Fortinet NSE4_FGT_AD-7.6 Practice Test 36

Question 350

A security engineer is choosing flow versus proxy Antivirus for an environment requiring MAPI attachment scanning. Which THREE checks are required to avoid unsupported coverage assumptions?

Confirm MAPI is supported by the selected proxy AV mode, rather than assuming the flow AV feature set includes it.
Treat HTTP AV success as proof all protocols are supported in flow mode.
Apply the matching proxy-based AV profile to a proxy-inspected forwarding policy carrying the mail traffic.
Use a safe representative attachment test to verify scanner detection/action and relevant logs on the real mail protocol.
Enable a different IPsec proposal on the internet gateway.
Rely only on a valid mail server certificate without ever testing attachment inspection.

Explanation

Correct Answer

FortiOS mode/protocol matrices do not show identical protocol support for flow and proxy.

Profile feature-set mode must match the selected firewall inspection mode on the actual traffic path.

An end-to-end file test proves actual protocol decoding and enforcement rather than catalog compatibility alone.

Incorrect Answers

Successful HTTP scanning says nothing about unsupported MAPI or SSH decoding.

VPN encryption parameters do not add antivirus protocol coverage.

Transport trust does not prove malicious file bytes are inspected.

Question 351

A public DMZ HTTPS server accepts traffic through policy 13 with no IPS sensor; a known exploit pattern reaches the service and appears only in server logs. Which FortiOS security control should protect this path?

Increase the public web server DNS TTL.
Enable a relevant IPS sensor on the effective inbound DMZ-server policy and validate signature coverage for its server protocol.
Change only administrator trusted-host settings.
Configure a separate WAN default route.

Explanation

Correct Answer

A firewall accept alone does not run vulnerability signatures; a tuned IPS sensor on that specific policy is required to detect/prevent known exploit payloads.

Incorrect Answers

DNS caching cannot inspect or block an exploit payload.

Control-plane management login limits do not protect forwarded DMZ application requests.

Route selection does not attach IPS analysis to the server flow.

Question 352

An IPS sensor using every signature is attached to a small DNS-only IoT subnet, overwhelming CPU and logging attacks against protocols the subnet never serves. What tuning is appropriate?

Disable IPS everywhere permanently.
Filter IPS signatures by actual server/client target, protocol, severity and exposure, then load-test attack coverage and resource use.
Increase the user firewall session timeout to hours.
Change the Ethernet duplex setting without checking errors.

Explanation

Correct Answer

FortiOS IPS signature filters are attribute-based; restricting them to relevant services can avoid unnecessary decoder work without discarding targeted prevention.

Incorrect Answers

That loses all attack prevention rather than tuning this subnet.

Longer sessions do not reduce irrelevant signature matching per payload.

Physical link tuning is unrelated to documented excess signature-processing load.

Question 353

A known exploit reliably produces an IPS event, but the target server still receives the malicious request. The matched sensor action is Pass/Monitor. What must change to prevent delivery?

Set an appropriate Block/reset action on the relevant IPS signature or filtered sensor entry and validate it on the service.
Increase only the IPS event retention period.
Move the client to a larger DHCP address pool.
Set the web category of the host to Shopping.

Explanation

Correct Answer

Pass/Monitor detects and logs but does not stop the exploit; prevention requires a blocking action in the effective sensor.

Incorrect Answers

Longer logging does not interrupt malicious traffic.

Address leases cannot turn IPS monitoring into prevention.

Web category classification is not the IPS signature action.

Question 354

A precise IPS signature falsely blocks an approved legacy accounting protocol. Other signatures protect the same network against known exploits. What exception scope is defensible?

Disable the full IPS sensor on all policies.
Permit every application with no threat logging.
Change the server DHCP lease renewal time.
Validate the triggering signature and narrowly override or exclude only that signature for the affected traffic, retaining other IPS detections.

Explanation

Correct Answer

A signature-specific exception removes one proven false positive; a sensor-wide disable would open unrelated vulnerabilities.

Incorrect Answers

This sacrifices other exploit prevention instead of tuning the false-positive signature.

A blanket allow provides no attack signature control or audit evidence.

Lease timing does not change an IPS payload match.

Question 355

The firewall receives current network traffic, but its IPS definitions are six months old and new threat signatures never appear. Which separate control should be investigated?

Increase SSL server certificate validity days.
Check FortiGuard IPS entitlement, scheduled signature update connectivity and installed IPS package version.
Use a larger FortiGate admin trust-host range.
Raise the maximum HTTP request body size indefinitely.

Explanation

Correct Answer

Having an IPS sensor is not proof of current definitions; protection for new vulnerabilities depends on supported update delivery.

Incorrect Answers

PKI expiration does not deliver new IPS signatures.

Broadening management sources has no relationship to vulnerability definitions.

A bigger request limit cannot make a missing CVE signature available.

Question 356

A web-application exploit is transported in encrypted HTTPS request bodies. The firewall uses only SSL certificate inspection and an IPS signature requiring HTTP payload bytes. What prevents this detection?

Switch all HTTPS destinations to port 80 without encryption.
Increase the IPS packet-count threshold.
Change the FortiGate display hostname.
The signature cannot examine the encrypted HTTP body; deploy compatible, authorized deep inspection or a suitable server-side compensating control.

Explanation

Correct Answer

Certificate inspection exposes handshake metadata, but encrypted request payloads remain opaque to signatures that require them.

Incorrect Answers

Replacing TLS with plaintext would be unsafe and does not address controlled inspection.

Thresholds do not decrypt data that the IPS engine cannot inspect.

Device name does not change SSL visibility into attack payload.

Question 357

An isolated manufacturing zone runs Modbus/TCP, while its current IPS sensor includes only generic web-server signatures. Which configuration better matches its actual attack surface?

Enable a broader website shopping category rule.
Apply Windows AD password policies to the Modbus register map.
Use supported OT/industrial protocol signature filters targeted to Modbus/affected asset roles, with safe validation on production-like traffic.
Increase HTTP/2 maximum frame size for all clients.

Explanation

Correct Answer

Industrial control traffic has protocol-specific parsing and operational constraints; a generic HTTP rule set cannot substitute for matching OT signatures.

Incorrect Answers

URL category control does not cover Modbus/TCP command payload exploits.

AD login policies cannot inspect an industrial protocol exploit.

An HTTP/2 setting is not relevant to Modbus/TCP traffic.

Question 358

A known IPS test flow reaches the DMZ server but no sensor event appears. The sensor is on policy 28, while flow debugging shows the session matches earlier policy 5 without IPS. What is the direct cause?

The session never traverses the IPS-equipped rule; correct the effective policy selection and attach the intended sensor where it actually matches.
The test packet must contain an unsupported DNS hostname.
The default route administrative distance is always wrong.
The IPS definition database must contain no signatures.

Explanation

Correct Answer

Only the selected first-match policy applies UTM protections to the session; later sensors do not inspect it.

Incorrect Answers

A clear earlier policy bypass already explains absent IPS enforcement.

Routing can forward successfully while a wrong firewall policy is chosen.

The profile is not invoked at all; signature inventory alone cannot correct the rule mismatch.

Question 359

Following a bulk signature upgrade, CPU spikes only during a flood of repeated failed login attempts, and IPS logs show a high-volume alert signature. What tuning technique targets that load?

Inspect signature event rates and apply appropriate signature-specific rate thresholds/tracking or filtering with validated attack coverage.
Increase interface MTU without testing fragmentation.
Disable every IPS policy and leave attack traffic unchecked.
Change server DNS records to a new address every minute.

Explanation

Correct Answer

FortiOS supports rate-count/duration modes for signatures and filters by attributes; targeted rate tuning can reduce unnecessary event/action churn.

Incorrect Answers

An MTU change does not address repeated signature events under a login flood.

Removing all prevention avoids CPU work but creates an unacceptable security gap.

DNS churn is not a signature rate-limit or IPS process tuning mechanism.

Question 360

A public HTTP service needs vulnerability shielding. A policy-based IPS sensor has only client-side target signatures enabled. Which sensor selection best matches the exposed server?

Use only the client-vulnerability sensor for a server exploit.
Disable the firewall rule to claim IPS protection.
Install a new web-browser homepage in clients.
Include appropriate server-targeted HTTP IPS signatures (or a vetted protect_http_server sensor) on the inbound firewall policy.

Explanation

Correct Answer

IPS signatures have target/client/server and protocol attributes; server HTTP exploitation calls for server-side signature coverage.

Incorrect Answers

Client-targeted checks do not necessarily include server-side HTTP vulnerabilities.

A hard network outage is not a correctly configured server exploit sensor.

Browser defaults have no relationship to IPS sensor target coverage.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 34 - 10 Questions (Last Reviewed 11-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 350

Explanation

Correct Answer

Incorrect Answers

Question 351

Explanation

Correct Answer

Incorrect Answers

Question 352

Explanation

Correct Answer

Incorrect Answers

Question 353

Explanation

Correct Answer

Incorrect Answers

Question 354

Explanation

Correct Answer

Incorrect Answers

Question 355

Explanation

Correct Answer

Incorrect Answers

Question 356

Explanation

Correct Answer

Incorrect Answers

Question 357

Explanation

Correct Answer

Incorrect Answers

Question 358

Explanation

Correct Answer

Incorrect Answers

Question 359

Explanation

Correct Answer

Incorrect Answers

Question 360

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests