Fortinet NSE4_FGT_AD-7.6 Practice Test 34

Question 330

A suspicious ZIP contains many levels of nested compressed files; FortiGate records scan-limit exceeded rather than a malware verdict. What control prevents silent inspection gaps?

Increase web category allowed minutes.
Set supported archive-depth and protocol size handling with an approved block/quarantine decision when inspection limits are exceeded.
Allow every nested archive unconditionally without a log.
Alter BGP local preference to the download server.

Explanation

Correct Answer

Archive recursion and decompression limits can stop a scanner before all members are inspected; operators must choose explicit handling rather than assume deep coverage.

Incorrect Answers

Web usage quota does not expand archive scan coverage.

That hides the precise failure the content policy must control.

Path routing does not change archive decompression limits.

Question 331

A large download now stalls at the browser after moving a client rule to proxy antivirus scanning; session logs show the FortiGate buffering before forwarding content. Which performance analysis is needed?

Increase static-route administrative distance on all WAN paths.
Disable all application session logging permanently.
Measure proxy file buffering/inspection latency and evaluate supported scan mode or limit settings against security and user-delay requirements.
Lower the expiration date of the FortiGate GUI certificate.

Explanation

Correct Answer

Proxy-mode AV can buffer files while making a verdict; the correct tradeoff must measure scan completeness and delay, not disable protection reflexively.

Incorrect Answers

Routing is already functional; proxy file buffering is the observed delay.

Losing logs cannot eliminate buffering and weakens incident evidence.

Management HTTPS identity is not a proxy file-scanning buffer limit.

Question 332

A deployment proposal says flow-based and proxy-based AV can both scan arbitrary SSH file transfers and MAPI traffic in FortiOS 7.6.0. Which verification is required?

Assume a larger AV definition package adds unsupported protocol decoders automatically.
Use web-filter categories as the only malware defense for SSH transfers.
Compare the Fortinet protocol support table for the exact AV inspection modes and choose a supported mode for each required protocol.
Make every service use port 443 without changing the AV mode.

Explanation

Correct Answer

FortiOS proxy and flow AV coverage differs; proxy supports some protocols such as SSH/MAPI that flow AV does not.

Incorrect Answers

Signature freshness cannot turn an unsupported flow-mode protocol into a supported scanner.

Category ratings do not inspect binary file transfers within SSH.

A transport port change does not add protocol coverage.

Question 333

An AV event says “infected file blocked,” but the SOC cannot trace which source, destination, filename and signature caused it. Select TWO controls needed for auditable file-level incident review.

Enable/retain appropriate Antivirus security event details including signature, file and associated source/destination session correlation.
Delete all AV event logs after a block.
When supported/authorized, retain the quarantined artifact or file reference with restricted access and chain-of-custody metadata.
Make the quarantined files publicly browsable.
Use only the firewall administrator GUI last-login timestamp.

Explanation

Correct Answer

File-level security evidence identifies the detected object and traffic, enabling investigation rather than an anonymous block counter.

A controlled quarantine reference allows later verification without redistributing the malicious file to ordinary users.

Incorrect Answers

Removing log evidence prevents correlating the malicious object with its source and action.

Public exposure of malicious content violates containment and evidence handling.

Admin login metadata does not identify the infected file or AV signature.

Question 334

Office-to-DMZ transfers are AV scanned, but DMZ-to-office file downloads use a different accepting policy and are not scanned. What explains the asymmetry?

FortiOS always mirrors UTM profiles across all reverse-direction policies automatically.
The second direction matches a separate firewall policy lacking the relevant AV profile; attach compatible inspection to that actual flow.
DNS recursion must be disabled to scan reverse traffic.
The WAN default route must use a smaller metric.

Explanation

Correct Answer

Forward and reverse business file transfers may be new sessions hitting different policy tuples; a profile attached to one rule does not cover unrelated rules.

Incorrect Answers

Independent policy selection means AV profiles should be verified per matched path.

DNS lookup is not the absent AV security profile on the DMZ-to-office rule.

Network routing alone cannot select the missing inspection profile.

Question 335

A controlled EICAR sample is classified correctly, but the Antivirus event says Monitor and the test download completes. The prevention standard mandates denial. Which AV action should be changed?

Delete the AV signature package to avoid false alarms.
Set the applicable antivirus scan action to Block on the matched policy/profile and retest the sample.
Set all web categories to Allow.
Change the VPN Phase 1 proposals.

Explanation

Correct Answer

Monitor records a detection while allowing traffic. A Block action prevents delivery and produces the required prevention event.

Incorrect Answers

Missing definitions reduce detection and cannot meet the prevention mandate.

URL category policies do not turn monitored AV detections into blocked files.

IKE cryptography does not control AV event actions.

Question 336

An engineer expects a proxy antivirus profile to fully inspect all nested and oversized archives transferred over CIFS. Which limitation must the design acknowledge?

Increase the FortiGate admin session timeout.
Use FSSO logon events as proof every CIFS archive member was scanned.
Change the local interface MTU to the largest supported value.
Check documented proxy CIFS AV limitations for some archives and oversized files and set compensating controls or an explicit disposition.

Explanation

Correct Answer

FortiOS documents proxy CIFS inspection caveats; claiming full coverage without testing file format/size is unsafe.

Incorrect Answers

A GUI session timeout cannot change CIFS antivirus archive processing.

Identity collection says nothing about malware inspection depth.

MTU does not provide the missing archive scanner coverage.

Question 337

A 250 MB file transfers successfully through a profile that usually blocks known malware, and the log shows oversize-pass. What does that evidence actually mean?

The file exceeded the configured AV scan limit and was passed unscanned under the protocol oversize action; reevaluate the risk decision.
The AV engine certified the large file malware-free.
The web category has been reclassified as safe.
The FortiGate had no default route.

Explanation

Correct Answer

An oversize-pass outcome is not a clean scan verdict. The configured size policy controls whether excessive files bypass or are blocked.

Incorrect Answers

A file that bypassed scanning lacks an AV cleanliness verdict.

Category metadata is separate from file scan-limit handling.

The observed successful transfer and oversize event contradict a route outage.

Question 338

FortiGuard Advanced Malware Protection is valid and update servers are reachable, yet AV definitions never download; no firewall policy has Antivirus scanning enabled. Which documented prerequisite should be checked?

Raise the number of available IP pool addresses.
Enable an appropriate AV profile on at least one matching security policy, then verify the signature update task downloads current definitions.
Change SSO group-source mode from Local to Collector Agent.
Disable FortiGuard automatic updates globally.

Explanation

Correct Answer

Fortinet documents that updated AV definitions require at least one policy with an enabled AV security profile; entitlement alone does not satisfy that condition.

Incorrect Answers

NAT pool capacity does not trigger AV definition delivery.

Identity membership source is unrelated to update activation prerequisites.

That makes package freshness worse, not better.

Question 339

A downloaded archive expands to thousands of nested members, making the proxy scanner consume all inspection workers. What control should the security engineer apply?

Configure documented archive recursion/decompression limits and a deliberate block or quarantine handling for content that cannot be safely scanned.
Raise the archive nesting limit to infinity and assume enough memory exists.
Disable every other firewall security profile to make room.
Change DHCP pool start and end address.

Explanation

Correct Answer

Recursive decompression can exhaust memory and time; bounded scanning with explicit fail handling preserves predictable security and availability.

Incorrect Answers

Unbounded decompression invites resource exhaustion and cannot guarantee processing.

Removing unrelated protections is not a principled archive scan risk control.

Client lease scope has no relevance to archive decomposition depth.

Question 340

A proxy AV policy adds 8 seconds to an HTTPS download. WAN packet loss is normal, but scanunit logs show a lengthy file scan. Which metric evidence isolates the bottleneck?

Measure only time to first TCP SYN response.
Correlate file size, proxy buffering/scanunit duration and end-to-end download completion under the selected scan mode.
Count the number of BGP peers on WAN.
Observe only whether the user authenticated with FSSO.

Explanation

Correct Answer

A long scanunit stage tied to file size explains latency beyond the healthy WAN network path; tuning must retain required malware coverage.

Incorrect Answers

A fast handshake does not capture minutes of later file buffering.

Route peer inventory cannot quantify a file-scan service-time increase.

Identity success does not explain proxy antivirus buffering latency.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 32 - 10 Questions (Last Reviewed 13-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 33 - 10 Questions (Last Reviewed 12-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 34 - 10 Questions (Last Reviewed 11-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 330

Explanation

Correct Answer

Incorrect Answers

Question 331

Explanation

Correct Answer

Incorrect Answers

Question 332

Explanation

Correct Answer

Incorrect Answers

Question 333

Explanation

Correct Answer

Incorrect Answers

Question 334

Explanation

Correct Answer

Incorrect Answers

Question 335

Explanation

Correct Answer

Incorrect Answers

Question 336

Explanation

Correct Answer

Incorrect Answers

Question 337

Explanation

Correct Answer

Incorrect Answers

Question 338

Explanation

Correct Answer

Incorrect Answers

Question 339

Explanation

Correct Answer

Incorrect Answers

Question 340

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests