Fortinet NSE4_FGT_AD-7.6 Practice Test 23

Question 220

A wireless captive portal authenticates on a RADIUS server and forwards accounting Start/Stop records to the FortiGate. No Windows domain controller is involved. Which FortiOS identity connector is relevant?

Configure a RADIUS single sign-on connector consuming the approved RADIUS accounting information.
Use a Collector Agent DC-agent connector to invent AD security events.
Use URL filtering alone as proof of portal authentication.
Enable SSH management login on all VLANs.

Explanation

Correct Answer

RADIUS SSO can map authenticated users from accounting records; Windows DC polling would not observe these non-AD portal logons.

Incorrect Answers

No AD DC exists to provide the Windows logon input this connector requires.

A web category rating cannot identify an individual RADIUS user.

Administrative access has no bearing on wireless portal accounting identity.

Question 221

A privileged finance user signs out, but an old FSSO IP binding remains active. Which TWO actions together correct the authorization exposure and prove it is closed?

Increase the firewall log retention period while leaving the active mapping intact.
Correct the FSSO logoff/workstation verification or timeout cleanup so the obsolete identity mapping is removed.
Configure a larger NAT pool for users signing off.
Permit the old IP through a generic allow policy during logout transitions.
After logout, validate that the user/IP entry disappears and a fresh connection no longer matches the privileged identity-aware rule.

Explanation

Correct Answer

The stale user/IP association is the access-control root cause; a supported lifecycle change must actually delete or expire it.

A new connection test and identity-table readback establish that privilege no longer follows the address after sign-out.

Incorrect Answers

Longer retention helps investigations but does not revoke the stale authorization.

Source address translation cannot remove the obsolete identity recorded against an IP.

This creates another access path and masks failure to revoke privileged identity.

Question 222

Windows security staff grant a collector network connectivity to DC01 but deny reading its Security log. Agentless FSSO polls the DC without learning any logons. What access must be authorized?

Grant the FortiGate built-in super_admin profile to every AD user.
Grant the polling identity approved Windows Security-event log read rights and confirm that the intended logon events can be retrieved.
Set DNS to a public server for the DC FQDN.
Disable all DC security auditing to reduce event noise.

Explanation

Correct Answer

Agentless FSSO depends on event visibility, not just a TCP session to the domain controller; rights should be scoped to the required audit logs.

Incorrect Answers

FortiGate administration roles do not authorize Windows Security log queries by the collector.

Public DNS cannot substitute for Windows log read rights and may misroute private AD names.

Removing audit events makes the polling source even less usable.

Question 223

A permitted payroll analyst is also a member of a broad “All Staff” group. A broad policy currently appears before payroll-only denies and permits cross-department records. What safeguard is necessary?

Remove all identity-group checks from policies.
Configure both rules to use the same global allow service object.
Disable policy hit logging to simplify the view.
Constrain high-sensitivity source identity/service/destination matching and place the effective specific deny/allow rule above conflicting broad rules.

Explanation

Correct Answer

FSSO group membership is not mutually exclusive. FortiOS matches policy order; explicit scope prevents broad group membership from overriding intended segregation.

Incorrect Answers

This makes a broadly matched network rule less restrictive, not more.

Identical broad services cannot distinguish payroll-only destinations.

Fewer logs do not alter rule precedence or protect restricted records.

Question 224

DC Agent monitoring for DC03 was repaired. The auditor asks for evidence that a new test sign-in on DC03 actually reaches the FortiGate. Which observation provides the strongest proof?

A fresh authenticated FSSO user-to-IP entry with the expected user/domain/group appears in FortiGate user monitoring and matches the collector event.
The Windows domain controller responds to ICMP ping.
The FortiGate web filter blocks a test URL.
The HA secondary reports checksum synchronization.

Explanation

Correct Answer

End-to-end DC event, collector mapping and FortiGate user monitor agreement demonstrates the source now produces usable identities.

Incorrect Answers

Network reachability does not prove that DC-agent logon events were forwarded or mapped.

A web-filter event can occur without any FSSO identity collection.

HA state does not prove identity events arrived from DC03.

Question 225

An employee is in an AD child security group that belongs to an approved parent group. FortiGate sees the employee/IP, but the policy tied to the parent group never matches. What should the engineer examine?

Compare the collector/LDAP effective group lookup against FortiGate group-source configuration and confirm whether the nested parent membership is returned and matched.
Increase session TCP idle timeout.
Disable the firewall policy schedule.
Turn off FortiGuard application control signatures.

Explanation

Correct Answer

A valid logon does not imply every nested group was included; the collected membership source and effective FortiGate group must agree.

Incorrect Answers

TCP session age cannot add a missing LDAP group to an FSSO login record.

An always-open schedule does not repair an identity-group mismatch.

App signature inspection does not resolve nested AD group membership.

Question 226

After implementing supported TS Agent mapping on a Citrix host, two employees concurrently browse from the same public IP but have different permitted app groups. Which observation proves correct isolation?

Each session maps to its own authenticated user and selects the corresponding group-restricted policy despite sharing the terminal server IP.
Both employees share the group of the most recent Citrix login.
The Citrix host resolves to a single DNS address.
Both users can reach any internal server without identity matching.

Explanation

Correct Answer

Per-session mapping preserves distinct identity when source addresses are common; inspecting both users concurrently verifies the TS-specific purpose.

Incorrect Answers

This is the identity-collision defect the TS Agent was meant to eliminate.

A shared source address can coexist with many users and does not demonstrate per-session group resolution.

Broad access does not prove the correct user-specific rule was chosen.

Question 227

A laptop changes network address, and its previous address is immediately reused by a contractor. A refreshed collector appears healthy. What specific user-identity test prevents inherited access?

Verify only that the DHCP server advertises the same DNS servers.
Measure WAN interface throughput.
Check the HTTPS certificate chain of the admin GUI.
Confirm the old address no longer maps to the employee, the contractor obtains only the contractor mapping, and new traffic matches contractor policy.

Explanation

Correct Answer

Successful reassignment requires both removal of the obsolete binding and correct group-based authorization for a new user on the recycled IP.

Incorrect Answers

Correct DNS options do not prove the FSSO table was refreshed when the address was reused.

WAN load does not identify which user the firewall attaches to the reused address.

Management TLS status is independent of client-to-user binding.

Question 228

DC05 has been added to supported FSSO monitoring. During a test login, Windows and Collector Agent show the new logon but FortiGate has no user entry. What downstream path should be examined next?

Reinstall every DC agent on already functioning DC01–DC04.
Remove the SSO security group from all policies.
Change static routes to every internet destination.
Test Collector Agent-to-FortiGate FSSO connector reachability, shared authentication settings and user mapping delivery.

Explanation

Correct Answer

When the DC and collector have the event, the missing stage is downstream delivery into FortiGate rather than Windows event capture.

Incorrect Answers

This leaves the proven DC05→collector source intact and does not focus on missing FortiGate delivery.

Policy group matching occurs after a user mapping exists, so it cannot create the absent FortiGate user entry.

Arbitrary WAN forwarding routes do not prove or repair the collector connector link.

Question 229

The collector correctly reports a sales employee department, and a FortiGate rule was corrected to reference the proper FSSO user group. What is the necessary test result?

A new test flow from that identified user hits the intended group-constrained firewall policy, while a user outside the group is denied.
Both test users see a successful FortiGate GUI login.
The firewall policy logs zero matches during the test.
Every AD user gets the same network entitlement.

Explanation

Correct Answer

Comparing positive and negative test flows verifies that identity group enforcement—not just general network reachability—works.

Incorrect Answers

Administrative GUI login tests a separate control plane and not the intended forwarding identity rule.

No hits cannot confirm the corrected policy selected the authorized flow.

Uniform access would indicate a bypass of the group-specific policy requirement.

Question 230

Following an FSSO logoff-expiration fix, a tester signs out and immediately starts a new restricted application connection from the same workstation. What outcome validates the intended logout revocation?

The FSSO privileged user entry is removed, and the new connection cannot match the privileged user policy.
A previously established TCP connection remains open indefinitely, so the new connection is assumed permitted.
Only a FortiGuard rating cache is cleared.
The firewall accepts the user based solely on the last-known IP even after the logout.

Explanation

Correct Answer

Identity revocation is established by a changed user table and the result of a fresh flow; existing sessions must be managed separately according to policy.

Incorrect Answers

Preexisting session state does not prove newly created sessions were evaluated without an obsolete identity.

Website ratings are not FSSO identity grant records.

This would repeat the stale-identity privilege leak, not demonstrate its closure.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 21 - 10 Questions (Last Reviewed 24-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 23 - 10 Questions (Last Reviewed 22-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 24 - 10 Questions (Last Reviewed 21-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 220

Explanation

Correct Answer

Incorrect Answers

Question 221

Explanation

Correct Answer

Incorrect Answers

Question 222

Explanation

Correct Answer

Incorrect Answers

Question 223

Explanation

Correct Answer

Incorrect Answers

Question 224

Explanation

Correct Answer

Incorrect Answers

Question 225

Explanation

Correct Answer

Incorrect Answers

Question 226

Explanation

Correct Answer

Incorrect Answers

Question 227

Explanation

Correct Answer

Incorrect Answers

Question 228

Explanation

Correct Answer

Incorrect Answers

Question 229

Explanation

Correct Answer

Incorrect Answers

Question 230

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests