Fortinet NSE4_FGT_AD-7.6 Practice Test 20

Question 190

An AD user successfully authenticates through the FortiGate LDAP server test, but FortiGate admin login is still rejected because no configured remote administrator mapping permits the user group. Which boundary is missing?

A source NAT object that translates the office subnet.
A central SNAT rule on WAN2.
An authorized remote-admin account/group mapping with a FortiGate access profile for that identity.
An application-control block override.

Explanation

Correct Answer

A working LDAP bind proves credentials, but the firewall still needs its administrator authorization and access-profile association.

Incorrect Answers

SNAT does not provision remote administrator identities or privileges.

Outbound translation has no relation to remote-admin account authorization.

Application signature categories cannot grant FortiGate administrator login rights.

Question 191

A FortiGate RADIUS test logs repeated timeout waiting for 10.9.1.5:1812; a packet capture shows requests leave but no reply reaches the configured source interface. What does this evidence isolate?

The user is definitely in the wrong FortiGate policy group.
The server/transport return path or upstream filtering for the RADIUS exchange, before policy group assignment.
The source web-filter category is set incorrectly.
The FortiGate administrator profile is too broad.

Explanation

Correct Answer

No response packet means the FortiGate cannot evaluate an Access-Accept or user group yet; route and UDP reachability must be investigated.

Incorrect Answers

The server has not returned an authentication result; group mapping cannot yet be concluded.

Web filtering does not process the RADIUS challenge/response.

A profile grants management privileges after successful authentication and does not explain an absent RADIUS response.

Question 192

An auditor account was meant to be read-only, but a controlled test successfully edits a firewall address object. The account shows `super_admin` as its access profile. What explains the privilege breach?

The FortiGuard subscription is active.
The assigned administrator access profile allows configuration writes; it is not the intended read-only profile.
The source workstation belongs to a trusted-host subnet.
The default IPv4 route prefers WAN1.

Explanation

Correct Answer

A successful write directly demonstrates excessive FortiOS administrator role privileges despite the account's audit purpose.

Incorrect Answers

Subscription status does not assign administrator write permissions.

Trusted hosts controls source login eligibility, not the authenticated role's configuration privileges.

A route has no effect on which GUI/CLI configuration operations an administrator can commit.

Question 193

A departed engineer's LDAP account is disabled, but the FortiGate continues to accept their local emergency administrator password. Why did the directory offboarding not revoke that login?

The RADIUS server is using UDP 1812 instead of TCP.
FortiGate IPsec Phase 2 settings are mismatched.
The local FortiGate credential is a separate authentication authority from the disabled remote directory user.
The administrator trusted-host list excludes all sources.

Explanation

Correct Answer

Local and remote administrator accounts require separate lifecycle controls; a disabled LDAP account does not erase a standalone FortiGate secret.

Incorrect Answers

The successful login uses local credentials, not a RADIUS exchange.

VPN cryptographic proposals cannot enable a disabled directory account or remove the local credential.

The account successfully logs in, so an all-source denial is inconsistent with the observation.

Question 194

An unauthenticated visitor can browse the Internet immediately, although the guest access requirement is to log in through a captive portal. Traffic logs show an ordinary source-address allow policy matched before an identity-based rule. What caused the bypass?

A broad unauthenticated forwarding allow matches first, preventing the identity-restricted portal rule from governing the session.
A DNS A record is missing for the portal hostname.
The FortiGate local administrator password is weak.
A web category database is expired.

Explanation

Correct Answer

A source-IP rule with no user authentication condition can admit the flow before the portal-bearing policy is considered.

Incorrect Answers

The client is already browsing successfully without needing the portal, pointing to policy match bypass.

Administrator password quality does not decide guest user authentication for forwarded Internet traffic.

Category rating state cannot require login when the earlier policy permits the flow without authentication.

Question 195

FortiGate LDAP test binds successfully to AD, but it cannot find the Security-Approvers group in an OU not covered by the configured base DN. Which setting explains that exact gap?

The FortiGate management interface uses the wrong HTTP port.
The session table has too many TCP connections.
The LDAP group search base/scope excludes the OU that holds the required group.
The IPsec policy uses central SNAT.

Explanation

Correct Answer

Binding confirms credentials and connectivity, while the subsequent directory search can still be restricted to the wrong subtree.

Incorrect Answers

Admin GUI port selection cannot alter the LDAP server's search subtree.

Session count does not selectively hide an AD OU from a successful LDAP query.

VPN source translation is not an LDAP group-search control.

Question 196

RADIUS packet capture shows Access-Accept for a branch user, but the required `Remote_Engineering` FortiGate group is empty and the matched policy denies access. What is the cause?

The RADIUS shared secret is necessarily incorrect.
The branch gateway has no default route.
The FortiGate administrator trusted hosts exclude this client.
The successful RADIUS identity is not associated with the user group referenced by the forwarding policy.

Explanation

Correct Answer

Authentication success is not enough for a group-conditioned accept; the FortiGate must resolve the returned identity/attributes to the allowed group.

Incorrect Answers

The accepted server response establishes that the basic authentication transaction completed.

The user reached the identity-based policy decision; missing group membership is the recorded failure.

Trusted hosts restrict appliance administration, not ordinary forward-user RADIUS group authorization.

Question 197

A source IP outside the administrator management subnet can see the FortiGate HTTPS login page; the interface `allowaccess` includes HTTPS, and no trusted-host or custom local-in source restriction is configured. What explains the exposure?

A user LAN forward policy is incorrectly allowing TCP 443.
The management HTTPS service listens on the interface without an effective source restriction.
The IPsec peer selected the wrong DH group.
The application-control sensor is set to Monitor.

Explanation

Correct Answer

Enabling the listener is necessary for the observed page; without host/source constraints, forbidden clients may reach it regardless of data-forward policies.

Incorrect Answers

Traffic to the FortiGate's own IP is local-in and need not match a client forwarding rule.

IKE proposal mismatch cannot explain reachable local management HTTPS.

Application classification is not the source restriction for an administrative listener.

Question 198

A staff member moved out of a privileged group. The directory shows the new role, but an existing FortiGate identity session still maps them to the old group and permits a protected service. What is the likely state discrepancy?

The protected server has a new DNS A record.
The firewall's effective authenticated identity/group session is stale relative to authoritative directory membership.
The SSL certificate inspection depth is set to Certificate Inspection.
The HA heartbeat path is disconnected.

Explanation

Correct Answer

Cached or persistent group mappings can outlive a directory change and must be refreshed/expired according to the identity method.

Incorrect Answers

Destination name changes cannot grant a user the wrong directory group.

TLS visibility does not itself change authenticated group membership.

Cluster membership is independent of the old identity authorization seen in the active policy.

Question 199

An LDAP-based FortiGate administrator was added to the approved Network-Readers AD group. Which test proves the intended account integration rather than mere directory availability?

Check only that the LDAP server responds to a ping.
Use a shared super_admin account to open the GUI.
Log in as that named AD user and confirm the correct FortiGate access profile grants read access but rejects an unauthorized configuration write.
Verify an outbound web-filter log is created for the AD server.

Explanation

Correct Answer

Real login and operation tests cover both remote authentication and FortiOS privilege mapping.

Incorrect Answers

ICMP reachability does not authenticate the user or map administrative privileges.

A shared local account cannot verify the named directory identity or least privilege.

Traffic logging has no bearing on the remote administrator authorization outcome.

Question 200

A FortiGate RADIUS configuration had repeated timeouts and was corrected. Select THREE evidence items that together demonstrate the client-to-server transaction and the intended group policy now work.

Check only whether the FortiGate WAN link has carrier.
Disable RADIUS logging so no timeouts appear.
Record a new RADIUS response from the configured server for a controlled test identity.
Accept all clients in an unrestricted policy without checking RADIUS.
Confirm the test user receives Access-Accept under the configured authentication and shared-secret contract.
Confirm the accepted identity maps to the FortiGate user group and permitted forwarding policy.

Explanation

Correct Answer

A real response proves the request/return network path and server service are reachable.

Access-Accept establishes that the server accepted the authentication transaction, not merely that the IP responds to ping.

Group mapping and policy match are separate from the RADIUS server's authentication result.

Incorrect Answers

A WAN physical link may be up while the RADIUS UDP exchange or server return path fails.

Suppressing error records does not repair authentication and hides proof.

Bypassing authorization does not prove the configured authentication method works.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 18 - 10 Questions (Last Reviewed 27-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 19 - 10 Questions (Last Reviewed 26-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 20 - 10 Questions (Last Reviewed 25-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 21 - 10 Questions (Last Reviewed 24-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests