Fortinet NSE4_FGT_AD-7.6 Practice Test 15

Question 140

A broad accept policy was moved below a deny for Finance subnet 10.5.8.0/24. Which controlled test demonstrates both the exception and intended general connectivity?

Confirm only that the deny rule is visible in the GUI.
From new sessions, confirm 10.5.8.x receives the deny policy ID while an authorized 10.5.9.x host still matches the later accept.
Test one preexisting connection without clearing its old session state.
Disable all rules and check that both addresses fail.

Explanation

Correct Answer

Testing the denied subset and allowed neighboring source validates precedence without inadvertently removing legitimate access.

Incorrect Answers

A rule can exist but still be shadowed or not match the flow.

A cached established flow may not reflect the new policy selection.

This proves global outage rather than a narrow-deny exception and preserved broad access.

Question 141

HTTPS administration on port1 is permitted only from management subnet 192.0.2.0/24. Select TWO direct observations needed to confirm the intended local-in restriction.

A LAN client can browse a public HTTPS website through the FortiGate.
An authorized management host in 192.0.2.0/24 can reach the FortiGate HTTPS login after allowed authentication.
The FortiGate has an outbound central SNAT entry for staff users.
The web-filter profile logs an allowed URL category.
An otherwise routed host outside the approved subnet is rejected at the FortiGate management listener.

Explanation

Correct Answer

The positive test confirms that the rule did not block the permitted administrative source.

The negative test establishes the source restriction; forward policy rules do not supply that proof.

Incorrect Answers

This is forwarded internet traffic, not HTTPS terminating on the FortiGate's own interface.

SNAT on forwarded sessions does not decide access to local-in admin HTTPS.

Web filtering user sessions does not prove the management listener restricts source IPs.

Question 142

An administrator repaired an allow policy whose outgoing interface was WAN1 even though the route to a branch uses `ipsec_dc`. Which test verifies the repaired forwarding match?

Ping the FortiGate WAN management address only.
Read the IPsec phase 1 name without generating traffic.
Generate a new branch flow, confirm its route uses ipsec_dc, and observe the expected accept policy ID and tunnel counters.
Check the antivirus signature package revision.

Explanation

Correct Answer

Route/interface selection and policy ID must agree for this protected path; merely having an enabled policy is not proof of forwarding.

Incorrect Answers

This tests local-in access rather than a forwarded LAN-to-branch session.

An existing tunnel object does not establish the expected policy match and data path.

Inspection database currency cannot confirm the routed egress interface.

Question 143

After limiting a payroll-server allow policy from ALL services to TCP 443, which result shows the change enforces the intended service boundary?

A new TCP 443 connection succeeds and an otherwise identical TCP 22 connection is denied by policy.
A ping to the server succeeds but no TCP services are tried.
An old SSH connection remains established.
The server DNS name resolves correctly.

Explanation

Correct Answer

Same hosts with different destination ports directly test the service matcher rather than address reachability alone.

Incorrect Answers

ICMP reachability does not prove TCP 443-only authorization.

Pre-change session state may persist and is not a clean new-session service match test.

DNS lookup does not measure HTTPS-only policy scope.

Question 144

A TCP session that survived a FortiGate policy deny update was explicitly cleared. Which evidence demonstrates that access is now revoked for both old and new flows?

The original TCP connection stays open but the policy UI says Deny.
Only the firewall's FortiGuard subscription status is checked.
The GUI HTTPS administrator connection is closed.
The targeted old session disappears from the session table and a fresh identical connection matches the intended deny policy.

Explanation

Correct Answer

Clearing prior state plus observing a new policy denial proves the change affects both cached and newly evaluated traffic.

Incorrect Answers

A live existing connection is contrary to immediate revocation despite the visible rule.

A security-feed entitlement does not establish the affected TCP session was removed.

An administrator session is unrelated to the target forwarded TCP flow.

Question 145

A gambling-category block profile was attached to the forward accept rule actually used by Sales. Which evidence proves the security profile now runs on Sales traffic?

Observe the profile exists under Security Profiles without traffic testing.
Read only the policy hit counter without checking category action.
Make a controlled website request from Sales and confirm a web-filter block/category event on the same matched firewall policy ID.
Verify the FortiGate management HTTPS service is enabled.

Explanation

Correct Answer

A correlated session and web-filter event show enforcement rather than merely a profile existing elsewhere.

Incorrect Answers

A configured but unattached profile does not inspect any matching session.

An accept hit does not show that web filtering blocked the intended URL.

Local administrator access has no relation to the Sales web-filter enforcement.

Question 146

A FortiOS 7.6.0 device is in policy-based NGFW mode and a Central SNAT entry now maps 10.7.0.0/24 to 203.0.113.10. Which observation validates the NAT change?

A VIP translates the external server's destination address.
The client receives an internal DHCP address from the FortiGate.
The FortiGate local-in policy permits admin HTTPS.
A new outbound 10.7.x flow matches the Central SNAT map and leaves with translated source 203.0.113.10.

Explanation

Correct Answer

Actual session translation is the proof of central SNAT, not a missing per-policy toggle in policy-based NGFW.

Incorrect Answers

VIP DNAT is a different mapping direction and does not prove the specified outbound SNAT.

Lease allocation does not confirm the external translated source address.

Management access authorization has no bearing on the central SNAT result.

Question 147

A new forward accept rule permits 10.44.5.0/24 to an HTTPS app. Which pair of packet outcomes demonstrates the original implicit deny was fixed without broadening source access?

Both source subnets reach the application successfully.
Only the configured policy source object name is inspected.
A firewall administrator logs into the GUI from 10.44.5.20.
A 10.44.5.20 HTTPS connection logs the new accept policy while 10.44.6.20 to the same host/port remains denied.

Explanation

Correct Answer

This directly checks the intended CIDR boundary and the implicit deny behavior for an unapproved adjacent subnet.

Incorrect Answers

That would show the allow rule is broader than the authorized source range.

An object label cannot prove its underlying subnet and real matching outcome.

A local management login is not a client-to-application forward policy test.

Question 148

A payroll allow rule is changed from incoming interface ANY to VLAN20. How can the engineer verify the interface boundary?

Check that both interfaces show Link Up.
Test only a VLAN20 client.
Send matching source/destination/port test flows from VLAN20 and the excluded transit interface; only VLAN20 should match the accept policy.
Compare FortiGuard license state on both interfaces.

Explanation

Correct Answer

Holding the other policy criteria constant while changing ingress tests whether the intended interface-specific condition is enforced.

Incorrect Answers

Carrier does not establish which forwarding policy authorizes a session.

Positive access alone cannot show an unrelated transit interface was excluded.

Content subscription status is not an incoming-interface policy constraint.

Question 149

An address object meant to cover 10.40.20.0/24 was corrected from /25. Which test most directly verifies the CIDR boundary for that policy?

Confirm only a host at 10.40.20.10 succeeds.
Confirm new permitted flows from both 10.40.20.10 and 10.40.20.200, while 10.40.21.10 remains outside the allow.
Ping the administrator management IP from the firewall.
Increase the SSL inspection depth.

Explanation

Correct Answer

Testing low/high members and an adjacent out-of-range address exposes mask-width errors that a policy display name can conceal.

Incorrect Answers

Both /25 and /24 contain .10, so that test would miss the original defect.

A local-in management ping is not an address-object membership test for client forwarding.

TLS decryption does not change an IPv4 prefix boundary.

Question 150

A recurring FortiGate policy should permit Finance TCP 443 to a reporting server on weekdays 08:00–17:00 only. Select THREE tests that together verify the rule after correcting its schedule.

Use a preexisting allowed TCP connection as the only evening test.
From the authorized Finance subnet, open a new TCP 443 session at 10:00 on a weekday and confirm the allow policy ID.
Check only that the interface speed is 1 Gbps.
Attempt the same new TCP 443 session at 20:00 on a weekday and confirm it no longer matches the timed allow.
Attempt the same new session on a Saturday and confirm the weekday allow policy does not apply.
Verify the FortiAnalyzer log receiver is online but generate no matching test traffic.

Explanation

Correct Answer

This positive test checks the intended source, service and active weekday schedule.

This proves the defined business-hour cutoff rather than an always-on rule.

Weekend rejection separately tests the recurrence-day condition, which time-of-day tests alone miss.

Incorrect Answers

Cached session state can outlive a changed schedule, so a new session is needed to evaluate the current rule.

Physical link speed does not establish policy schedule evaluation.

Log transport cannot confirm the weekday/time conditions without actual sessions.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 13 - 10 Questions (Last Reviewed 01-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 14 - 10 Questions (Last Reviewed 31-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 15 - 10 Questions (Last Reviewed 30-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 16 - 10 Questions (Last Reviewed 29-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 17 - 10 Questions (Last Reviewed 28-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 140

Explanation

Correct Answer

Incorrect Answers

Question 141

Explanation

Correct Answer

Incorrect Answers

Question 142

Explanation

Correct Answer

Incorrect Answers

Question 143

Explanation

Correct Answer

Incorrect Answers

Question 144

Explanation

Correct Answer

Incorrect Answers

Question 145

Explanation

Correct Answer

Incorrect Answers

Question 146

Explanation

Correct Answer

Incorrect Answers

Question 147

Explanation

Correct Answer

Incorrect Answers

Question 148

Explanation

Correct Answer

Incorrect Answers

Question 149

Explanation

Correct Answer

Incorrect Answers

Question 150

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests