Fortinet NSE4_FGT_AD-7.6 Practice Test 35

Question 340

A proxy AV policy adds 8 seconds to an HTTPS download. WAN packet loss is normal, but scanunit logs show a lengthy file scan. Which metric evidence isolates the bottleneck?

Measure only time to first TCP SYN response.
Correlate file size, proxy buffering/scanunit duration and end-to-end download completion under the selected scan mode.
Count the number of BGP peers on WAN.
Observe only whether the user authenticated with FSSO.

Explanation

Correct Answer

A long scanunit stage tied to file size explains latency beyond the healthy WAN network path; tuning must retain required malware coverage.

Incorrect Answers

A fast handshake does not capture minutes of later file buffering.

Route peer inventory cannot quantify a file-scan service-time increase.

Identity success does not explain proxy antivirus buffering latency.

Question 341

A team wants FortiGate AV to inspect file transfers inside supported SSH traffic. Its current flow-mode AV is configured successfully for HTTP downloads. What compatibility decision is needed?

Keep flow mode and increase the HTTP scan file limit.
Disable SSH and require plaintext telnet transfers.
Set administrator allowaccess SSH on WAN.
Check FortiOS proxy AV support for SSH and use an appropriately configured proxy-mode profile/policy when this protocol inspection is required.

Explanation

Correct Answer

AV protocol coverage is mode-dependent; working flow HTTP scanning does not establish support for SSH file transfers.

Incorrect Answers

HTTP size limits cannot add SSH AV protocol support to flow mode.

Replacing secure transfer with insecure protocols is not a legitimate AV compatibility solution.

Firewall management SSH does not scan forwarded SSH file payloads.

Question 342

The SOC wants to demonstrate that a known EICAR test file was actually blocked by FortiOS AV rather than denied by a network ACL. Which log is most specific?

A DHCP ACK for the source device.
An SSL trust success message only.
An Antivirus security event identifying the test file/signature, block action, matched policy and source session.
A routing table printout at test time.

Explanation

Correct Answer

A content AV log proves the scanner matched a file signature and chose Block; a generic policy deny lacks file-level malware attribution.

Incorrect Answers

Lease allocation gives no evidence about malware detection.

TLS trust shows certificate validation but not the test file was scanned and blocked.

Route existence does not document a virus signature hit.

Question 343

Users downloading from a public DMZ server are protected by an inbound policy, while a separate outbound staff rule has AV enabled. What must security validate for downloads from the published DMZ server?

Assume a FortiGate AV profile applies globally to every passing packet.
Turn off the DMZ route and reenable it after each file.
Use static NAT on every DMZ host as evidence of AV enforcement.
Check which inbound/outbound policy actually matches that transfer and enable an appropriate AV scan on the relevant content-bearing path.

Explanation

Correct Answer

An AV profile on staff internet egress does not automatically apply to a separate public-DMZ forwarding policy.

Incorrect Answers

FortiOS security profiles are attached to specific matched policies.

Disabling connectivity is not a malware inspection method.

Address translation is not the AV scanner.

Question 344

A known harmless antivirus test file is downloaded over HTTPS after the staff policy gets an AV and deep-inspection profile. Which result proves the new protection works?

Every HTTPS website is denied by a new broad firewall Block rule.
Only the FortiGate SSL inspection CA is trusted by the browser.
The FortiGate GUI responds at its management IP.
The test file is detected and blocked by an Antivirus event tied to the intercepted HTTPS session and correct policy ID.

Explanation

Correct Answer

The AV sample is designed for safe testing; a signature-specific block after TLS decryption proves actual content scanning.

Incorrect Answers

Network blocking proves no per-file inspection, violating normal permitted HTTPS access.

Trust alone does not prove the AV profile detected any file.

Management reachability is not egress content inspection.

Question 345

Mail attachments are detected through SMTP proxy inspection, but a new MAPI client path is not scanned under flow AV. What conclusion is appropriate?

SMTP and MAPI are identical packets on the wire.
AV protocol support differs by inspection mode; use supported proxy inspection for the required MAPI path and test the attachment.
Increase an SMTP signature size and assume MAPI is automatically decoded.
Ignore MAPI because client computers already resolve DNS.

Explanation

Correct Answer

FortiOS documents MAPI in proxy AV coverage, not flow AV. A successful SMTP test cannot prove MAPI scanning on another mode.

Incorrect Answers

Different application protocols do not share identical AV coverage merely because both carry mail.

A scan-size adjustment does not add an unsupported protocol decoder.

DNS name resolution says nothing about malware scanning in mail attachments.

Question 346

The security team changes oversize behavior from Pass to Block for large transferred files. What verification establishes that unscannable content no longer passes silently?

Show that a small EICAR sample is blocked by normal AV signature scanning.
Verify only the WAN route next hop.
Disable oversize logging to reduce log storage.
Transfer a controlled file beyond the configured scan threshold and confirm the protocol option blocks it with an oversize-specific log.

Explanation

Correct Answer

A positive oversize-block event demonstrates the configured fail-closed behavior; clean small-file scanning alone does not test this branch.

Incorrect Answers

A normal-size signature test cannot prove large unscannable file handling.

Packet routing cannot establish the oversize action on a content inspection policy.

Suppressing the distinct outcome prevents proof of the required threshold action.

Question 347

An AV signature update proxy was corrected. Which evidence proves the expected antivirus package now runs locally?

A successful web browser visit to an unrelated website.
A current AV engine/signature package version and successful FortiGuard download task, plus a controlled detection for an applicable signature.
A new DHCP lease on a LAN workstation.
A FortiGate administrator password change.

Explanation

Correct Answer

Update job and package metadata verify delivered definitions; a safe detection test establishes that enforcement uses the updated local scanner.

Incorrect Answers

General internet access does not prove AV update service transactions succeeded.

Client addressing cannot establish AV signature freshness.

Management credentials are unrelated to update package installation.

Question 348

An archive exceeds a configured recursion limit and is blocked although no virus signature matches. What evidence should an investigator expect?

A scan-limit/decompression or archive-depth handling event with the configured block action, not an invented malware signature identification.
A valid malware detection name must always appear for every archive limit block.
A FortiGuard URL category block proves file archive depth.
An SD-WAN failover event is sufficient evidence.

Explanation

Correct Answer

An unscannable archive can be denied by a resource/oversize policy independent of a virus verdict; logs should reflect that specific reason.

Incorrect Answers

Archive handling limits can deny data without matching any known virus.

Web classification does not inspect the internal nesting of a downloaded archive.

WAN steering is unrelated to AV archive-depth action.

Question 349

Proxy-mode antivirus creates unacceptable delay on large mail attachments. Select TWO independent steps that quantify the bottleneck and preserve required malware safeguards.

Disable antivirus on every mail policy immediately.
Measure proxy file buffer/scan duration and protocol-specific inspection latency on representative attachment sizes.
Evaluate supported proxy scan mode/limits and policy options against required malware detection before changing them.
Increase FortiGate GUI idle timeout.
Lower all WAN route costs without measuring them.

Explanation

Correct Answer

Stage-level metrics establish whether AV scanning rather than network latency drives the user-visible delay.

A validated scan-mode or threshold change can reduce delay without silently disabling mandated protection.

Incorrect Answers

This removes the security control rather than tuning the observed bottleneck.

Admin session timeouts do not influence proxy attachment scan duration.

Routing metrics cannot prove the proxy scanunit delay has been addressed.

Question 350

A security engineer is choosing flow versus proxy Antivirus for an environment requiring MAPI attachment scanning. Which THREE checks are required to avoid unsupported coverage assumptions?

Confirm MAPI is supported by the selected proxy AV mode, rather than assuming the flow AV feature set includes it.
Treat HTTP AV success as proof all protocols are supported in flow mode.
Apply the matching proxy-based AV profile to a proxy-inspected forwarding policy carrying the mail traffic.
Use a safe representative attachment test to verify scanner detection/action and relevant logs on the real mail protocol.
Enable a different IPsec proposal on the internet gateway.
Rely only on a valid mail server certificate without ever testing attachment inspection.

Explanation

Correct Answer

FortiOS mode/protocol matrices do not show identical protocol support for flow and proxy.

Profile feature-set mode must match the selected firewall inspection mode on the actual traffic path.

An end-to-end file test proves actual protocol decoding and enforcement rather than catalog compatibility alone.

Incorrect Answers

Successful HTTP scanning says nothing about unsupported MAPI or SSH decoding.

VPN encryption parameters do not add antivirus protocol coverage.

Transport trust does not prove malicious file bytes are inspected.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 33 - 10 Questions (Last Reviewed 12-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 34 - 10 Questions (Last Reviewed 11-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 340

Explanation

Correct Answer

Incorrect Answers

Question 341

Explanation

Correct Answer

Incorrect Answers

Question 342

Explanation

Correct Answer

Incorrect Answers

Question 343

Explanation

Correct Answer

Incorrect Answers

Question 344

Explanation

Correct Answer

Incorrect Answers

Question 345

Explanation

Correct Answer

Incorrect Answers

Question 346

Explanation

Correct Answer

Incorrect Answers

Question 347

Explanation

Correct Answer

Incorrect Answers

Question 348

Explanation

Correct Answer

Incorrect Answers

Question 349

Explanation

Correct Answer

Incorrect Answers

Question 350

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests