Fortinet NSE4_FGT_AD-7.6 Practice Test 1

Question 1

A branch FortiGate must accept GUI administration from 10.20.1.0/24 only. HTTPS is currently enabled on the untrusted WAN interface. Which control combination actually reduces the management exposure?

Add an IPv4 forward-traffic accept policy for 10.20.1.0/24.
Leave WAN HTTPS enabled but disable traffic logging.
Remove unwanted HTTPS administrative access from the WAN interface and restrict each authorized administrator to approved trusted management hosts.
Set an SD-WAN SLA to prefer the management subnet.

Explanation

Correct Answer

Interface allowaccess governs whether the service listens; administrator trusted hosts restrict which source hosts can authenticate. These are management-plane controls.

Incorrect Answers

Forward policies govern traffic traversing the firewall, not connections to its own administrative HTTPS listener.

Traffic logging affects observability, not service exposure or administrator login source restrictions.

SD-WAN egress selection cannot restrict inbound local administration on the FortiGate.

Question 2

A newly unpacked FortiGate still uses a well-known initial administrator credential. The management interface is already isolated from the Internet. Which immediate control addresses credential compromise itself?

Enable forward-traffic policy logging without modifying the administrator account.
Increase the session TTL on a WAN firewall rule.
Change the initial administrator password to a unique strong secret and require approved administrative authentication controls.
Allow SNAT on the management subnet.

Explanation

Correct Answer

Replacing the known credential closes a direct authentication risk even when the management interface is restricted.

Incorrect Answers

Logging user sessions does not replace a guessed or leaked privileged login secret.

The forwarding session timer is unrelated to validation of privileged administrator credentials.

Address translation is not an administrator credential or MFA enforcement mechanism.

Question 3

Certificate verification fails across several services because the FortiGate clock is substantially wrong, although the issuing CA is trusted. Which prerequisite must be repaired first?

Replace the firewall default route with a blackhole.
Change certificate revocation checking to ignore all failures.
Make a forward firewall policy accept every TLS session.
Configure reachable NTP synchronization and validate the device clock against actual current time before judging certificate validity.

Explanation

Correct Answer

TLS certificate notBefore/notAfter validation depends on a correct clock; fixing trust anchors alone cannot compensate for wrong device time.

Incorrect Answers

A blackhole default would impair NTP connectivity and does not correct certificate time validation.

Disabling validation undermines security and does not establish the correct clock.

Forward-policy permission cannot change the FortiGate time used by its own certificate verifier.

Question 4

Clients on LAN port3 are meant to receive leases from the FortiGate, but only port2 has a DHCP scope and port3 clients time out. Which configuration belongs on port3?

Configure a FortiGate DHCP server on port3 with a subnet-matching lease pool, gateway, and DNS options.
Enable FortiGuard web filtering on a WAN firewall policy.
Add an IPsec phase 2 selector for the LAN segment.
Add a local-in deny for the LAN subnet.

Explanation

Correct Answer

The DHCP server is bound to the client-facing interface; the scope and options must match its connected subnet.

Incorrect Answers

Web filtering inspects applications after addressing; it cannot answer DHCP DISCOVER on port3.

VPN selectors control encrypted traffic matches, not DHCP server placement on the client interface.

A local-in deny could block host access to firewall services and does not configure DHCP leases.

Question 5

A FortiOS configuration was exported from a 100F and is proposed for direct restore onto a different model. The restore rejects it as an incompatible configuration. Which next action is supported?

Change the FortiGuard package update server and repeat the same incompatible restore.
Increase the FortiGate DHCP lease time and retry the import.
Prepare a backup from the correct hardware/firmware baseline or perform a validated configuration migration with remapped model-specific interfaces.
Disable antivirus scanning and assume the backup becomes model-neutral.

Explanation

Correct Answer

FortiOS restore checks model/firmware compatibility; importing an incompatible configuration may fail or leave invalid interface references.

Incorrect Answers

FortiGuard update routing does not affect the configuration file model or build identity.

Lease duration cannot fix a hardware/firmware incompatibility detected during restore.

A security profile does not rewrite hardware-specific configuration references.

Question 6

An administrator wants to upgrade a production FortiGate across several FortiOS releases. The current model/build is known, but the intermediate supported upgrade sequence has not been checked. Which action must precede maintenance?

Use Fortinet’s supported upgrade-path guidance for that model and current/target builds, with a tested configuration backup and rollback plan.
Install the latest image immediately, regardless of intermediate upgrade requirements.
Delete the existing configuration before backing it up.
Edit SD-WAN link costs to select the firmware update server.

Explanation

Correct Answer

Supported firmware upgrade sequences and rollback preparations prevent skipped-version incompatibilities and unrecoverable changes.

Incorrect Answers

Skipping supported upgrade steps can create schema or firmware compatibility problems.

Destroying recovery state before validating the upgrade path increases outage risk.

Steering choices do not establish the FortiOS release migration sequence or recovery artifacts.

Question 7

Web-filter ratings report unavailable on a newly registered FortiGate. Internet name resolution works, but System > FortiGuard shows the corresponding service entitlement is inactive. What specifically needs correction?

Increase the firewall antivirus scan timeout.
Switch the default route to ECMP without changing license status.
Activate/renew the relevant FortiGuard service entitlement for the registered device and confirm a real rating lookup.
Change the local administrator login profile to super_admin.

Explanation

Correct Answer

The FortiGuard rating service is subscription-dependent; reachability without a valid entitlement does not establish permission to use it.

Incorrect Answers

An AV scan timeout does not grant a missing web-filter entitlement.

Network paths are already functioning and load balancing cannot renew a service subscription.

Administrator privileges do not alter FortiGuard subscription eligibility for a device.

Question 8

A vendor claims an IPv4 forward firewall policy denying TCP/443 will block HTTPS requests addressed to the FortiGate’s own WAN-interface IP. What policy boundary actually handles inbound traffic TO that interface?

Keep the forward-policy deny because locally terminated HTTPS always traverses a normal IPv4 forwarding policy.
Add a DNAT virtual IP pointing at the FortiGate WAN IP.
Use local-in service controls, including allowaccess, administrator trusted hosts and a matching local-in policy if finer restrictions are needed.
Disable FortiAnalyzer logging to block inbound HTTPS.

Explanation

Correct Answer

Local-in traffic terminates on the FortiGate. IPv4 forward policies apply to traffic crossing it; there is no default IPv4 forward-style implicit deny in the local-in list.

Incorrect Answers

A management connection to the FortiGate is local-in, not transit traffic subject to an ordinary forwarding rule.

DNAT concerns forwarded destination translations, not management-plane source restrictions.

Remote logging cannot deny management-plane traffic.

Question 9

A help-desk FortiGate administrator must review logs but must not change firewall policies or create other administrators. Which native access control should enforce this?

Give the account super_admin and ask the user not to edit policies.
Assign an administrator access profile with read permission for required log areas and no write or unrelated permissions.
Restrict the source IP but retain super_admin for all authorized logins.
Disable forward traffic logs to reduce what the help desk can see.

Explanation

Correct Answer

Access profiles determine read, write or no CLI/GUI privileges for functional areas; an account need not use super_admin.

Incorrect Answers

super_admin has full control and ignores the requirement for enforced least privilege.

Trusted hosts restrict login origin, not the operations the account can perform after authentication.

Suppressing logs destroys evidence and does not enforce administrator change permissions.

Question 10

The FortiGate reaches the Internet by IP address, but its FortiGuard server names and NTP hostnames do not resolve. Its system DNS servers point to retired resolvers. Which independent initial-system setting should be corrected?

Reissue the FortiGate administrator certificate without testing the resolver.
Increase the IPS signature threshold.
Configure reachable FortiGate system DNS resolvers and verify named service lookups independently of raw-IP connectivity.
Disable WAN-interface ping.

Explanation

Correct Answer

The appliance uses system DNS when resolving configured FQDN services, including FortiGuard and hostname-based NTP targets.

Incorrect Answers

Changing a certificate does not repair failed DNS lookups for FortiGuard or NTP hostnames.

Intrusion prevention thresholds do not resolve service names for appliance-originated traffic.

ICMP administrative access is unrelated to the system DNS resolver configuration.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 1 - 10 Questions (Last Reviewed 13-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 1

Explanation

Correct Answer

Incorrect Answers

Question 2

Explanation

Correct Answer

Incorrect Answers

Question 3

Explanation

Correct Answer

Incorrect Answers

Question 4

Explanation

Correct Answer

Incorrect Answers

Question 5

Explanation

Correct Answer

Incorrect Answers

Question 6

Explanation

Correct Answer

Incorrect Answers

Question 7

Explanation

Correct Answer

Incorrect Answers

Question 8

Explanation

Correct Answer

Incorrect Answers

Question 9

Explanation

Correct Answer

Incorrect Answers

Question 10

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests