Fortinet NSE4_FGT_AD-7.6 Practice Test 33

Question 320

After restoring an expired Application Control subscription, how should operations prove both the service entitlement and the endpoint signatures are operational?

Check only that the FortiGate GUI can be opened.
Disable all internet applications to make a block test pass.
Change the DHCP lease server to the FortiGate.
Confirm the license is valid, the current signature database has downloaded, and a known controlled application is recognized and handled by the sensor.

Explanation

Correct Answer

The entitlement is a prerequisite, but an up-to-date definition set and applied sensor log are separate evidence of actual detection.

Incorrect Answers

Management connectivity does not establish application signature update or enforcement.

A universal network deny does not prove the app sensor or licensed signature service works.

DHCP service placement cannot verify FortiGuard entitlement and signatures.

Question 321

A custom App Control signature has been installed for a proprietary handshake. What test demonstrates it distinguishes the proprietary application instead of blocking all traffic on its TCP port?

Block every packet on the port regardless of payload.
Show controlled matching packets trigger the custom app ID/action while unrelated traffic on the same port remains unaffected.
Test only the proprietary app with no unrelated control traffic.
Check only that DNS resolves the custom app hostname.

Explanation

Correct Answer

A custom signature must match the distinctive payload sequence, not merely a shared transport port; positive and negative test vectors validate specificity.

Incorrect Answers

This is a port-only denial and does not demonstrate the signature classification.

A positive-only trial cannot establish the absence of false positives on the shared port.

DNS reachability does not prove the custom application signature executes.

Question 322

The App Control sensor was moved from a DMZ policy to the Corporate-to-WAN rule. Which session evidence confirms the change protects the intended corporate VLAN?

A corporate test flow logs the correct forwarding policy ID and the expected App Control signature block.
The DMZ rule still shows an attached sensor.
The Corporate VLAN receives a DHCP address.
The FortiGate changes primary HA member during the test.

Explanation

Correct Answer

Only a correlation between the originating VLAN policy hit and application signature action proves this specific traffic uses the sensor.

Incorrect Answers

An unrelated policy reference does not cover corporate traffic.

Client addressing alone says nothing about selected security profiles.

A cluster role transition is not App Control enforcement evidence.

Question 323

A new risky category was monitored for two weeks before enabling Block. Which verification avoids accidentally denying critical business apps?

Enable the highest category block across all VLANs without reviewing monitor logs.
Disable UTM logging before enabling Block.
Reconcile monitor events with approved app inventory, then run a targeted block test that still permits documented exceptions.
Check route distance only.

Explanation

Correct Answer

Observed App Control IDs and explicit allow exceptions are evidence of a scoped production rollout, unlike an unexamined category blanket deny.

Incorrect Answers

This ignores the impact data the pilot was designed to gather.

That removes the evidence needed to verify the sensor and diagnose false positives.

Next-hop preference does not identify which applications would match the risk category.

Question 324

After a signature override for an ERP false positive, the SOC needs evidence the exception is narrow. What should it test?

All applications in the category become allowed.
Only the ERP server responds to ICMP ping.
App signature logging is disabled after the change.
ERP traffic is permitted with the intended app ID, but a different known-prohibited app in the same category remains blocked by the sensor.

Explanation

Correct Answer

A positive ERP test and negative prohibited-app test establish that a per-signature exception has not disabled category enforcement.

Incorrect Answers

That indicates a broad category exception rather than the approved ERP signature override.

ICMP reachability does not test App Control signatures or false-positive tuning.

Without logs, the SOC cannot establish which app was identified or blocked.

Question 325

Two services share TCP/443 and the same CDN address. One messaging app must be blocked while a documentation service is allowed. After deploying App Control, what acceptance evidence establishes the discrimination?

Both services are blocked on port 443.
A controlled session to the messenger logs its signature Block, while the document app on the same port remains allowed.
Both services are allowed with no application-identification logs.
A traceroute shows the shared CDN is reachable.

Explanation

Correct Answer

Different outcomes for two applications sharing the same transport destination demonstrate signature-level classification rather than a TCP/443 denial.

Incorrect Answers

A port-based blanket deny violates the permitted documentation requirement.

That does not demonstrate the messenger prohibition.

A network path does not identify applications running inside an HTTPS connection.

Question 326

A branch allows downloads through a policy with only web filtering enabled; a controlled known malware sample reaches clients and produces no AV event. What configuration boundary needs attention?

Increase the web category usage quota.
Change HA device election priority.
Enable a compatible Antivirus profile on the matching firewall policy and appropriate SSL inspection for encrypted file content.
Reassign source NAT to a new public address.

Explanation

Correct Answer

An allow rule with web filtering alone does not invoke virus scanning; HTTPS file content also needs permitted decryption.

Incorrect Answers

URL category time limits cannot inspect malicious file bytes.

Cluster primary selection does not attach an AV security profile.

Source NAT is not the missing malware scanner.

Question 327

A mail gateway must scan attachments over an application protocol supported by the proxy antivirus engine but not by the selected flow-based AV profile (MAPI). What deployment condition matters?

Increase flow-profile signature sensitivity indefinitely.
Reduce the maximum time a mail message can remain open.
Enable a broader web-filter URL category.
Choose a supported proxy-based Antivirus profile and compatible proxy-mode firewall policy for the required protocol.

Explanation

Correct Answer

FortiOS AV coverage is protocol and inspection-mode specific; some protocols such as MAPI are not handled by flow AV.

Incorrect Answers

A flow engine cannot inspect a protocol that mode does not support by using a higher threshold.

Session timeout does not enable missing AV protocol coverage.

Web rating is not MAPI attachment malware scanning.

Question 328

A security policy requires large inbound files to fail closed if FortiGate cannot finish antivirus scanning. An oversized file currently passes with an oversize event. Which policy decision needs correction?

Set a supported oversize Block action and suitable protocol-option thresholds for the actual traffic, then test an oversized sample.
Increase file size without limit and assume it is always fully scanned.
Disable AV logs to hide the oversize event.
Enable DNS tunneling to move the file.

Explanation

Correct Answer

An oversize event means the file exceeded inspection handling limits; when pass is configured, unscanned payload may flow despite AV being attached.

Incorrect Answers

Resource limits still exist; unbounded values do not provide deterministic inspection.

Suppressing evidence does not enforce the fail-closed requirement.

A different protocol path does not implement AV oversize denial.

Question 329

FortiGuard AV entitlement is valid, but the installed definition database date is weeks old after a proxy change. Which dependency should be tested?

Disable antivirus on every policy to trigger freshness.
Increase the SSO Collector Agent group cache.
Validate FortiGuard update-service reachability/proxy settings and scheduled updates; confirm the AV package version advances.
Change the HTTPS certificate SAN of an unrelated internal server.

Explanation

Correct Answer

A valid subscription and packet forwarding do not prove FortiGuard signatures downloaded; the update path is separate from client traffic forwarding.

Incorrect Answers

Removing scanning would weaken protection and does not restore broken updates.

AD group lookup does not deliver AV definitions.

Server identity for another site does not fix FortiGuard update transport.

Question 330

A suspicious ZIP contains many levels of nested compressed files; FortiGate records scan-limit exceeded rather than a malware verdict. What control prevents silent inspection gaps?

Increase web category allowed minutes.
Set supported archive-depth and protocol size handling with an approved block/quarantine decision when inspection limits are exceeded.
Allow every nested archive unconditionally without a log.
Alter BGP local preference to the download server.

Explanation

Correct Answer

Archive recursion and decompression limits can stop a scanner before all members are inspected; operators must choose explicit handling rather than assume deep coverage.

Incorrect Answers

Web usage quota does not expand archive scan coverage.

That hides the precise failure the content policy must control.

Path routing does not change archive decompression limits.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 31 - 10 Questions (Last Reviewed 14-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 32 - 10 Questions (Last Reviewed 13-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 33 - 10 Questions (Last Reviewed 12-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 34 - 10 Questions (Last Reviewed 11-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 320

Explanation

Correct Answer

Incorrect Answers

Question 321

Explanation

Correct Answer

Incorrect Answers

Question 322

Explanation

Correct Answer

Incorrect Answers

Question 323

Explanation

Correct Answer

Incorrect Answers

Question 324

Explanation

Correct Answer

Incorrect Answers

Question 325

Explanation

Correct Answer

Incorrect Answers

Question 326

Explanation

Correct Answer

Incorrect Answers

Question 327

Explanation

Correct Answer

Incorrect Answers

Question 328

Explanation

Correct Answer

Incorrect Answers

Question 329

Explanation

Correct Answer

Incorrect Answers

Question 330

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests