Fortinet NSE4_FGT_AD-7.6 Practice Test 14

Question 130

A FortiGate debug flow finds a route `via ipsec_branch`, but the only intended accept policy lists outgoing interface `wan1`. The flow then shows forward-policy denial. What explains this?

The FortiGate lacks an IPsec SA by definition.
The policy does not match the routed outgoing interface, so it cannot authorize the VPN-bound packet.
The DNS lookup returned no address.
The local-in administrator service was disabled.

Explanation

Correct Answer

Routing selects the VPN interface before the policy check; an allow rule tied to WAN1 is not an eligible match for that path.

Incorrect Answers

The trace identifies an effective route to ipsec_branch; it does not itself establish a Phase 1 negotiation failure.

A concrete destination packet reached routing and policy evaluation, so DNS is not the observed fault.

Management HTTPS access does not match this forwarded client subnet flow.

Question 131

A firewall audit finds that an internal source can connect to a server on TCP 22 although the written rule should permit only HTTPS. The matched policy lists service `ALL`. What is the explanatory policy error?

The upstream static route has the wrong administrative distance.
The destination server has a self-signed HTTPS certificate.
The rule's service matcher includes SSH/TCP 22 and therefore permits more than the authorized port.
The FortiGate time zone is not UTC.

Explanation

Correct Answer

Source/destination criteria can match while the service field remains too broad; service ALL authorizes additional protocols.

Incorrect Answers

The connection succeeds and logs match a permitting policy; this is service-scope exposure, not a route omission.

Certificate trust cannot explain acceptance of SSH on TCP 22.

System clock settings do not broaden a forwarding policy's service matcher.

Question 132

At 09:00, policy 11 allowed a long-running SSH session. At 09:10 the policy changed to deny and all new SSH attempts fail, but the original TCP connection remains open. What accounts for this difference?

The source IP has changed to a different subnet.
IPsec Phase 1 authentication failed.
The web category changed to Allow.
The existing connection retains established session-table state while fresh sessions are evaluated against the new deny rule.

Explanation

Correct Answer

Stateful forwarding can process established flows using session entries; a policy edit does not guarantee instant teardown of every existing session.

Incorrect Answers

The same long-lived connection persists while new identical attempts are denied, which points to state, not a new source address.

The observed SSH session continues to pass; its behavior cannot be explained by an absent new IKE SA.

Web filtering categories do not determine reuse of the original SSH session state.

Question 133

Gambling sites are blocked for users matching policy 5, but another user matches policy 3, which allows HTTPS with security profiles disabled. The user reaches gambling sites. Which configuration difference explains the bypass?

The FortiGuard category database is necessarily expired.
The server's TLS certificate chain is too short.
The client's DHCP default gateway is missing.
The actual matching policy 3 has no web-filter profile/UTM enabled, even though a profile is configured elsewhere.

Explanation

Correct Answer

Profile-based NGFW requires each inspected forward policy to apply the profile; a different protected rule does not inspect these sessions.

Incorrect Answers

Other users are blocked on policy 5; the evidence points to policy coverage, not a global rating entitlement issue.

SSL chain length is not evidence that web-filter inspection is attached to policy 3.

The client reaches websites through the matched allow policy, so gateway reachability exists.

Question 134

An operator switched to policy-based NGFW on FortiOS 7.6.0 and sees no NAT checkbox in firewall policies; NAT mappings now appear under Central SNAT. What causes the interface difference?

The FortiGate administrator has read-only permissions.
Policy-based NGFW mode requires central NAT, so source translation is configured in the central SNAT table.
The destination server uses IPv6 only.
The active WAN member failed its SD-WAN SLA.

Explanation

Correct Answer

This is a documented mode-level behavior; per-policy NAT is not the standard source-translation control in policy-based NGFW.

Incorrect Answers

An admin permission issue would limit edits broadly; the NAT control location changed with the NGFW operating mode.

The observed mode change affects policy NAT controls independent of this particular destination.

Link health has no causal connection to the NAT checkbox being replaced by central mapping.

Question 135

A FortiOS flow trace says `Denied by forward policy check` for 10.44.5.20→192.0.2.15 TCP 443. The policy list has accepts for 10.44.4.0/24 only and no other eligible rule. What causes the drop?

No configured forward allow matches the 10.44.5.0/24 source, so the implicit deny applies.
The server certificate contains the wrong common name.
The FortiGuard web-filter license has expired.
The NAT address pool is low on IP addresses.

Explanation

Correct Answer

FortiOS does not need an explicit deny rule to reject an unmatched forwarded session; the source range is outside the allowed subnet.

Incorrect Answers

TLS certificate evaluation is not reached when the packet fails the firewall policy check.

The trace indicates a forwarding-policy denial, before web category inspection.

SNAT availability cannot create a missing source-subnet policy match.

Question 136

A transit network reaches a sensitive payroll host through a policy intended for only VLAN20. Logs show the matched rule has incoming interface `any`, and the transit source also satisfies its address group. What is the direct exposure mechanism?

The IPS signature database is two days old.
The FortiGate management port is listening on HTTPS.
The VPN IKE proposal has been weakened.
The incoming-interface criterion is not restricted to VLAN20, so traffic from an unintended interface qualifies for the same accept rule.

Explanation

Correct Answer

Interface ANY broadens the policy match across incoming paths, and source-address objects alone cannot encode the originally intended interface boundary.

Incorrect Answers

An IPS update does not explain why a forward accept policy matched the transit interface.

A local-in management listener is different from an unauthorized transit forwarding match.

IKE proposal choice does not change the incoming interface field of the payroll allow policy.

Question 137

A policy was meant to allow 10.40.20.0/24, but the address object contains 10.40.20.0/25. Hosts .10 pass, while .200 hits implicit deny. Which object error explains the difference?

The configured /25 covers only 10.40.20.0–10.40.20.127, excluding 10.40.20.200.
The default route must prefer the other WAN.
The FortiGate local administrator trusted host uses /24.
The FortiGuard category should be overridden.

Explanation

Correct Answer

An address object's subnet mask determines the actual matched set; a friendly object name cannot enlarge the CIDR range.

Incorrect Answers

The difference follows source address membership within the /25, not egress routing.

Management login trusted hosts do not choose the forward client rule's source CIDR.

Content filtering cannot make .200 match the wrong IP address object.

Question 138

A service policy has source/destination/service fields correct but its recurring schedule is Saturday/Sunday. Staff test it on Tuesday at 10:00 and match an implicit deny. What causes the failure?

The client is not authenticated to the firewall GUI.
The policy schedule is inactive at the time of the weekday test, so it is not an eligible accept match.
The destination TCP 443 is outside the HTTPS service object.
The VPN rekey proposal is mismatched.

Explanation

Correct Answer

FortiOS uses the schedule field as part of policy matching; an otherwise matching rule can be inactive outside its allowed interval.

Incorrect Answers

A forward user session does not require administrative GUI login to match a schedule.

The question states the service is correct; the schedule alone excludes the flow.

A policy-time mismatch is independent of IPsec phase negotiation.

Question 139

A client hits policy 8, which blocks an application category. Policy 18 below explicitly allows a sanctioned app in that category, but policy 18 never logs matches. Why is it ineffective?

The client requires a larger DHCP pool.
The FortiGate HA member priority is too low.
The earlier broad application blocking rule matches first and prevents evaluation of the more specific lower allow.
The server uses a public certificate instead of a private one.

Explanation

Correct Answer

The observed policy ID and rule order show the specific exception is shadowed; its own allow setting cannot override an earlier match.

Incorrect Answers

The client already reaches policy evaluation; IP address leasing does not determine app policy order.

HA elections do not select which application policy matches a session.

TLS certificate issuer choice does not reorder the observed application rules.

Question 140

A broad accept policy was moved below a deny for Finance subnet 10.5.8.0/24. Which controlled test demonstrates both the exception and intended general connectivity?

Confirm only that the deny rule is visible in the GUI.
From new sessions, confirm 10.5.8.x receives the deny policy ID while an authorized 10.5.9.x host still matches the later accept.
Test one preexisting connection without clearing its old session state.
Disable all rules and check that both addresses fail.

Explanation

Correct Answer

Testing the denied subset and allowed neighboring source validates precedence without inadvertently removing legitimate access.

Incorrect Answers

A rule can exist but still be shadowed or not match the flow.

A cached established flow may not reflect the new policy selection.

This proves global outage rather than a narrow-deny exception and preserved broad access.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 12 - 10 Questions (Last Reviewed 02-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 13 - 10 Questions (Last Reviewed 01-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 14 - 10 Questions (Last Reviewed 31-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 15 - 10 Questions (Last Reviewed 30-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 16 - 10 Questions (Last Reviewed 29-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 130

Explanation

Correct Answer

Incorrect Answers

Question 131

Explanation

Correct Answer

Incorrect Answers

Question 132

Explanation

Correct Answer

Incorrect Answers

Question 133

Explanation

Correct Answer

Incorrect Answers

Question 134

Explanation

Correct Answer

Incorrect Answers

Question 135

Explanation

Correct Answer

Incorrect Answers

Question 136

Explanation

Correct Answer

Incorrect Answers

Question 137

Explanation

Correct Answer

Incorrect Answers

Question 138

Explanation

Correct Answer

Incorrect Answers

Question 139

Explanation

Correct Answer

Incorrect Answers

Question 140

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests