Fortinet NSE4_FGT_AD-7.6 Practice Test 24

Question 230

Following an FSSO logoff-expiration fix, a tester signs out and immediately starts a new restricted application connection from the same workstation. What outcome validates the intended logout revocation?

The FSSO privileged user entry is removed, and the new connection cannot match the privileged user policy.
A previously established TCP connection remains open indefinitely, so the new connection is assumed permitted.
Only a FortiGuard rating cache is cleared.
The firewall accepts the user based solely on the last-known IP even after the logout.

Explanation

Correct Answer

Identity revocation is established by a changed user table and the result of a fresh flow; existing sessions must be managed separately according to policy.

Incorrect Answers

Preexisting session state does not prove newly created sessions were evaluated without an obsolete identity.

Website ratings are not FSSO identity grant records.

This would repeat the stale-identity privilege leak, not demonstrate its closure.

Question 231

An outbound policy uses certificate inspection, and a lab file with a known test signature is downloaded inside HTTPS without antivirus seeing its payload. The endpoint and profile attachment are verified. What inspection mode is missing?

Use an authorized SSL deep-inspection profile on the matching firewall policy so content can be decrypted and inspected.
Increase the HTTPS session timeout while staying in certificate inspection.
Disable FortiGuard signature updates and retry.
Turn on BGP route logging for the egress interface.

Explanation

Correct Answer

Certificate inspection exposes TLS handshake/certificate information but not encrypted response bodies; payload antivirus requires deep decryption, subject to policy and endpoints trusting the inspection CA.

Incorrect Answers

A longer TLS connection does not reveal the encrypted file content to antivirus.

Removing signatures makes file detection less likely and does not add decryption.

BGP logs describe routing, not UTM visibility inside TLS.

Question 232

After SSL deep inspection is enabled, managed laptops see certificate-authority warnings only on intercepted HTTPS sites; ordinary bypassed sites validate. Which trust configuration is missing?

Install the intercepted website certificate as a root CA on FortiGate.
Disable server-certificate validation globally.
Install the approved FortiGate inspection CA public certificate in trusted client root stores and retain the corresponding signing key securely on FortiGate.
Change the web-filter rating category to Monitor.

Explanation

Correct Answer

Deep inspection re-signs intercepted server certificates with a CA selected in the SSL/SSH profile; endpoints must trust that issuing CA to validate the replacement chain.

Incorrect Answers

A leaf website certificate is not the organizational inspection signer for other destinations.

Suppressing server checks weakens TLS security and does not establish correct client trust.

URL category actions do not cause clients to trust the FortiGate-generated issuer.

Question 233

Security wants to block https://example.org/download/bad.exe but allow the same hostname root. The outbound profile only inspects certificate/SNI metadata. Why can the existing profile not reliably evaluate that encrypted path?

SNI and an HTTP URL path are identical during TLS negotiation.
A static route can match application URL paths.
The HTTPS request path is inside encrypted application data; use supported deep inspection with URL filtering where inspection is authorized.
AV signature updates automatically expose encrypted request paths without TLS inspection.

Explanation

Correct Answer

Certificate inspection can evaluate exposed certificate/handshake metadata, not the full encrypted HTTP path. A path-specific rule requires appropriate decryption or another authorized endpoint control.

Incorrect Answers

SNI usually identifies the hostname, not the subsequent encrypted request path.

FortiOS route lookup selects network next hops, not HTTP path strings.

A signature database does not decrypt the TLS application layer.

Question 234

A mobile banking app pins its public certificate and stops working when a corporate FortiGate re-signs it. Enterprise policy explicitly permits banking content to bypass decryption but still requires normal transport access control. Which change is appropriate?

Create a narrowly approved SSL deep-inspection exemption for the banking destination/category while retaining deep inspection for the rest of the policy.
Install the FortiGate inspection CA as a trusted authority only on the firewall.
Allow all destinations on all ports by a new first-match rule.
Disable antivirus and IPS for the whole enterprise indefinitely.

Explanation

Correct Answer

A pinned client rejects a replacement certificate even if the organization trusts its CA. A scoped exemption avoids intercepting that flow without disabling protection globally.

Incorrect Answers

The pinned client compares expected keys; FortiGate local trust cannot override application pinning.

Broad forwarding bypass would weaken unrelated policy enforcement, not just decryption for the specific app.

An app-specific TLS exemption does not require turning off all UTM protections for unrelated traffic.

Question 235

FortiGate 7.6.0 is managed at fw-core.example.net, but browsers warn that its GUI identity is issued by a device default CA rather than a publicly/organizationally trusted issuer. What certificate should protect the admin GUI?

Install an approved server certificate containing fw-core.example.net in SAN and set it as the HTTPS administrative certificate.
Deploy the SSL outbound inspection root CA as the server leaf certificate.
Set all administrator trusted-host restrictions to 0.0.0.0/0.
Change the system DNS resolver to a public IP only.

Explanation

Correct Answer

An admin GUI is a TLS server. A valid trusted leaf certificate with a matching hostname permits administrators to verify the management endpoint.

Incorrect Answers

An inspection CA is not automatically a hostname-valid leaf certificate for GUI HTTPS.

Broadening permitted administrators cannot repair the presented server identity.

Resolution cannot make a certificate chain trusted or a hostname match its SAN.

Question 236

A regulated client policy must reject HTTPS servers with expired chains. A test site presents an expired certificate, but FortiGate still allows the session. What policy setting must be validated?

Set web-filter category action to Monitor for the hostname.
Inspect the SSL/SSH profile invalid-certificate actions and configure expired-certificate blocking for this traffic.
Increase antivirus maximum file size.
Rotate the FortiGate administrator password.

Explanation

Correct Answer

An allow action for expired certificates will pass an invalid upstream identity; enforcing the profile validation action makes this scenario fail closed.

Incorrect Answers

URL-category monitoring does not impose PKI certificate validity checks.

AV scan size does not validate a server leaf certificate expiry timestamp.

An admin credential change does not enforce validation of a remote HTTPS certificate.

Question 237

A browser reports the external HTTPS server omits an intermediate issuer certificate while its root is approved. Which TWO checks are needed to prove and correct the exact chain problem?

Verify the server presents the required intermediate CA certificate chain in the handshake.
Disable all validation for the entire enterprise.
Add a FortiGate static route to the CA subject common name.
Replace the site HTTPS TCP port with a different number.
Confirm the destination certificate chain builds to an approved trusted root after the server-side chain is repaired.

Explanation

Correct Answer

A missing intermediate prevents a relying party from constructing a path from leaf to trusted root.

A successful chain validation proves the intermediate and trust anchor now connect the leaf to the approved issuer.

Incorrect Answers

This conceals the chain failure and accepts untrusted unrelated servers.

A CA subject is not a packet forwarding prefix; routing cannot repair X.509 chain completeness.

A port change does not supply the missing issuer certificate.

Question 238

A team imports only public certificate corp-inspection-ca.pem for a custom signing CA. The FortiGate cannot issue substitute server certificates during TLS interception. What material is required?

Import an authorized local CA certificate with its matching private key in a supported format and select it in the deep-inspection profile.
Export every upstream server private key from the internet.
Increase administrator concurrent session limit.
Create a new VLAN interface with any IP address.

Explanation

Correct Answer

Replacing a remote server certificate requires signing with the configured inspection CA private key; a public certificate alone verifies, but cannot sign.

Incorrect Answers

The FortiGate does not own arbitrary external server private keys; it creates substitute leaf certificates.

Admin sessions do not provide certificate signing capability.

A new network interface does not supply missing CA private-key material.

Question 239

An organization’s policy allows health and personal-privacy websites but prohibits decrypting their content. Users need normal IP/FQDN destination controls to remain effective. How should SSL inspection be configured?

Disable the global firewall policy engine for private destinations.
Import user browser history to a public analytics system.
Exempt approved sensitive web categories or specific destinations within the deep-inspection profile while retaining the appropriate forwarding policies.
Allow all HTTPS traffic from any source regardless of destination.

Explanation

Correct Answer

A scoped SSL exemption leaves traffic subject to permitted network routing and policy but avoids intercepting content where policy forbids it.

Incorrect Answers

The privacy rule concerns decryption, not the ability to bypass network authorization.

Collecting extra sensitive browsing data violates the privacy objective and does not implement an exemption.

A universal forwarding rule is wider than a decryption exemption and negates least privilege.

Question 240

An approved deep-inspection profile is attached to a proxy-mode policy, but a service negotiating TLS over TCP/8443 is not inspected. The profile maps HTTPS only to 443 and Inspect All Ports is disabled. What must change?

Add the supported TLS service port to the profile protocol-port mapping or enable the appropriate inspect-all-ports behavior after testing.
Change the server TLS certificate expiration date.
Enable unrelated FSSO polling on the domain controllers.
Lower the IPv4 route administrative distance.

Explanation

Correct Answer

In proxy inspection, configured protocol ports determine which sessions are inspected when all-port inspection is off. The non-standard TLS port is outside that mapping.

Incorrect Answers

Certificate validity is not the port mapping that prevents the profile from processing TCP/8443.

Identity logon collection cannot add TLS inspection to an unmapped port.

Next-hop preference does not add TCP/8443 to the SSL protocol port list.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 22 - 10 Questions (Last Reviewed 23-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 23 - 10 Questions (Last Reviewed 22-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 24 - 10 Questions (Last Reviewed 21-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests