Fortinet NSE4_FGT_AD-7.6 Practice Test 22

Question 210

An AD team adds DC04 in a branch office. Authentication works but no logons from that site appear in FSSO. DC01–DC03 are monitored successfully. What must the identity team do?

Enable IPS on branch DNS traffic.
Change the client DNS suffix to a web category.
Add DC04 to the configured DC-agent or supported domain-controller polling collection scope and verify event visibility.
Assign every branch employee an administrator account on the firewall.

Explanation

Correct Answer

FSSO collectors do not automatically receive logon events from a previously unmonitored DC just because AD authentication succeeded.

Incorrect Answers

IPS signatures do not subscribe a new domain controller to identity event collection.

Web category metadata has no effect on FSSO DC coverage.

Firewall admin accounts cannot replace the existing Windows SSO identity feed.

Question 211

FSSO logons and AD groups display correctly in the FortiGate user monitor. A finance firewall policy matches the correct networks but still excludes finance users because its Source User field points to a different group. What is the smallest valid repair?

Raise administrator HTTPS max sessions.
Change a WAN BGP administrative distance.
Reference the appropriate FortiGate user group mapped to the verified FSSO finance group in the intended firewall policy.
Disable SSL inspection across all outbound policies.

Explanation

Correct Answer

Logon collection does not grant forwarding permission by itself: the matching firewall policy must select the same FSSO group recognized for the caller.

Incorrect Answers

Administrative login limits have no effect on forwarding policy group selection.

Routing preference is separate from the policy rejecting the correct user group.

Inspection profile removal does not change the rule source-group mismatch.

Question 212

An employee logs off at 17:00 but a device with the same IP still receives employee-only access afterward; session logs show an old FSSO identity association. Which lifecycle control should be investigated?

Increase web-category quotas for this IP.
Review FSSO logoff and workstation-check detection, aging, and identity-table cleanup so the mapping expires or is removed on logout.
Install another site-to-site IPsec gateway.
Change the profile default monitor action to allow.

Explanation

Correct Answer

FSSO must not treat an obsolete IP-to-user record as a continuing authorization claim after the observed user leaves the workstation.

Incorrect Answers

Category quota changes do not invalidate the obsolete identity entry.

A VPN peer does not detect the employee logoff or remove FSSO sessions.

Broadly relaxing UTM enforcement cannot correct the stale authorization identity.

Question 213

A security team forbids installing agents on Windows domain controllers but can authorize security event log queries with a delegated account. Which documented FSSO source is appropriate?

Deploy an HTTP reverse proxy as an AD domain controller.
Place the default gateway in monitoring-only mode.
Configure a supported agentless Poll Active Directory Server connector with authorized DC event-log access.
Disable authentication on all internal firewall policies.

Explanation

Correct Answer

FortiGate can poll Windows security events directly for user logons; this does not require per-DC agents, but it requires the correct rights and reachability.

Incorrect Answers

Reverse-proxy traffic is not Windows domain security-log collection.

Router state does not provide the logon identities required by FSSO.

Removing the requirement evades, rather than supplies, the desired Windows SSO signal.

Question 214

An AD user belongs to both “Engineering” and “Contractors”. An earlier broad rule permits contractor internet access to sensitive engineering destinations despite a later narrow rule. What FortiGate policy design corrects this?

Put the more specific identity/address/service rule at the effective first-match position and restrict overlapping broad group rules.
Increase Collector Agent polling frequency only.
Enable interface packet capture on the WAN indefinitely.
Disable all logging on the broad policy.

Explanation

Correct Answer

A user can be in multiple groups, so policy ordering and match scope—not a promise of mutually exclusive AD membership—determine the first rule selected.

Incorrect Answers

The user is already correctly identified; polling cannot fix a broad first-match rule.

A packet capture cannot enforce least-privilege source-group policy ordering.

Logging controls visibility, not which identity group can traverse the first matched rule.

Question 215

During a compliance review, an administrator must remove third-party services from all Windows DCs. FSSO must continue using Windows logon data. Which collection mode avoids DC-resident agents?

Replace domain-controller agents with a web-filter URL category.
Use a different FortiOS management certificate while keeping DC Agent mode.
Switch to supported agentless AD event-log polling with a least-privilege account and tested DC connectivity.
Configure a policy-based NAT rule for each AD user.

Explanation

Correct Answer

Polling the directory security logs is the documented alternative to DC Agents; validate log permissions and the appropriate event sources.

Incorrect Answers

URL categories do not report Windows logons.

The management certificate does not remove the DC-resident agent dependency.

NAT mappings cannot substitute for event-log identity collection.

Question 216

The FSSO collector sends correct user/IP mappings but the organization wants its FortiGate to resolve group membership from a separate approved LDAP directory. Which connector-level choice fits this requirement?

Use the FSSO external connector with the Local user-group source and configure the relevant LDAP server/group mappings.
Set the security profile feature set to proxy for every firewall policy.
Make the event collector use the same IP as the FortiGate.
Increase FSSO logon cache retention indefinitely.

Explanation

Correct Answer

FortiOS can receive logon identity from the collector while matching group membership through locally configured LDAP-derived groups; it must not assume the collector supplies those groups.

Incorrect Answers

Flow/proxy inspection does not choose where FSSO group membership is resolved.

IP aliasing is unrelated to the Local group-source choice.

Retention does not make local LDAP group resolution take place.

Question 217

A shared Windows RDS server runs 20 sessions through the same IP, and FortiGate must distinguish user authorizations for those simultaneous sessions. What is the technical reason plain IP FSSO cannot be the only source?

Shared-host IP addresses do not identify individual user sessions; use supported Terminal Server Agent session/port mapping.
A terminal server has no IP address once more than one person signs on.
A firewall can never apply user policy to Citrix or RDS traffic.
TLS certificates identify every RDS user individually without a user mapping.

Explanation

Correct Answer

Identity from a unique client IP is ambiguous on a multi-user terminal host; a TS-aware mapping binds traffic to the appropriate session.

Incorrect Answers

The host keeps its address; the problem is multiple users sharing it.

Supported Terminal Server Agent options exist to distinguish such users.

Transport certificates do not inherently attach outgoing sessions to each Windows user.

Question 218

Collector Agent receives a valid Windows logon with workstation name PC-94, but identity mapping fails because the collector resolves PC-94 to an old address in DNS. What data should the engineer correct?

Fix workstation name resolution and verify the collector maps PC-94 to its current IP before publishing the identity.
Add a broader web application signature.
Raise the default outgoing interface MTU.
Change VPN Phase 2 PFS group.

Explanation

Correct Answer

FSSO collector uses DNS/workstation checks to link a Windows logon to traffic-source IP; stale name resolution assigns the wrong user to packets.

Incorrect Answers

An application signature does not correct the workstation host lookup.

A working network MTU does not repair a stale PC-94 DNS record.

VPN cryptographic settings do not resolve the FSSO IP-to-workstation error.

Question 219

DC05 appears online in agentless FSSO polling, but a test user logon produces no security events in the expected log even locally on DC05. What missing prerequisite is primary?

Reorder the internet firewall NAT pool.
Use a larger FortiOS session table.
Create an antivirus quarantine filter for DC05.
Enable appropriate Windows logon auditing/event generation on DC05, then confirm poller visibility with delegated event-log permissions.

Explanation

Correct Answer

Polling can read only events that Windows records; connector reachability alone cannot create absent logon events.

Incorrect Answers

NAT ordering cannot create Windows Security events on DC05.

Session count has no relation to the domain controller log entries.

Malware scanning is not the audit-policy setting that generates logon events.

Question 220

A wireless captive portal authenticates on a RADIUS server and forwards accounting Start/Stop records to the FortiGate. No Windows domain controller is involved. Which FortiOS identity connector is relevant?

Configure a RADIUS single sign-on connector consuming the approved RADIUS accounting information.
Use a Collector Agent DC-agent connector to invent AD security events.
Use URL filtering alone as proof of portal authentication.
Enable SSH management login on all VLANs.

Explanation

Correct Answer

RADIUS SSO can map authenticated users from accounting records; Windows DC polling would not observe these non-AD portal logons.

Incorrect Answers

No AD DC exists to provide the Windows logon input this connector requires.

A web category rating cannot identify an individual RADIUS user.

Administrative access has no bearing on wireless portal accounting identity.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 20 - 10 Questions (Last Reviewed 25-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 21 - 10 Questions (Last Reviewed 24-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 23 - 10 Questions (Last Reviewed 22-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 24 - 10 Questions (Last Reviewed 21-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 210

Explanation

Correct Answer

Incorrect Answers

Question 211

Explanation

Correct Answer

Incorrect Answers

Question 212

Explanation

Correct Answer

Incorrect Answers

Question 213

Explanation

Correct Answer

Incorrect Answers

Question 214

Explanation

Correct Answer

Incorrect Answers

Question 215

Explanation

Correct Answer

Incorrect Answers

Question 216

Explanation

Correct Answer

Incorrect Answers

Question 217

Explanation

Correct Answer

Incorrect Answers

Question 218

Explanation

Correct Answer

Incorrect Answers

Question 219

Explanation

Correct Answer

Incorrect Answers

Question 220

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests