Question 120
A user has a long established TCP connection to an application. An administrator changes its FortiGate policy from accept to deny, but the existing connection continues temporarily while fresh connections are blocked. Which operational step is appropriate for immediate revocation?
- Disable FortiGuard IPS signature updates.
- Increase the session TTL for the affected flow.
- Move the accept rule back above the deny.
- Identify and clear the affected existing session state, while leaving the new deny policy intact.
Explanation
Correct Answer
D:Established sessions may continue under cached state even when a policy change blocks new session setup; matching session cleanup enforces immediate revocation.
Incorrect Answers
A:IPS database refresh does not invalidate a particular previously allowed session.
B:Longer state retention prolongs rather than revokes access.
C:That would permit fresh connections and undermine the intended revocation.
Question 121
A FortiOS 7.6.0 device uses profile-based NGFW mode. Web-filter categories have been configured in a profile, but users still browse gambling websites because their matching accept policy has no security profiles enabled. Which correction applies enforcement?
- Enable security profiles on the actual matching firewall policy and attach the intended web-filter profile.
- Add the website categories only to the FortiGate administrator trusted-host configuration.
- Change only the VPN Phase 2 lifetime.
- Increase the allowed service range for the policy.
Explanation
Correct Answer
A:In profile-based NGFW, defining a web filter is insufficient; the inspected forwarding policy must reference the profile and receive appropriate traffic.
Incorrect Answers
B:Trusted hosts restrict firewall management logins, not web browsing by LAN users.
C:IPsec rekey timing does not attach a missing web-filter profile.
D:Broader services cannot enforce URL categories without the configured inspection profile.
Question 122
After switching a FortiGate to policy-based NGFW mode, an engineer cannot find the individual source-NAT toggle on IPv4 security rules. Internal users need outbound address translation. Where must SNAT be configured?
- Add a per-policy NAT checkbox to the GUI with a browser extension.
- Create a matching Central SNAT mapping for the intended source, destination and egress scope.
- Create a DNAT virtual IP for outbound source translation.
- Add a local-in policy accepting the user subnet.
Explanation
Correct Answer
B:Fortinet documents that policy-based NGFW mode always uses central NAT; source translation is defined in the central SNAT table rather than per-policy toggles.
Incorrect Answers
A:The absent field reflects the operating mode, not a UI rendering defect.
C:DNAT maps destination addresses; it is not the required outbound SNAT mapping.
D:Local-in rules govern traffic to the firewall itself, not NAT on forwarded internet sessions.
Question 123
A new staff subnet reaches the FortiGate, but flow debug shows `Denied by forward policy check` and no rule matches its source, destination interface and service. The subnet should access only a specific HTTPS application. What policy is needed?
- Disable the IPv4 firewall policy subsystem entirely.
- Enable FortiGate HTTPS administration on the WAN port.
- Change the web-filter action of a different policy.
- Create a narrowly scoped forward accept rule for the correct ingress, egress, subnet, application address and TCP 443 service.
Explanation
Correct Answer
D:Without an explicit matching allow, the ordinary forwarding-policy implicit deny applies; authorizing only the required tuple preserves least privilege.
Incorrect Answers
A:That does not supply an authorized service match or preserve firewall enforcement.
B:Local management access is unrelated to client-to-application forwarding.
C:An unmatched policy cannot override the implicit deny for the new subnet.
Question 124
A policy intended for branch VLAN20 to a single payroll server currently uses incoming-interface `any`. An unrelated transit interface can therefore also match its permissive address/service objects. Which change directly reduces the exposure?
- Increase the destination server's TCP keepalive interval.
- Turn on logging but retain the `any` interface.
- Bind the policy to the approved incoming interface or security zone, preserving its destination/service restrictions.
- Raise the FortiGate GUI admin timeout.
Explanation
Correct Answer
C:An interface-specific rule prevents packets arriving on unrelated transit ports from satisfying an overly broad incoming-interface criterion.
Incorrect Answers
A:TCP liveness tuning does not change the policy's incoming-interface scope.
B:Logs reveal exposure after the fact; they do not restrict which interface is authorized.
D:Management-session duration is not a forwarding-interface authorization criterion.
Question 125
A FortiGate address object named PAYROLL_NET was intended as 10.40.20.0/24, but its configured mask is /25. Select TWO checks that expose why host 10.40.20.200 does not match the expected allow rule.
- Inspect the object's stored IPv4 subnet/mask, not merely its friendly name.
- Trace a new test session from .200 and observe the actual matched policy or implicit-deny result.
- Check the SSL certificate issuer of an unrelated website.
- Increase the DHCP lease lifetime for all clients.
- Disable FortiAnalyzer to force a policy change.
Explanation
Correct Answer
A:The CIDR definition determines which addresses are included; 10.40.20.200 lies outside a 10.40.20.0/25 object.
B:The live flow shows whether policy evaluation excludes .200 rather than relying on a guessed rule hit.
Incorrect Answers
C:Certificate trust cannot change address-object CIDR membership.
D:Longer leases do not expand the configured subnet from /25 to /24.
E:Log receiver connectivity does not determine which source addresses match an IPv4 policy object.
Question 126
A Finance firewall rule must allow a reporting service Monday through Friday from 08:00 to 17:00 local time, but its schedule object is `always`. Which configuration enforces the intended window?
- Assign an appropriately defined recurring schedule with those weekday/time boundaries to the specific allow policy, and verify system time.
- Change only the source NAT pool used by the policy.
- Set web filter to Allow for business URLs.
- Move a broad always-allow rule above the intended schedule rule.
Explanation
Correct Answer
A:FortiOS policy matching includes the configured schedule; an always-active schedule cannot impose weekday business hours.
Incorrect Answers
B:Address translation does not restrict the hours during which a rule can match.
C:Web categorization is not a replacement for a time-limited firewall schedule.
D:That would shadow time restrictions for matching sessions.
Question 127
A policy sequence blocks the entire social-network application category before a lower rule tries to allow one approved collaboration application. Both rules match the same users. How can the exception work without opening the whole category?
- Place the more specific eligible allow/override before the broad block and preserve the remaining category restriction.
- Disable the application control engine globally.
- Raise the IPS severity threshold.
- Change DHCP lease time for the user subnet.
Explanation
Correct Answer
A:When the broad blocking decision matches first, a later special exception cannot override it; specific authorization must precede the general rule or use an explicit supported application-sensor override.
Incorrect Answers
B:This would also allow every prohibited category member instead of just the approved app.
C:IPS exploit severity does not control the application-category allow/block sequence.
D:Client address lifetime cannot choose which application rule matches first.
Question 128
A FortiGate has policy 4: source 10.9.0.0/16, destination 192.0.2.20, service HTTPS, action accept. Policy 14 below denies 10.9.9.0/24 to the same host/service. A 10.9.9.5 connection is accepted and logged on policy 4. What is the root cause?
- The destination interface has no route.
- The HTTPS certificate is untrusted.
- The IPsec tunnel's PFS groups differ.
- Policy 4 is the earlier matching broad accept, so traffic never reaches policy 14.
Explanation
Correct Answer
D:The observed policyid=4 aligns with top-down first-match rule selection and explains why the later subnet deny is ineffective.
Incorrect Answers
A:The accepted session and policyid record demonstrate the flow reached the forwarding decision successfully.
B:Certificate trust does not choose which IPv4 forwarding policy accepted the flow.
C:The flow was accepted by the first matching IPv4 policy, not blocked by IKE negotiation.
Question 129
From a forbidden external test host, an HTTPS connection to the FortiGate's own port1 IP succeeds, while all transit IPv4 HTTPS traffic is correctly restricted. No custom local-in deny or trusted-host restriction exists. Which boundary is still open?
- The FortiGate local management listener is reachable under interface allowaccess/default local-in behavior.
- A forwarding policy accepting internet browsers must be too broad.
- The outbound central SNAT table has no entry.
- The user's FSSO token has expired.
Explanation
Correct Answer
A:Forward policy restrictions do not necessarily block traffic terminating on the firewall interface; Fortinet documents local-in and trusted-host controls.
Incorrect Answers
B:Those policies apply to packets going through the firewall, not necessarily HTTPS directed to its own management IP.
C:SNAT does not determine authorization to a local administrative listener.
D:Remote admin HTTPS source reachability is not the same as an FSSO user forwarding session.
Question 130
A FortiGate debug flow finds a route `via ipsec_branch`, but the only intended accept policy lists outgoing interface `wan1`. The flow then shows forward-policy denial. What explains this?
- The FortiGate lacks an IPsec SA by definition.
- The policy does not match the routed outgoing interface, so it cannot authorize the VPN-bound packet.
- The DNS lookup returned no address.
- The local-in administrator service was disabled.
Explanation
Correct Answer
B:Routing selects the VPN interface before the policy check; an allow rule tied to WAN1 is not an eligible match for that path.
Incorrect Answers
A:The trace identifies an effective route to ipsec_branch; it does not itself establish a Phase 1 negotiation failure.
C:A concrete destination packet reached routing and policy evaluation, so DNS is not the observed fault.
D:Management HTTPS access does not match this forwarded client subnet flow.
Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests