Most UptoDate Fortinet NSE4_FGT_AD-7.6 Exam Dumps PDF 2026
100% Free Fortinet NSE 4 NSE4_FGT_AD-7.6 Dumps PDF Demo Cert Guide Cover
NEW QUESTION # 85
Refer to the exhibit.
An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.
Why are there no logs generated under security logs for ABC.Com?
- A. The ABC.Com Type is set as Application instead of Filter.
- B. The ABC Com Action is set to Allow
- C. The ABC.Com is configured under application profile, which must be configured as a web filter profile.
- D. The ABC Com is hitting the category Excessive-Bandwidth.
Answer: B
Explanation:
In FortiOS 7.6 Application Control, security logs are generated primarily for actions such as Block or Monitor, not for Allow actions.
What is happening in the exhibit
An Application Override is configured for ABC.Com
Type: Application
Action: Allow
The application control profile is applied to a firewall policy
Logging is enabled on the firewall policy
Traffic to ABC.Com is successfully allowed
However, no security logs appear for ABC.Com.
Why no logs are generated
In FortiOS 7.6:
Application Control logs are written to Security Logs when:
An application is Blocked
An application is Monitored
When an application action is set to Allow:
The traffic is permitted silently
No application control security log is generated
Even if policy logging is enabled
This is expected and documented behavior.
To generate logs for allowed applications, the action must be set to Monitor, not Allow.
Why the other options are incorrect
A). ABC.Com is hitting the category Excessive-Bandwidth
Incorrect. ABC.Com has a higher-priority explicit override (priority 1), so it is not evaluated against the Excessive-Bandwidth filter.
B). The ABC.Com Type is set as Application instead of Filter
Incorrect. Application-type overrides are valid and commonly used; this does not suppress logging.
C). The ABC.Com must be configured as a web filter profile
Incorrect. This traffic is being evaluated by Application Control, not Web Filter.
NEW QUESTION # 86
Refer to the exhibit. What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?
- A. FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.
- B. FortiGate will close the connection if the SNI does not match the CN and SAN fields
- C. FortiGate will close the connection if the SNI does not match the CN or SAN fields.
- D. FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.
Answer: C
Explanation:
SNI-server-cert-check
Enable: Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, use the CN in the server certificate to do URL filtering.
Strict: Check the SNI in the client hello message with the CN or SAN fields in the returned server certificate. If mismatched, close the connection.
Disable: Do not check the SNI in the client hello message with the CN or SAN fields in the returned server certificate.
NEW QUESTION # 87
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The subject alternative name (SAN) field in the server certificate.
- B. The host field in the HTTP header.
- C. The serial number in the server certificate.
- D. The subject field in the server certificate.
- E. The server name indication (SNI) extension in the client hello message.
Answer: A,D,E
Explanation:
When using SSL certificate inspection, FortiGate is not decrypting the traffic. During the exchange of hello messages at the beginning of an SSL handshake, FortiGate parses the server name indication (SNI) from client Hello, which is an extension of the TLS protocol. The SNI tells FortiGate the hostname of the SSL server, which is validated against the DNS name before receipt of the server certificate. If there is no SNI exchanged, then FortiGate identifies the server by the value in the server by the value in the Subject field or SAN (Subject Alternative Name) field in the server certificate.
NEW QUESTION # 88
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the firewall policy and IP pool configuration on the FortiGate device.
Two PCs, PC1 and PC2, are connected behind FortiGate and can access the internet successfully. However, when the administrator adds a third PC to the network (PC3), the PC cannot connect to the internet.
Based on the information shown in the exhibit, which two configuration options can the administrator use to fix the connectivity issue for PC3? (Choose two.)
- A. In the IP pool configuration, set typeto overload.
- B. In the firewall policy configuration, add 10.0.1.3as an address object in the source field.
- C. In the IP pool configuration, set endipto 192.2.0.12.
- D. Configure another firewall policy that matches only the address of PC3 as source, and then place the policy on top of the list.
Answer: A,C
Explanation:
With IP pool type set to One-to-One, only as many internal hosts as there are public IPs in the pool (192.2.0.10-192.2.0.11) can use NAT. Changing the type to overload allows all internal hosts (including PC3) to share the available public IPs, so PC3 can reach the internet.
Alternatively, keeping One-to-One but extending the pool to 192.2.0.10-192.2.0.12 adds another public IP, allowing a third internal host (PC3) to be mapped and gain internet access.
NEW QUESTION # 89
Refer to the exhibit. The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)
- A. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
- B. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
- C. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
- D. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
Answer: A,C
Explanation:
FortiGate's temporary SSL certificate may cause access denial to sites using HTTP Strict Transport Security (HSTS), so such sites are exempted from deep SSL inspection. Legal regulations require exemption of certain categories to protect user privacy and sensitive information, so these web categories are excluded from SSL inspection.
NEW QUESTION # 90
An administrator wants to ensure that a specific firewall policy on FortiGate is matched before any other policies for the same traffic. Which configuration change is most appropriate?
- A. Move the policy higher in the policy list
- B. Increase the policy ID number
- C. Enable central NAT
- D. Change the policy schedule to always
Answer: A
Explanation:
FortiGate processes policies from top to bottom, matching traffic against the first policy whose criteria are satisfied. By moving a policy above others that might also match the traffic, you ensure it is evaluated first. On the exam, always remember that the visual order in the policy list governs evaluation, not the policy ID or creation time.
NEW QUESTION # 91
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port2) interface has the IP address
100.65.0.101/24.
The LAN (port4) interface has the IP address
10.0.11.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)?
- A. 100.65.0.101
- B. 100.65.0.149
- C. 100.65.0.99
- D. 100.65.0.49
Answer: C
Explanation:
From the exhibits, there are three relevant firewall policies from LAN (port4) to WAN (port2), each using a different IP pool for source NAT:
TCP traffic
Service: ALL_TCP
Destination: BR1-FGT
IP Pool: SNAT-Pool → 100.65.0.49
PING traffic
Service: PING
Destination: all
IP Pool: SNAT-Remote1 → 100.65.0.99
IGMP traffic
Service: IGMP
Destination: all
IP Pool: SNAT-Remote → 100.65.0.149
The user on HQ-PC-1 (10.0.11.50) is pinging BR1-FGT (100.65.1.111). In FortiOS, policy matching is based on (among other fields) source, destination, and service, and the first matching policy in top-down order is applied.
Because the traffic is ICMP echo (ping), it matches the policy named PING traffic (service PING, destination all). That policy explicitly uses Use Dynamic IP Pool with SNAT-Remote1, which is configured with external IP 100.65.0.99.
Therefore, the source NAT IP used for this ping is 100.65.0.99.
NEW QUESTION # 92
Refer to the exhibit. How can the administrator view the log messages shown in the exhibit?
(Choose two.)
- A. By right clicking the Implicit deny policy
- B. Filtering by Policy UUID and Application Name in the log entry
- C. Through Security event log page
- D. Through FortiGate CLI command diagnose log test
Answer: B,C
Explanation:
The log shown is a UTM application control log, which can be viewed through the Security Event log page. The administrator can also filter logs by the Policy UUID and Application Name to find specific entries like the one in the exhibit.
NEW QUESTION # 93
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
What would you do to resolve this issue?
- A. Set SSL inspection to deep-content-inspection.
- B. Change the Inspection mode to Proxy-based.
- C. Add *Google*.com to the URL category in the security profile.
- D. Move up Google in the Application and Filter Overrides section to set its priority to 1.
Answer: D
Explanation:
In the Application and Filter Overrides, the Excessive-Bandwidth filter (set to Block) is priority 1, and Google (set to Monitor) is priority 2. Since overrides are evaluated by priority, Google traffic is being blocked by the higher-priority rule. Moving Google to the top (priority 1) ensures it is matched first, allowing access while still monitoring it.
NEW QUESTION # 94
An administrator wants to address shadow IT visibility challenges and prevent users from sending sensitive files outside the organization without proper approval. Which FortiSASE method should the administrator implement to achieve these goals?
- A. Secure private access (SPA)
- B. Secure internet access (SIA)
- C. Secure SD-WAN access (SSD-WAN)
- D. Secure SaaS access (SSA)
Answer: D
Explanation:
Secure SaaS Access (SSA) provides visibility into shadow IT and allows control over SaaS applications, including enforcing policies to prevent sensitive files from being uploaded or shared without proper approval.
NEW QUESTION # 95
Which inspection mode does FortiGate use for application profiles if it is configured as a profile- based next-generation firewall (NGFW)?
- A. Proxy-based inspection
- B. Certificate inspection
- C. Flow-based inspection
- D. Full content inspection
Answer: C
Explanation:
You can configure application control in proxy-based and flow-based firewall policies. However, because application control uses the IPS engine, which uses flow-based inspection, the INSPECTION is always flow-based.
NEW QUESTION # 96
Refer to the exhibits.
A diagram of a FortiGate device connected to the network VIP object and firewall policy configurations are shown.
The WAN (port2) interface has the IP address
100.65.0.101/24.
The LAN (port4) interface has the IP address
10.0.11.254/24.
If the host 100.65.1.111 sends a TCP SYN packet on port 443 to 100.65.0.200. what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?
- A. 100.65.1. ill, 10.0.11.50, and 4443. respectively
- B. 10.0.11.254, 100.65.0.200. and 443, respectively
- C. 10.0.11.254, 10.0.15.50, and 4443. respectively
- D. 100.65.1.111, 10.0.11.50. and 443. respectively
Answer: A
Explanation:
From the exhibits:
A VIP named VIP-WEB-SERVER is configured on WAN (port2) with:
External IP: 100.65.0.200
Mapped (internal) IP: 10.0.11.50
Port forwarding enabled (TCP)
External service port: 443
Map to IPv4 port: 4443
The inbound firewall policy Web_Server_Access is:
From WAN (port2) to LAN (port4)
Destination: VIP-WEB-SERVER
Service: HTTPS
NAT: Disabled (meaning no source NAT is applied)
What happens to the packet
A host 100.65.1.111 sends TCP SYN dst-port 443 to 100.65.0.200.
When FortiGate matches the VIP and forwards traffic to the internal server, FortiGate performs destination NAT (DNAT) based on the VIP:
Source IP is unchanged because policy NAT is disabled:
Source remains 100.65.1.111
Destination IP is translated by the VIP:
Destination becomes 10.0.11.50
Destination port is translated by the VIP port-forward:
Destination port becomes 4443
Therefore, at the time FortiGate forwards the packet to the destination (internal server), it will be:
Source address: 100.65.1.111
Destination address: 10.0.11.50
Destination port: 4443
NEW QUESTION # 97
Refer to the exhibit. Which two statements about the FortiGuard connection are true? (Choose two.)
- A. FortiGate is using the default port for FortiGuard communication.
- B. The weight increases as the number of failed packets rises.
- C. You can configure unreliable protocols to communicate with FortiGuard Server.
- D. FortiGate identified the FortiGuard Server using DNS lookup.
Answer: B,D
Explanation:
FortiGate identified the FortiGuard Server using DNS lookup → The server is shown with a private IP (10.0.1.241), which indicates FortiGate resolved it via DNS or explicit override rather than using default FortiGuard anycast servers.
The weight value reflects server reliability. It decreases with good performance and increases as packet loss or failures rise, meaning higher weight indicates more failures.
NEW QUESTION # 98
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
- B. YouTube search is allowed based on the Google Application and Filter override settings.
- C. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- D. Facebook access is blocked based on the category filter settings.
Answer: C,D
NEW QUESTION # 99
Refer to the exhibit.
An SD-WAN zone configuration on the FortiGate GUI is shown. Based on the exhibit, which statement is true?
- A. port2 and port3 are not assigned to a zone.
- B. The Underlay zone contains no member.
- C. The Underlay zone is the zone by default.
- D. The virtual-wan-link and overlay zones can be deleted
Answer: B
Explanation:
According to the FortiOS 7.6 Administrator Guide and the specific behavior of the SD-WAN GUI, here is the technical breakdown:
SD-WAN Zone Hierarchy and UI Elements: In the FortiGate GUI, SD-WAN zones that contain member interfaces are displayed with a plus (+) icon next to the checkbox. This icon allows administrators to expand the zone and view the specific physical or logical interfaces assigned to it.
Analysis of the "Underlay" Zone: In the provided exhibit, the virtual-wan-link and overlay zones both feature the plus (+) expansion icon, indicating they have active members. The Underlay zone, however, lacks this icon and displays a red status icon. This is the visual indicator in FortiOS that the zone is currently empty and contains no member interfaces.
Mandatory Zone Membership: In FortiOS 7.x, every SD-WAN member interface must be assigned to a zone.
It is not possible for an interface to be an "SD-WAN member" (as shown in the legend with port2 and port3) without being assigned to a zone. Since port2 and port3 are listed in the legend, they are indeed assigned to one of the other expanded zones (likely virtual-wan-link or overlay), making Option D incorrect.
Default Zone Behavior: While FortiOS 7.6 often creates default zones like virtual-wan-link, underlay, and overlay during certain configuration wizards or by default in newer versions, they are distinct entities. There is no single "default" zone that acts as a global catch-all in the way Option C suggests.
Immutability of System Zones: While certain system-defined zones have restrictions, the primary focus of this specific exhibit is the current membership state, which clearly shows the Underlay zone is empty.
NEW QUESTION # 100
Refer to the exhibit.
Which statement about this firewall policy list is true?
- A. The firewall policies are listed by ingress and egress interfaces pairing view.
- B. The Implicit group can include more than one deny firewall policy.
- C. The firewall policies are listed by ID sequence view.
- D. LAN to WAN, WAN to LAN, and Implicit are sequence grouping view lists.
Answer: D
Explanation:
The firewall policy list shown is displayed in the sequence grouping view, where policies are grouped based on their traffic direction - such as LAN to WAN, WAN to LAN, and Implicit. This view helps administrators quickly identify and manage policies according to their interface pairings and logical traffic flow, rather than by numerical ID order.
NEW QUESTION # 101
Refer to the exhibits. An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-
2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-
2, the status stays Pending.
What can be the two possible reasons? (Choose two.)
- A. Management IP must be set to 10.0.13.254.
- B. Upstream FortiGate IP must be set to 10.0.11.254.
- C. SAML Single Sign-On must be set to Manual.
- D. HQ-ISFW-2 must be authorized on HQ-ISFW.
Answer: B,D
Explanation:
The Upstream FortiGate IP should match the IP address of the Fabric Root interface, which is
10.0.11.254, not 10.0.13.254.
The new device (HQ-ISFW-2) must be authorized on the Fabric Root (HQ-ISFW) before it can join the Security Fabric, otherwise the status remains pending.
NEW QUESTION # 102
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.
Based on the exhibit, which statement is true?
- A. port2 and port3 are not assigned to a zone.
- B. The Underlay zone contains no member.
- C. The Underlay zone is the zone by default.
- D. The virtual-wan-link and overlay zones can be deleted.
Answer: B
Explanation:
Underlay is not a default zone. It is user defined and not active.
NEW QUESTION # 103
Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)
- A. The subject alternative name (SAN) field in the server certificate.
- B. The host field in the HTTP header.
- C. The serial number in the server certificate.
- D. The subject field in the server certificate.
- E. The server name indication (SNI) extension in the client hello message.
Answer: A,D,E
Explanation:
When SSL certificate inspection is enabled on a FortiGate device, the system uses the following three pieces of information to identify the hostname of the SSL server:
Server Name Indication (SNI) extension in the client hello message (B): The SNI is an extension in the client hello message of the SSL/TLS protocol. It indicates the hostname the client is attempting to connect to. This allows FortiGate to identify the server's hostname during the SSL handshake.
Subject Alternative Name (SAN) field in the server certificate (C): The SAN field in the server certificate lists additional hostnames or IP addresses that the certificate is valid for. FortiGate inspects this field to confirm the identity of the server.
Subject field in the server certificate (D): The Subject field contains the primary hostname or domain name for which the certificate was issued. FortiGate uses this information to match and validate the server's identity during SSL certificate inspection.
NEW QUESTION # 104
Refer to the exhibit showing a debug flow output.
Which two conclusions can you make from the debug flow output? (Choose two.)
- A. The debug flow is for UDP traffic.
- B. The default gateway is configured on port2.
- C. The matching firewall policy denies the traffic.
- D. The RPF check fails.
Answer: B,C
Explanation:
The default gateway is configured on port2 → The debug output shows find a route:
flag=00000000 gw-0.0.0.0 via port2, which indicates that the default route (0.0.0.0/0) points out port2.
The matching firewall policy denies the traffic → The log line Denied by forward policy check (policy 2) confirms that policy 2 matched and explicitly dropped the traffic.
NEW QUESTION # 105
Refer to the exhibit. Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?
- A. None of the inspected protocols are active in this profile.
- B. Antivirus scan is disabled under System -> Feature visibility.
- C. FortiGate, with less than 2 GB RAM, does not support the Antivirus scan feature.
- D. The Feature Set for the profile is Flow-based but it must be Proxy-based.
Answer: A
Explanation:
Enable one or more protocols for inspection, then enable AntiVirus scan for the selected protocols with a specified action.
https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/922096/inspection-mode- feature-comparison
NEW QUESTION # 106
......
Updated Fortinet NSE4_FGT_AD-7.6 Dumps – PDF & Online Engine: https://www.prep4surereview.com/NSE4_FGT_AD-7.6-latest-braindumps.html
PDF Exam Material 2026 Realistic NSE4_FGT_AD-7.6 Dumps Questions: https://drive.google.com/open?id=1-e-O3I0TFmbWE-rZystucrzjWJ50BRpz
