Fortinet NSE4_FGT_AD-7.6 Practice Test 21

Question 200

A FortiGate RADIUS configuration had repeated timeouts and was corrected. Select THREE evidence items that together demonstrate the client-to-server transaction and the intended group policy now work.

Check only whether the FortiGate WAN link has carrier.
Disable RADIUS logging so no timeouts appear.
Record a new RADIUS response from the configured server for a controlled test identity.
Accept all clients in an unrestricted policy without checking RADIUS.
Confirm the test user receives Access-Accept under the configured authentication and shared-secret contract.
Confirm the accepted identity maps to the FortiGate user group and permitted forwarding policy.

Explanation

Correct Answer

A real response proves the request/return network path and server service are reachable.

Access-Accept establishes that the server accepted the authentication transaction, not merely that the IP responds to ping.

Group mapping and policy match are separate from the RADIUS server's authentication result.

Incorrect Answers

A WAN physical link may be up while the RADIUS UDP exchange or server return path fails.

Suppressing error records does not repair authentication and hides proof.

Bypassing authorization does not prove the configured authentication method works.

Question 201

An administrator account is assigned a read-only access profile. Which acceptance test checks both authorized monitoring and denied modification?

Confirm only that the account can successfully log in.
Open the permitted status/log views and attempt a controlled configuration edit that must be rejected for that same account.
Ask the account to browse a public HTTPS website through the FortiGate.
Inspect the WAN link speed.

Explanation

Correct Answer

The profile must satisfy both necessary read operations and the negative write boundary, not just permit a login.

Incorrect Answers

A successful login could still inherit excessive super_admin write access.

Client web browsing does not test administrator RBAC settings.

Physical interface state cannot prove an admin profile restricts edits.

Question 202

After retiring an administrator, how should operations validate that both the disabled AD identity and separately disabled local emergency account no longer grant access?

Only check the AD user status in the directory console.
Confirm the FortiGate can still reach its syslog receiver.
Attempt a controlled fresh login through each prior authentication path and confirm both are rejected while authorized administrators still work.
Test only a previously open administrator GUI session.

Explanation

Correct Answer

Two-path negative testing is needed because offboarding one directory principal may leave a separate local FortiGate account active.

Incorrect Answers

A disabled AD identity does not prove local FortiGate credentials have been revoked.

Remote logging continuity does not test revoked administrator authentication.

An existing session may persist and cannot substitute for testing fresh login authorization.

Question 203

A guest captive-portal policy was introduced. Which controlled result demonstrates users must authenticate before the first allowed web session?

A new unauthenticated guest is redirected or denied until valid portal login, after which only authorized browsing is permitted.
A guest gets a valid IP address from DHCP.
An administrator can log in to the FortiGate GUI.
Web filtering blocks a category for an already-authenticated user only.

Explanation

Correct Answer

Both the pre-auth denial/portal and post-auth access show the policy enforces user identity rather than merely matching an IP.

Incorrect Answers

Address assignment does not prove a user passed captive-portal authentication.

Admin GUI login is different from guest captive-portal authentication.

This tests content policy but not the requirement to authenticate before initial browsing.

Question 204

After expanding LDAP search scope, which result demonstrates that a nested Security-Approvers group is now recognized without granting unrelated permissions?

Authenticate a test user in the nested group and confirm the FortiGate resolves that group while an out-of-group user remains excluded.
Confirm only that the AD server answers ICMP.
Check that every FortiGate admin can write all system settings.
Increase the WAN source-NAT pool size.

Explanation

Correct Answer

A positive member and negative nonmember check validates group resolution rather than only LDAP bind success.

Incorrect Answers

Network reachability does not prove directory search finds the intended nested group.

Universal privileged access violates the group-specific permission requirement.

IP translation cannot correct directory group membership search results.

Question 205

RADIUS authentication succeeds for users, but the FortiGate policy is intended to permit only the `Remote_Engineering` group. Select TWO separate tests that prove the group-mapping fix is not overbroad.

Ping the RADIUS server and skip user-level tests.
Permit every authenticated user in the firewall rule.
Use a known Engineering member and verify an Access-Accept maps to that group and allows the intended policy.
Check only the FortiGate management HTTPS certificate.
Use a known nonmember and confirm authentication alone does not grant access through the Engineering-only policy.

Explanation

Correct Answer

This checks both the returned group identity and authorized forwarding behavior.

The negative case proves a successful RADIUS login is not being mistaken for universal group authorization.

Incorrect Answers

Transport reachability cannot prove group-specific access control.

A universal group bypass would defeat the Engineering-only requirement.

Admin TLS identity does not establish user group mapping after RADIUS success.

Question 206

Windows users successfully authenticate to AD-DC03, but Collector Agent logs show no logon events from DC03 while other DCs feed it normally. DC Agent mode is selected, not direct polling. Which change repairs this missing event source?

Add the user to the firewall administrator profile.
Install and register the supported DC Agent on AD-DC03 and verify its event delivery to the designated Collector Agent.
Create an outbound IPv4 NAT pool for AD-DC03.
Enable web-filter ratings on the first client policy.

Explanation

Correct Answer

DC Agent mode needs an agent on every observed DC; an uninvolved DC cannot forward its logon events simply because another DC has an agent.

Incorrect Answers

Admin GUI privileges do not deliver workstation logon events from DC03.

NAT policy does not substitute for the DC-agent-to-collector notification path.

URL ratings are independent of the absent identity event source.

Question 207

A Collector Agent shows accurate usernames, workstation IPs and logon timestamps but reports no group memberships; the FortiGate group-source mode is Collector Agent. What integration should be checked first?

Enable an additional IPv4 route to the internet.
Replace the endpoint TLS inspection certificate.
Validate the Collector Agent directory group lookup configuration, bind permissions and chosen group list before changing firewall policy order.
Add a more permissive catchall user firewall policy.

Explanation

Correct Answer

The collector has captured user logons; empty groups point to LDAP/directory group resolution or collector group selection, not event collection.

Incorrect Answers

A default route does not resolve AD groups from a recognized logon.

Client HTTPS certificate trust cannot populate collector group memberships.

Granting unidentified users access masks the group-lookup failure rather than restoring identity information.

Question 208

Thirty remote desktop users share a Citrix host address, but some applications are being authorized as the most recently logged-on user. Which identity data should the firewall receive?

Increase the shared host DHCP lease duration.
Use a supported Fortinet TS Agent/session-aware mapping for the shared terminal server, rather than interpreting the host IP as one unique user.
Move the Citrix host to an unrestricted firewall zone.
Reassign all Citrix sessions the same FSSO username.

Explanation

Correct Answer

Many logged-in users share a server IP; TS-agent session information is needed to disambiguate them when applying per-user policy.

Incorrect Answers

Lease duration does not distinguish concurrent users who share an address.

Zone changes bypass identity controls without mapping individual logon sessions.

Collapsing identities reproduces the erroneous user/IP mapping.

Question 209

A support laptop moves from 10.40.3.28 to 10.40.3.91 while its old address is leased to a different employee. The FSSO table still attributes the old IP to the first user. What prevents inherited permissions?

Increase the token bucket for application control.
Keep the old binding indefinitely and lower the firewall log level.
Duplicate the same address into a secondary interface object.
Enable supported Collector Agent workstation verification/refresh and remove stale IP-to-user bindings when the address owner changes.

Explanation

Correct Answer

FSSO associates user and client IP; stale leases can attach a prior employee group to a new address occupant until the mapping is validated and cleared.

Incorrect Answers

Traffic-shaping rates do not update an identity binding.

Suppressing evidence leaves an incorrect authorization principal attached to the address.

Duplicating an old host IP is not proof of its current AD user.

Question 210

An AD team adds DC04 in a branch office. Authentication works but no logons from that site appear in FSSO. DC01–DC03 are monitored successfully. What must the identity team do?

Enable IPS on branch DNS traffic.
Change the client DNS suffix to a web category.
Add DC04 to the configured DC-agent or supported domain-controller polling collection scope and verify event visibility.
Assign every branch employee an administrator account on the firewall.

Explanation

Correct Answer

FSSO collectors do not automatically receive logon events from a previously unmonitored DC just because AD authentication succeeded.

Incorrect Answers

IPS signatures do not subscribe a new domain controller to identity event collection.

Web category metadata has no effect on FSSO DC coverage.

Firewall admin accounts cannot replace the existing Windows SSO identity feed.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 19 - 10 Questions (Last Reviewed 26-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 20 - 10 Questions (Last Reviewed 25-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 21 - 10 Questions (Last Reviewed 24-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 23 - 10 Questions (Last Reviewed 22-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 200

Explanation

Correct Answer

Incorrect Answers

Question 201

Explanation

Correct Answer

Incorrect Answers

Question 202

Explanation

Correct Answer

Incorrect Answers

Question 203

Explanation

Correct Answer

Incorrect Answers

Question 204

Explanation

Correct Answer

Incorrect Answers

Question 205

Explanation

Correct Answer

Incorrect Answers

Question 206

Explanation

Correct Answer

Incorrect Answers

Question 207

Explanation

Correct Answer

Incorrect Answers

Question 208

Explanation

Correct Answer

Incorrect Answers

Question 209

Explanation

Correct Answer

Incorrect Answers

Question 210

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests