Fortinet NSE4_FGT_AD-7.6 Practice Test 16

Question 150

A recurring FortiGate policy should permit Finance TCP 443 to a reporting server on weekdays 08:00–17:00 only. Select THREE tests that together verify the rule after correcting its schedule.

Use a preexisting allowed TCP connection as the only evening test.
From the authorized Finance subnet, open a new TCP 443 session at 10:00 on a weekday and confirm the allow policy ID.
Check only that the interface speed is 1 Gbps.
Attempt the same new TCP 443 session at 20:00 on a weekday and confirm it no longer matches the timed allow.
Attempt the same new session on a Saturday and confirm the weekday allow policy does not apply.
Verify the FortiAnalyzer log receiver is online but generate no matching test traffic.

Explanation

Correct Answer

This positive test checks the intended source, service and active weekday schedule.

This proves the defined business-hour cutoff rather than an always-on rule.

Weekend rejection separately tests the recurrence-day condition, which time-of-day tests alone miss.

Incorrect Answers

Cached session state can outlive a changed schedule, so a new session is needed to evaluate the current rule.

Physical link speed does not establish policy schedule evaluation.

Log transport cannot confirm the weekday/time conditions without actual sessions.

Question 151

A FortiGate in profile-based NGFW mode forwards 10.12.0.0/24 to the Internet through wan1. The ISP will accept only the FortiGate public address as source. Which setting produces that egress translation?

Create a VIP mapping the public web-server destination to an internal address.
Enable source NAT on the matching LAN-to-wan1 forwarding policy using the approved outgoing interface address.
Enable local-in management HTTPS on wan1.
Change the default route distance without enabling NAT.

Explanation

Correct Answer

Policy-mode source NAT changes the private client source to the permitted public egress address, allowing replies to return through the FortiGate.

Incorrect Answers

VIP performs destination translation for inbound services, not private-client SNAT.

Management listener settings do not translate source addresses for forwarded clients.

Routing can choose the WAN exit but does not rewrite private source addresses by itself.

Question 152

Internet clients must reach public 203.0.113.50:8443, but the approved server listens at 10.10.0.50:443. The FortiGate is not using central NAT. Which object provides the port mapping?

Enable outgoing source NAT on the staff's LAN internet policy.
Create a TCP port-forwarding VIP with external port 8443 mapped to 10.10.0.50 port 443, and allow it with the appropriate inbound policy.
Configure an FSSO collector to forward the port.
Increase the web-filter rating timeout.

Explanation

Correct Answer

A FortiOS VIP can translate both external destination address and service port to the internal host; policy acceptance is a separate requirement.

Incorrect Answers

An outbound SNAT toggle does not publish a public destination service.

FSSO maps authenticated user identities and does not rewrite inbound TCP destinations.

URL ratings do not map TCP 8443 to TCP 443 on an internal server.

Question 153

A FortiOS 7.6.0 VIP is configured for public 198.51.100.10 to private 10.2.0.10, but an inbound non-central-NAT rule uses destination `all` and never selects the intended VIP. What policy configuration needs correction?

Configure a Central SNAT map for outbound private clients instead.
Change the administrator trusted-host list to include the public customer.
Rename the VIP to a shorter string without altering the policy reference.
Use the configured VIP object as the inbound firewall-policy destination with matching ingress interface and service.

Explanation

Correct Answer

In non-central NAT operation, an explicit VIP object must participate in policy matching for the published destination path.

Incorrect Answers

SNAT addresses the source side and does not attach the existing inbound VIP to its policy.

Trusted hosts govern login to the FortiGate, not access to the private server behind DNAT.

Object naming cannot cause a policy to select an unreferenced destination object.

Question 154

A FortiGate switches to central NAT. The previous administrator expects an inbound VIP to be selected within the security-policy destination field, but FortiOS now treats translation separately. Which configuration model should be followed?

Configure the enabled DNAT/VIP object in the central NAT workflow and keep the security allow rule scoped to the intended flow.
Put a source-NAT address pool into the FortiGate local-in policy.
Disable all inbound firewall security policies after enabling central NAT.
Create a static route to the client subnet as the only DNAT mapping.

Explanation

Correct Answer

With central NAT active, VIP DNAT processing and the security policy are separate controls; the old per-policy VIP selection model changes.

Incorrect Answers

Local-in controls interface-bound services and does not implement central DNAT for a server.

NAT does not replace forward traffic authorization; unscoped traffic must still be controlled.

Routing determines next hops, not external-IP to internal-IP destination translation.

Question 155

A policy performs source NAT using IP pool 203.0.113.20–203.0.113.25, but the new ISP authorizes only 203.0.113.40–203.0.113.45. Sessions pass security policy and leave with an old source. What must change?

Modify only the destination VIP mapping for an unrelated inbound service.
Increase the FortiGate login session idle timeout.
Disable the route to the ISP to force new source addresses.
Choose an approved SNAT IP pool with the actual authorized egress addresses and verify return routing for that range.

Explanation

Correct Answer

FortiOS SNAT pool contents determine the translated source; a valid policy accept does not override an incorrect source pool.

Incorrect Answers

DNAT for a public server does not choose outgoing client source IPs.

Administrator sessions do not control outbound IP pool membership.

A missing egress route prevents delivery rather than correcting the chosen SNAT source pool.

Question 156

Office users at 10.3.0.20 reach an internal web server via its public DNS record 203.0.113.60, but packets bypass the intended VIP when both hosts are on the same LAN. Which FortiGate path should be designed?

Remove the VIP and rely on the model's DNS cache.
Provide a supported hairpin/U-turn VIP policy and any required source-NAT/return path so internal clients can use the external server address.
Create a local-in admin HTTPS allow rule for the public DNS name.
Raise the Internet SD-WAN SLA threshold without changing the loopback path.

Explanation

Correct Answer

Hairpin NAT explicitly handles internal sources targeting a published external IP; both destination mapping and symmetric return behavior must be supported.

Incorrect Answers

Name resolution does not provide the required forwarding/NAT path to the server.

The target is a private web server behind the FortiGate, not the FortiGate GUI listener.

Link steering does not translate a public VIP back to an internal server on the same LAN.

Question 157

The published service must expose TCP 8443 externally but reach the internal HTTPS server on TCP 443. Select TWO port-forwarding VIP settings that directly implement those different socket endpoints.

Enable SNAT for an unrelated outbound LAN policy instead of VIP port forwarding.
Use an HTTPS administrative local-in policy to publish the private application.
Set the VIP external port to TCP 22 because SSH uses encrypted transport.
Set the VIP external service port to TCP 8443.
Set the VIP mapped internal port to TCP 443 on the private server.

Explanation

Correct Answer

The external port must match what Internet clients connect to, before DNAT maps it.

The mapped port matches the actual server listener; 8443 externally need not equal 443 internally.

Incorrect Answers

SNAT changes client source addresses and cannot publish the specified inbound destination port.

Local-in HTTPS would expose the FortiGate management listener, not map traffic to a private server.

SSH's port 22 is not the requested external HTTPS listener port.

Question 158

A FortiGate VIP is tied to wan1, and public access to the same application succeeds through wan1 but not from the second ISP address on wan2. What object constraint must be checked?

Verify the VIP external-interface/address binding and matching inbound policy for the intended wan2 entry point.
Change only the internal server administrator password.
Increase the antivirus file-size limit globally.
Configure a new local DHCP pool on wan2.

Explanation

Correct Answer

Fortinet documents that a VIP bound to an external interface participates in policy matching for that ingress interface; wan1 binding does not automatically cover wan2.

Incorrect Answers

The service is reachable via wan1, making the missing wan2 VIP/policy match a separate issue.

AV oversize settings do not bind a DNAT VIP to wan2.

DHCP address assignment is unrelated to public inbound VIP translation.

Question 159

An outbound central SNAT rule translates LAN users to 198.51.100.100, but the ISP routes replies only for the customer's assigned 203.0.113.0/28 block. Firewall logs show accepted outgoing SYN packets and no replies. Which NAT-related assumption fails?

The selected SNAT pool address is not within an upstream routable/owned return prefix; use a permitted pool with correct ISP routing.
The client's web-filter category is too restrictive.
The application server expects a different TLS certificate.
The FortiGate local-in HTTPS trusted hosts are incorrect.

Explanation

Correct Answer

Source translation does not make an arbitrary public IP return-reachable; upstream provider routes and anti-spoofing policies must accept the translated identity.

Incorrect Answers

The outbound SYN is accepted and leaves; the missing replies match a public source-routing problem.

No reply reaches the TCP handshake, before server TLS identity validation.

Management login filters cannot make the ISP return packets for an unauthorized SNAT address.

Question 160

Site-to-site traffic 10.1.0.0/24→10.2.0.0/24 is permitted via an IPsec interface, but its central SNAT rule translates 10.1.0.0/24 to a public WAN address, violating selectors and peer expectations. What is required?

Enlarge the public internet IP pool to cover more addresses.
Change the FortiGate administrator trusted-host list.
Replace the site VPN phase 1 name without correcting NAT scope.
Scope or exempt the protected VPN destinations from that internet SNAT mapping so tunnel traffic retains the intended private source.

Explanation

Correct Answer

The peer expects the protected private subnet; an overly broad source-translation map changes source addresses after policy selection and can defeat encrypted traffic matching.

Incorrect Answers

More WAN source addresses intensify the wrong-NAT issue for VPN traffic.

Management access is unrelated to translation of protected transit subnets.

Tunnel naming does not stop the central SNAT map from rewriting the source.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 14 - 10 Questions (Last Reviewed 31-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 15 - 10 Questions (Last Reviewed 30-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 16 - 10 Questions (Last Reviewed 29-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 17 - 10 Questions (Last Reviewed 28-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 18 - 10 Questions (Last Reviewed 27-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 150

Explanation

Correct Answer

Incorrect Answers

Question 151

Explanation

Correct Answer

Incorrect Answers

Question 152

Explanation

Correct Answer

Incorrect Answers

Question 153

Explanation

Correct Answer

Incorrect Answers

Question 154

Explanation

Correct Answer

Incorrect Answers

Question 155

Explanation

Correct Answer

Incorrect Answers

Question 156

Explanation

Correct Answer

Incorrect Answers

Question 157

Explanation

Correct Answer

Incorrect Answers

Question 158

Explanation

Correct Answer

Incorrect Answers

Question 159

Explanation

Correct Answer

Incorrect Answers

Question 160

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests