Fortinet NSE4_FGT_AD-7.6 Practice Test 27

Question 260

A service over port 8443 is not being scanned by a proxy-mode SSL profile. A subsequent rule change includes 8443. Which observation demonstrates the problem is fixed?

Show that users can reach HTTPS on TCP/443.
Confirm an AD user group exists in the identity directory.
Read the appliance model name and serial number.
Correlate the matched proxy-policy profile with the TCP/8443 TLS inspection and applicable UTM event for that service.

Explanation

Correct Answer

A rule/profile match and UTM activity for the previously unmapped nonstandard port confirms inspection, not merely network reachability.

Incorrect Answers

Working port 443 does not prove 8443 was added to the inspection port map.

FSSO group state is not evidence that the new TLS service port is processed.

Hardware inventory cannot verify inspection of the intended TCP/8443 flow.

Question 261

A web-filter profile blocks Gambling, and FortiGuard rating works, but office HTTPS traffic continues to reach gambling sites. The client policy has UTM enabled but no web-filter profile assigned. What is missing?

Increase FortiGate administrator idle timeout.
Attach the intended web-filter profile to the first matching client-to-WAN firewall policy and confirm inspection support.
Create a WAN SD-WAN health check.
Set the FSSO collector group source to Local.

Explanation

Correct Answer

A category action stored in an unattached profile cannot affect traffic. The rule that forwards the client session must invoke the web-filter engine.

Incorrect Answers

Admin session controls do not attach URL filtering to forwarded traffic.

A link SLA does not select web categories for a security policy.

Directory group resolution is unrelated to the absent web-filter profile.

Question 262

A production portal is rated Business and the category is allowed, yet HTTPS requests to its login path are blocked. The enabled static URL filter has a wildcard matching the portal domain. What should the engineer inspect?

Set the VPN Phase 2 lifetime to a different value.
Disable all web-filter logging.
Change the FortiGate HA device priority.
Review the matching static URL pattern, its type/action and precedence; narrow the overbroad block while preserving required category policy.

Explanation

Correct Answer

Static URL filters can match an explicit wildcard and impose a block even where the FortiGuard category is permitted.

Incorrect Answers

IPsec rekey intervals cannot alter literal URL filter matches.

Hiding records cannot remove the actual static URL block rule.

Cluster election priority does not change a static URL pattern.

Question 263

A category-based web policy starts returning rating errors after its FortiGuard Web Filtering entitlement expires. A local static URL block still works. What missing dependency explains the category failures?

Replace every client workstation certificate.
Increase the number of firewall sessions.
Restore a valid FortiGuard Web Filtering subscription and verify rating service connectivity and response.
Turn off all user group objects.

Explanation

Correct Answer

FortiGuard cloud category lookup is subscription-dependent; a static local URL match does not demonstrate that remote ratings are licensed or reachable.

Incorrect Answers

Client issuer trust does not renew the FortiGuard web rating subscription.

Connection capacity does not supply rating entitlements or category responses.

Directory membership is not the failed FortiGuard rating service.

Question 264

A policy should block an HTTPS /private/export path but allow /public on the same host. Logs show only domain/SNI because the policy uses certificate inspection. What is required to inspect encrypted path content?

Add only a DNS filter on the domain.
Increase the domain rating confidence score.
Use an authorized deep SSL/SSH inspection profile with compatible URL filtering so the application URL path becomes visible.
Increase the configured outgoing static route distance.

Explanation

Correct Answer

TLS hides request paths beyond the handshake; certificate inspection cannot differentiate two paths on one encrypted host.

Incorrect Answers

DNS controls the hostname resolution and cannot target /private/export separately from /public.

Category confidence does not decrypt a path inside TLS.

Next-hop selection has no HTTPS URL-path inspection semantics.

Question 265

An internal policy now requires access to Social Networking websites while retaining audit logs for that category; the existing FortiGuard web-filter action is Block. Which action satisfies the new rule?

Disable the firewall policy completely.
Set category to Block and shorten session timeout.
Change the category to Monitor in the attached web-filter profile and verify category log events.
Remove all traffic logs and use an implicit allow.

Explanation

Correct Answer

Monitor permits category traffic and records the access; Block denies it, and Allow can be less explicit about monitored use.

Incorrect Answers

A disabled forwarding rule prevents the newly approved access.

A shorter blocked session remains a denial, not monitored permitted access.

Permitting use without the required category audit trail fails the policy.

Question 266

A company must permit invoice.company.example in a category otherwise blocked for office users. Opening the whole category is forbidden. Which web-filter control fits?

Move every browser client to an unrestricted firewall policy.
Disable FortiGuard Web Filtering entitlement.
Change only the server DNS TTL.
Create a narrow approved URL/static or local category override for the exact permitted portal and retain blocking for the general category.

Explanation

Correct Answer

Specific URL or category overrides permit controlled exceptions; changing the whole category to Allow would expose unrelated sites.

Incorrect Answers

A broad policy exception removes more controls than the one approved portal.

Losing category ratings undermines the requirement to keep the category blocked.

DNS caching does not override a category-based web policy action.

Question 267

A business continuity requirement says remote web rating outages must not interrupt approved general browsing, but access must be logged and higher-risk categories still controlled when the rating service works. The active profile currently blocks all rating errors. What option should be evaluated?

Make every FortiGuard category permanently Allow.
Install a new SSL inspection root certificate.
Disable all WAN link health monitoring.
Set Allow websites when a rating error occurs for the scoped web-filter profile, with an explicit risk/monitoring decision.

Explanation

Correct Answer

The profile has a separate rating-error behavior. Allowing rating errors is a documented availability tradeoff, not a change to category actions when ratings are available.

Incorrect Answers

That would remove category controls even while the rating system is healthy.

Certificate trust cannot determine the web-filter rating error policy.

Routing SLA checks do not express web-filter fail-open behavior.

Question 268

A restricted user tests gambling.com and gets access despite a correct blocked category on policy 50. The policy lookup shows the flow matches policy 12, which lacks a web filter. What is the operational cause?

An earlier matching forwarding rule bypasses the filtering profile; scope or reorder the rules so the intended filtered rule governs the traffic.
The FortiGuard category database cannot evaluate any domain.
The VPN remote gateway is unresponsive.
All client browsers reject the FortiGate CA.

Explanation

Correct Answer

FortiOS takes the first effective matching firewall policy. A correctly configured later profile cannot inspect traffic that never reaches its rule.

Incorrect Answers

The diagnosis has a specific earlier rule without web filtering, independent of rating availability.

The requested web flow is already forwarded by policy 12; VPN reachability is not the cause.

A certificate error would not create an earlier unfiltered policy match.

Question 269

An internet policy forwards HTTPS without filtering even though a web-filter profile has been created. Which TWO changes make the configured category controls operational on this rule?

Enable security-profile/UTM inspection on the matching IPv4 forwarding rule and use a supported inspection mode.
Set every FortiGuard category to Allow and remove URL logging.
Change the firewall appliance hostname to the blocked domain.
Bind a web-filter profile whose feature-set mode is compatible with that policy and confirm a controlled category block.
Move the WAN default route without attaching a web profile.

Explanation

Correct Answer

A pure forwarding policy without the required UTM inspection does not invoke the web-filter engine.

The specific profile is applied through the matching policy, and a tested category block proves the inspection is in effect.

Incorrect Answers

This would abandon the required blocking policy instead of enabling it.

Appliance identity does not configure outbound web filtering.

Routing changes cannot replace the missing security-profile binding.

Question 270

FortiGuard labels a legitimate internal vendor portal Shopping and company policy blocks Shopping. The review board authorizes a category correction for that portal only. What is the appropriate control?

Set the whole Shopping category to Allow for all users.
Create and document a web rating override for the specific domain into its approved category, subject to the required FortiGuard licensing.
Disable FortiGuard ratings for the complete firewall.
Install a new DHCP relay at the client VLAN.

Explanation

Correct Answer

Web rating overrides adjust one URL or domain categorization without permitting an entire unwanted category; the approval can be audited.

Incorrect Answers

That is broader than the approved one-site correction.

Removing the service would make other category controls unreliable.

DHCP address assignment does not correct URL categorization.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 25 - 10 Questions (Last Reviewed 20-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 27 - 10 Questions (Last Reviewed 18-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 29 - 10 Questions (Last Reviewed 16-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 260

Explanation

Correct Answer

Incorrect Answers

Question 261

Explanation

Correct Answer

Incorrect Answers

Question 262

Explanation

Correct Answer

Incorrect Answers

Question 263

Explanation

Correct Answer

Incorrect Answers

Question 264

Explanation

Correct Answer

Incorrect Answers

Question 265

Explanation

Correct Answer

Incorrect Answers

Question 266

Explanation

Correct Answer

Incorrect Answers

Question 267

Explanation

Correct Answer

Incorrect Answers

Question 268

Explanation

Correct Answer

Incorrect Answers

Question 269

Explanation

Correct Answer

Incorrect Answers

Question 270

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests