Fortinet NSE4_FGT_AD-7.6 Practice Test 28

Question 270

FortiGuard labels a legitimate internal vendor portal Shopping and company policy blocks Shopping. The review board authorizes a category correction for that portal only. What is the appropriate control?

Set the whole Shopping category to Allow for all users.
Create and document a web rating override for the specific domain into its approved category, subject to the required FortiGuard licensing.
Disable FortiGuard ratings for the complete firewall.
Install a new DHCP relay at the client VLAN.

Explanation

Correct Answer

Web rating overrides adjust one URL or domain categorization without permitting an entire unwanted category; the approval can be audited.

Incorrect Answers

That is broader than the approved one-site correction.

Removing the service would make other category controls unreliable.

DHCP address assignment does not correct URL categorization.

Question 271

Compliance permits employees to read a vendor documentation site but prohibits uploading form data to its support endpoint. A simple FortiGuard category Block would deny both. What additional control should be investigated?

Block the whole vendor domain regardless of request type.
Change the default gateway MAC address.
Increase the FortiGuard rating lookups per day.
Evaluate the applicable supported web-content/HTTP-method or proxy inspection controls for POST submission on that site, with deep inspection if encrypted payload visibility is required.

Explanation

Correct Answer

Site categories typically classify destination URLs, not whether a particular request method uploads data; method-aware inspection needs suitable profile/mode and TLS visibility.

Incorrect Answers

The business explicitly permits normal browsing and forbids only upload actions.

Layer-2 next-hop identity does not distinguish HTTP POST from GET requests.

More category queries still do not enforce an upload-method constraint.

Question 272

A branch must limit social media category usage by minutes per user, and the administrator sees category usage quota unavailable in the current flow-based web profile. Which capability requirement is being missed?

Add more SD-WAN health probes until the quota control appears.
Lower SSL handshake timeouts for all internet clients.
Create a new static IPv4 route for the category IP ranges.
Use a supported proxy-based web-filter profile and compatible proxy-inspected firewall policy for category usage quota controls.

Explanation

Correct Answer

FortiOS exposes category usage quotas for suitable actions in proxy-based web filtering; flow-only mode does not expose the same profile feature.

Incorrect Answers

Link probing does not enable a proxy-only web feature.

TLS timeout does not implement a per-user category usage quota.

FortiGuard web categories are not a static routing table quota mechanism.

Question 273

The acceptable-use policy requires a browser warning and user acknowledgement before accessing newly tagged high-risk—but not forbidden—sites. Which FortiOS web action is most appropriate?

Use the URL static-filter Block action on every site in the category.
Disable the web filter profile entirely.
Set all applications to an antivirus Quarantine action.
Set the selected web-filter category action to Warning and test the override/acknowledgement behavior in the deployed inspection mode.

Explanation

Correct Answer

A warning presents an interstitial rather than always denying the category; category Block would never permit the documented user acknowledgement flow.

Incorrect Answers

A hard block offers no acknowledgment path for approved users.

Removing the profile would not display the required warning.

AV malware handling is not a web-category user-warning choice.

Question 274

An administrator writes a static URL pattern `*.example.net` intending to block only `/upload` under one vendor domain, but many harmless subdomains are denied. What rule design avoids this?

Increase the certificate validation timeout.
Disable all FortiGuard categories.
Replace the broad domain wildcard with a supported narrower URL pattern/scope and validate its HTTPS path visibility.
Install a new SSO Collector Agent.

Explanation

Correct Answer

A wildcard hostname matches many subdomains; path-level targeting requires an actual path-specific rule and inspection that can see the requested URL.

Incorrect Answers

TLS validation duration has no effect on which URL string the wildcard matches.

Category disablement does not narrow the static URL pattern and harms other protections.

User logon collection cannot narrow a URL pattern match.

Question 275

FortiGuard web ratings sometimes time out, but the subscription is active and other cloud services work. Before renewing licensing unnecessarily, what diagnostic distinction should the operator make?

Reissue the FortiGate SSL inspection private key automatically.
Change the entire web profile to Allow without recording the outage.
Delete every firewall policy and rebuild all networks.
Check current FortiGuard service reachability/response latency and rating error logs separately from actual subscription validity.

Explanation

Correct Answer

A timeout may reflect network or service availability, while an expired entitlement is a licensing condition; both can show rating errors but require different remedies.

Incorrect Answers

CA signing keys are not the FortiGuard rating service transport or entitlement.

This removes intended protection without determining why ratings are late.

A rating-only error does not justify broad unrelated policy deletion.

Question 276

A proxy-based policy blocks exact URL paths for plaintext HTTP, but on HTTPS it blocks only hostnames. TLS certificate inspection is active. Why is the `/secret` path rule not enforced?

Change the FortiGate root admin account name.
Add a higher-priority static route for the website.
The URL path remains encrypted; enable approved deep inspection and compatible URL/static filter in the same effective policy.
Increase the number of website category queries.

Explanation

Correct Answer

Certificate metadata can expose a hostname but not the HTTP path. Path filtering therefore needs suitable TLS content inspection.

Incorrect Answers

Admin identity is not the HTTPS request path decryption boundary.

Network route preference cannot expose encrypted HTTP path bytes.

FortiGuard category lookups cannot decrypt the path within TLS.

Question 277

A network manager switches the Streaming Media category from Block to Monitor for a supervised pilot. Users can stream successfully and category events are generated. Does this indicate filter failure?

Yes. Every monitored category must cause a replacement block page.
Yes. Logging category events proves no category lookup occurred.
Yes. A working stream means the FortiGate forwarded traffic without any policy.
No. Monitor is intended to permit and log the selected category, unlike Block.

Explanation

Correct Answer

The observed permit-with-log is the documented category Monitor behavior; the profile still classifies traffic and records a category event.

Incorrect Answers

A block page corresponds to Block, not Monitor.

A category log is evidence of classification, not its absence.

A permitted monitored flow can still match a controlled firewall rule.

Question 278

A hospital permits IT responders to bypass one blocked category for 20 minutes during incidents, but other employees must remain blocked. Which FortiOS policy capability handles this temporary group-specific bypass?

Reclassify the entire category as globally allowed.
Increase DNS TTL to 20 minutes.
Configure a web profile override for the authorized user group with an approved duration and suitable user authentication.
Disable IPS signatures globally.

Explanation

Correct Answer

A web profile override can grant a bounded alternate profile by user/group/IP and duration. Permanent category recategorization would affect a wider audience.

Incorrect Answers

That removes blocking for users not approved for the 20-minute exception.

DNS caching cannot implement category bypass by user group and time.

IPS is a separate engine and does not set a temporary URL-category profile switch.

Question 279

A newly deployed corporate branch sets a strict fail-closed rule for sites whose web rating lookup fails. One unrated domain is denied although the FortiGuard category itself is not blocked. Which setting likely explains the decision?

The user has no static IPv4 route to the domain.
The domain must belong to every blocked category at once.
The profile disallows websites on FortiGuard rating errors; inspect the rating-options action and associated error log.
The gateway has no local administrator trusted hosts.

Explanation

Correct Answer

A rating failure is distinct from receiving a blocked category. FortiOS can allow or deny the unknown rating depending on profile options.

Incorrect Answers

An SSL web-filter rating-error decision is not evidence of routing failure.

No category rating was returned, so assigning all categories is not justified.

Admin login source policy does not control category rating behavior.

Question 280

A web profile `Staff_WF` is referenced by several rules. A pilot department sees unfiltered browsing, and policy lookup shows its flows hit an earlier rule with `utm-status` disabled. What diagnostic path is most direct?

Increase the antivirus signature count on the appliance.
Check the policy ID selected by the live session and whether that same policy enables UTM and references the intended web profile.
Turn on packet capture of an unrelated HA heartbeat link.
Change FSSO polling frequency without checking policy ID.

Explanation

Correct Answer

FortiOS enforces the inspection stack on the first matching forwarding rule, not a profile merely existing or referenced by later rules.

Incorrect Answers

AV updates cannot cause an earlier rule to attach a missing web profile.

HA heartbeat packets do not identify the client forwarding rule with UTM disabled.

The traffic path already matches a specific unfiltered rule regardless of identity collection.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 26 - 10 Questions (Last Reviewed 19-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 27 - 10 Questions (Last Reviewed 18-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 28 - 10 Questions (Last Reviewed 17-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 29 - 10 Questions (Last Reviewed 16-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 30 - 10 Questions (Last Reviewed 15-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 270

Explanation

Correct Answer

Incorrect Answers

Question 271

Explanation

Correct Answer

Incorrect Answers

Question 272

Explanation

Correct Answer

Incorrect Answers

Question 273

Explanation

Correct Answer

Incorrect Answers

Question 274

Explanation

Correct Answer

Incorrect Answers

Question 275

Explanation

Correct Answer

Incorrect Answers

Question 276

Explanation

Correct Answer

Incorrect Answers

Question 277

Explanation

Correct Answer

Incorrect Answers

Question 278

Explanation

Correct Answer

Incorrect Answers

Question 279

Explanation

Correct Answer

Incorrect Answers

Question 280

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests