Fortinet NSE4_FGT_AD-7.6 Practice Test 26

Question 250

A proxy-mode FortiGate policy must inspect internal HTTPS over TCP/8443 and provide trusted replacement server certificates. The SSL profile currently maps only 443 and laptops do not trust the signing CA. Which THREE prerequisites together make this design feasible?

Configure the HTTPS protocol-port mapping to include TCP/8443 on the selected SSL/SSH profile.
Replace the SSL profile with certificate inspection while retaining the need to examine HTTP payloads.
Select a supported FortiGate CA certificate with a usable matching private key for deep-inspection re-signing.
Install the chosen inspection CA public certificate in affected client trust stores.
Allow every invalid upstream certificate unconditionally and rely on the client to block it.
Keep the default 443-only port mapping and increase UTM log retention.

Explanation

Correct Answer

Proxy inspection can skip unmapped TLS ports when inspect-all-ports is disabled.

The firewall must actually sign replacement server certificates for outbound TLS decryption.

Without endpoint trust, clients reject re-signed HTTPS server identities.

Incorrect Answers

Certificate inspection cannot inspect HTTPS application payloads.

Disabling server validation is a separate weakness and does not solve port mapping and CA trust prerequisites.

More logs cannot make an unmapped 8443 service undergo TLS interception.

Question 251

An SSL profile was switched from certificate inspection to deep inspection. The team must prove HTTPS payload scanning works using a safe approved test file. Which evidence is necessary?

Record only that the HTTPS server certificate is trusted.
Count outbound route entries after the test.
Check that FSSO user login timestamps were recorded.
Show the correct matching policy/profile and a controlled HTTPS test-file detection event correlated with the decrypted session.

Explanation

Correct Answer

A content-scanning event tied to the intercepted flow proves payload visibility; merely seeing a TLS handshake cannot establish file-inspection enforcement.

Incorrect Answers

Certificate validation demonstrates a handshake property, not antivirus visibility into the download.

Routing table size does not evidence TLS file inspection.

Identity collection does not prove the AV profile inspected the downloaded payload.

Question 252

A new FortiGate inspection CA is deployed. A browser trust warning persists on one device even though the upstream server certificate is valid and other devices trust the new CA. What device-specific check is decisive?

Inspect the failed endpoint’s trusted root store and the issuer chain of its intercepted leaf certificate.
Rebuild the whole FortiGate routing table.
Disable deep inspection for all departments.
Increase the WAN interface MTU.

Explanation

Correct Answer

A single-client warning with a valid upstream chain strongly implicates missing/wrong endpoint trust of the FortiGate CA.

Incorrect Answers

Routing is already functional; the browser error identifies a TLS trust issue.

A global decryption bypass is much broader than a one-device trust repair.

A usable TLS connection with a certificate warning is not explained by MTU alone.

Question 253

A tester must enforce policy on /admin/config in an HTTPS site while allowing /public on the same domain. Which TWO facts must be established before claiming the FortiGate can enforce that path-level distinction?

Confirm only that the server certificate has the approved issuer.
The matched firewall policy uses a permitted deep-inspection profile and compatible URL control for decrypted HTTP paths.
Set a hostname-wide block for the whole site.
A controlled HTTPS test to both paths shows /admin/config blocked while /public remains permitted.
Increase the number of DNS A records for the hostname.

Explanation

Correct Answer

The path is inside TLS and must be available to the UTM engine to distinguish two URLs on the same host.

A paired positive/negative test proves the intended path-level enforcement instead of host-only blocking.

Incorrect Answers

Issuer identity does not make the encrypted request path visible.

Blocking both paths does not meet the requirement to permit /public.

DNS resolution does not distinguish encrypted URL paths on one host.

Question 254

A pinned mobile app fails only when a FortiGate SSL profile decrypts its TLS sessions. The approved exemption is configured. Which test demonstrates the app’s failure cause and narrowly scoped fix?

Compare the same approved app with deep inspection active versus its exact-FQDN exemption, while confirming other HTTPS traffic stays intercepted.
Verify that the FortiGate can ping the app server.
Raise the app’s DNS TTL to several days.
Turn off all firewall policy UTM across the organization.

Explanation

Correct Answer

Restoration only for the exempt pinned destination isolates re-signing as the cause and verifies the exemption does not disable protection elsewhere.

Incorrect Answers

ICMP reachability does not show whether certificate pinning rejects an intercepted TLS handshake.

DNS cache duration does not determine whether a pinned key matches a replacement certificate.

A global bypass does not test the narrow exemption and sacrifices unrelated protection.

Question 255

A FortiGate GUI certificate is replaced with an approved certificate for firewall-ops.corp. Which acceptance check confirms the management-specific repair?

Confirm that a web-filter rule blocks a gambling site.
Check that IPsec Phase 1 is established.
Increase GUI idle session timeout and assume SAN matching.
Browse the management FQDN and verify the presented leaf SAN, trust chain and expiration without a certificate warning.

Explanation

Correct Answer

Browser chain and hostname checks validate the TLS identity of the admin service independently of outbound SSL inspection policies.

Incorrect Answers

Outbound URL filtering is not a test of the FortiGate GUI server certificate.

IPsec IKE authentication is a different certificate use case.

Session lifetime does not validate hostnames or certificate issuers.

Question 256

An SSL profile is configured to block expired upstream server certificates. A controlled test with an expired site now fails. Which log evidence confirms it was blocked for the intended reason rather than because of a route failure?

A CPU usage graph that spikes during the test.
A successful DNS response for the server name alone.
A firewall administrator login-success event.
An SSL anomaly/certificate-validation log identifies the expired server certificate and block action for the test session.

Explanation

Correct Answer

A certificate-specific UTM log distinguishes expiry enforcement from generic network or DNS connectivity failures.

Incorrect Answers

CPU utilization cannot identify an SSL certificate expiry policy decision.

DNS success says nothing about the subsequent TLS certificate-block reason.

The management plane does not identify the remote server certificate rejection.

Question 257

A server presents a complete, trusted CA chain, but the leaf has been revoked by its issuer. The traffic policy is supposed to reject revoked certificates. Which validation proves this particular threat is blocked?

Measure the TCP handshake round-trip time only.
Reissue the FortiGate admin GUI certificate.
Test and inspect the revocation-status enforcement outcome for the leaf serial, distinguishing it from chain construction success.
Enable more user FSSO group mappings.

Explanation

Correct Answer

A complete issuer path is not the same as non-revocation; status-checking must reject a compromised or revoked leaf even when its chain is intact.

Incorrect Answers

TCP timing cannot distinguish a revoked certificate from a good chain.

The failing identity belongs to the external website, not the management GUI.

AD group lookup does not evaluate TLS revocation status.

Question 258

After rotating its deep-inspection CA, FortiGate starts re-signing successfully. How should engineers verify that endpoints see the approved new issuer rather than an old, untrusted default CA?

Check only the number of IPS signatures installed.
Examine a controlled intercepted site’s browser certificate chain and confirm the issuer matches the approved FortiGate CA that is trusted on the endpoint.
Turn off SSL anomaly logs and infer success from the lack of alerts.
Replace every upstream certificate with the inspection CA certificate.

Explanation

Correct Answer

The presented substitute leaf and endpoint root chain reveal which private-key/certificate pair is being used by inspection and whether the client accepts it.

Incorrect Answers

IPS signature inventory cannot identify the CA that signed an intercepted HTTPS leaf.

Absence of logs is not positive issuer-chain verification.

External services retain their identities; FortiGate creates re-signed client-facing substitutes.

Question 259

Health-sector HTTPS sessions are exempted from FortiGate SSL deep inspection under policy. What evidence shows the exception was applied without opening unrestricted network access?

Verify that all outbound traffic bypasses the FortiGate.
Export decrypted patient application payloads to prove exemption.
Set source address to all and services to all for every policy.
Confirm the specific flow has an SSL-exemption event/no decrypted payload, while the forwarding policy still enforces permitted destinations.

Explanation

Correct Answer

The exemption affects content decryption for identified destinations; normal network-policy decisions and exception logging remain independently testable.

Incorrect Answers

Bypassing the firewall removes required forwarding controls, not just decryption.

Collection of readable health content contradicts the approved no-decrypt objective.

An SSL exemption is not blanket permission for unrestricted access.

Question 260

A service over port 8443 is not being scanned by a proxy-mode SSL profile. A subsequent rule change includes 8443. Which observation demonstrates the problem is fixed?

Show that users can reach HTTPS on TCP/443.
Confirm an AD user group exists in the identity directory.
Read the appliance model name and serial number.
Correlate the matched proxy-policy profile with the TCP/8443 TLS inspection and applicable UTM event for that service.

Explanation

Correct Answer

A rule/profile match and UTM activity for the previously unmapped nonstandard port confirms inspection, not merely network reachability.

Incorrect Answers

Working port 443 does not prove 8443 was added to the inspection port map.

FSSO group state is not evidence that the new TLS service port is processed.

Hardware inventory cannot verify inspection of the intended TCP/8443 flow.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 24 - 10 Questions (Last Reviewed 21-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 27 - 10 Questions (Last Reviewed 18-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 250

Explanation

Correct Answer

Incorrect Answers

Question 251

Explanation

Correct Answer

Incorrect Answers

Question 252

Explanation

Correct Answer

Incorrect Answers

Question 253

Explanation

Correct Answer

Incorrect Answers

Question 254

Explanation

Correct Answer

Incorrect Answers

Question 255

Explanation

Correct Answer

Incorrect Answers

Question 256

Explanation

Correct Answer

Incorrect Answers

Question 257

Explanation

Correct Answer

Incorrect Answers

Question 258

Explanation

Correct Answer

Incorrect Answers

Question 259

Explanation

Correct Answer

Incorrect Answers

Question 260

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests