Fortinet NSE4_FGT_AD-7.6 Practice Test 37

Question 360

A public HTTP service needs vulnerability shielding. A policy-based IPS sensor has only client-side target signatures enabled. Which sensor selection best matches the exposed server?

Use only the client-vulnerability sensor for a server exploit.
Disable the firewall rule to claim IPS protection.
Install a new web-browser homepage in clients.
Include appropriate server-targeted HTTP IPS signatures (or a vetted protect_http_server sensor) on the inbound firewall policy.

Explanation

Correct Answer

IPS signatures have target/client/server and protocol attributes; server HTTP exploitation calls for server-side signature coverage.

Incorrect Answers

Client-targeted checks do not necessarily include server-side HTTP vulnerabilities.

A hard network outage is not a correctly configured server exploit sensor.

Browser defaults have no relationship to IPS sensor target coverage.

Question 361

An entry-level FortiGate protecting only an SMTP gateway cannot keep up with `all_default` IPS at peak load. Which sensor scope reduces irrelevant checks while retaining email-server threats?

Increase the SSL inspection CA validity period.
Turn all FortiGuard updates off permanently.
Disable all SMTP access while leaving an empty sensor.
Use a server-targeted SMTP/IMAP/POP3 appropriate IPS sensor/filter instead of matching every unrelated signature.

Explanation

Correct Answer

A protect_email_server-like signature set selects email server protocols/target and can improve relevance versus broad unrestricted signature coverage.

Incorrect Answers

CA certificate lifetime does not reduce IPS signature decoding workload.

This would lose new vulnerability coverage rather than tune relevant signatures.

An outage does not satisfy the requirement to protect a functioning mail service.

Question 362

An IPS sensor uses signature default actions, and one newly introduced severe exploit signature defaults to Pass due to initial false-positive risk. The organization requires blocking this exploit after testing. Which action is appropriate?

Assume Critical severity always means a default Block action.
Add a targeted sensor override to Block that specific validated signature after assessing false positives.
Increase the number of attack logs retained without changing the action.
Disable the sensor’s matching firewall policy.

Explanation

Correct Answer

Default Pass can intentionally favor monitoring on new broad signatures; a local block override changes the selected prevention decision.

Incorrect Answers

New signatures may initially use Pass despite high severity to manage false positives.

Log retention cannot turn detection into prevention.

Removing legitimate service is not a tuned signature block.

Question 363

An industrial sensor detects a legacy proprietary message as an IPS attack; a single signature ID is confirmed wrong in the lab. Which repair maintains unrelated protections?

Disable all IPS signatures for all VLANs.
Change the web-filter category of the server.
Increase FGCP HA device priority.
Create a narrowly justified exception for the specific signature ID/traffic and verify nearby critical signatures remain enabled.

Explanation

Correct Answer

A single-signature exclusion corrects a false positive without discarding other IPS coverage for the same zone.

Incorrect Answers

Blanket removal would expose unrelated services and protocols.

Website classification cannot change an IPS payload signature match.

Primary election does not tune a per-signature false positive.

Question 364

FortiGuard contract is active and the IPS profile is attached, but a known newly patched CVE has no corresponding signature locally. What update evidence is missing?

Change the interface administrative access ports.
Increase the DHCP relay hop count.
Set every IPS action to Pass.
Inspect the FortiGuard IPS database version and automatic update job success, then evaluate whether the particular CVE signature is available for that release.

Explanation

Correct Answer

An attached sensor cannot use signatures that have not been installed or may not yet exist for the specific attack.

Incorrect Answers

Admin service ports do not install IPS vulnerability definitions.

DHCP relay settings have no impact on signature package availability.

This would reduce prevention rather than address a missing signature.

Question 365

A firewall is required to block a lab HTTPS exploit pattern, but the app request body is encrypted and the currently matched server policy uses certificate-only inspection. Which TWO controls are necessary to enable payload-dependent IPS enforcement?

Apply compatible, authorized deep SSL inspection on the server/client policy path so the required HTTP payload is visible.
Apply an appropriate IPS sensor containing the relevant server-exploit signature and blocking action on that same effective policy.
Set SSL profile to certificate inspection only and claim decrypted payload visibility.
Disable IPS to reduce overhead while promising exploit blocking.
Increase a WAN BGP next-hop preference with no UTM changes.

Explanation

Correct Answer

Certificate-only metadata cannot give the IPS engine encrypted HTTP request-body fields needed by the signature.

Decryption alone is insufficient unless a sensor examines the recovered request and makes an appropriate prevention decision.

Incorrect Answers

Certificate inspection does not expose encrypted request bodies.

Without the sensor there is no IPS prevention decision.

Routing policy does not decrypt or scan encrypted application payloads.

Question 366

A facility operates IEC 61850 MMS but no ordinary HTTP servers on the protected subnet. What IPS profile design is more appropriate than a default web-app exploit rule set?

Block every TCP/80 website category on the subnet.
Install more FSSO DC agents on the manufacturing LAN.
Use only a VPN admin login policy for the OT system.
Enable supported OT signatures/decoders for the actual IEC 61850 MMS services and test protocol safety with operators.

Explanation

Correct Answer

FortiOS has industrial protocol IPS definitions; matching the live OT protocol is necessary for useful detections while limiting false positives.

Incorrect Answers

Web URL classification is not a substitute for an IEC 61850 IPS decoder.

Windows logon collection cannot inspect MMS commands.

VPN authentication does not classify industrial protocol exploits.

Question 367

After a rule reorganization, the SOC cannot tell whether traffic from branch VLAN 30 is processed by the expected IPS sensor. What observation answers that question?

Check only the FortiGate serial number.
Use ping reachability to the destination alone.
Correlate source/destination and firewall policy ID from the test session with the applied IPS profile and a controlled matching signature event.
Read the DHCP lease on an unrelated subnet.

Explanation

Correct Answer

A sensor configuration listing is not evidence that this session traversed it; matched policy and signature-event correlation is.

Incorrect Answers

Appliance identity cannot show whether a specific client session hit a given sensor.

Successful ICMP flow does not prove payload inspection or sensor selection.

Client lease scope is not an IPS event or policy hit record.

Question 368

A signature fires 15,000 times per minute on repetitive failed logins, overwhelming alert handlers. The SOC wants one meaningful detection window rather than one action per packet. Which sensor feature should be evaluated?

Disable all IPS signatures globally.
Increase the browser’s web-filter category quota.
Add an HA heartbeat link with lower priority.
Configure supported signature rate-count/duration and tracking mode, then test an actual attack threshold and false-positive impact.

Explanation

Correct Answer

FortiOS IPS signature rate settings can count matching events per source/destination and set triggering thresholds; tuning should not hide real exploit attempts.

Incorrect Answers

That removes attack detection rather than controlling one noisy event pattern.

Web usage minutes are not IPS attack event frequency thresholds.

Cluster networking does not aggregate IPS signature alert counts.

Question 369

A new server-targeted IPS sensor is attached to a DMZ policy. Which controlled test proves it prevents the originally observed known web attack rather than simply dropping the connection at the network layer?

All HTTP traffic is blocked by a new interface policy.
The web server DNS record resolves correctly.
A safe representative exploit test generates a signature-specific IPS Block event on the matched DMZ policy while benign HTTP remains permitted.
The firewall administrator GUI shows the IPS profile object.

Explanation

Correct Answer

Signature/block logs plus benign control traffic distinguish content IPS enforcement from blanket port denial.

Incorrect Answers

A generic port block denies legitimate service but does not prove IPS signature inspection.

Name resolution says nothing about exploit payload detection.

An object existing does not show it selected the attack packet.

Question 370

After replacing a broad IPS sensor with one specific to a mail gateway, what acceptance evidence is necessary to justify the performance change?

Show lower IPS engine resource use under representative traffic while a controlled relevant mail-server exploit signature still triggers.
Only show CPU fell after disabling IPS altogether.
Compare only DHCP lease times before and after.
Use a higher web-filter category quota.

Explanation

Correct Answer

Measured load and relevant signature detection together demonstrate that tuning did not discard the protection the gateway requires.

Incorrect Answers

No IPS means there is no exploit prevention to preserve.

DHCP metrics are unrelated to IPS resource cost and signature hits.

Category minutes do not measure IPS resource cost.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 35 - 10 Questions (Last Reviewed 10-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 360

Explanation

Correct Answer

Incorrect Answers

Question 361

Explanation

Correct Answer

Incorrect Answers

Question 362

Explanation

Correct Answer

Incorrect Answers

Question 363

Explanation

Correct Answer

Incorrect Answers

Question 364

Explanation

Correct Answer

Incorrect Answers

Question 365

Explanation

Correct Answer

Incorrect Answers

Question 366

Explanation

Correct Answer

Incorrect Answers

Question 367

Explanation

Correct Answer

Incorrect Answers

Question 368

Explanation

Correct Answer

Incorrect Answers

Question 369

Explanation

Correct Answer

Incorrect Answers

Question 370

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests