Exam Dumps Q&As - Provide NSE4_FGT_AD-7.6 with Correct Answers: https://prepaway.testkingpass.com/NSE4_FGT_AD-7.6-testking-dumps.html