Fortinet NSE4_FGT_AD-7.6 Practice Test 38

Question 370

After replacing a broad IPS sensor with one specific to a mail gateway, what acceptance evidence is necessary to justify the performance change?

Show lower IPS engine resource use under representative traffic while a controlled relevant mail-server exploit signature still triggers.
Only show CPU fell after disabling IPS altogether.
Compare only DHCP lease times before and after.
Use a higher web-filter category quota.

Explanation

Correct Answer

Measured load and relevant signature detection together demonstrate that tuning did not discard the protection the gateway requires.

Incorrect Answers

No IPS means there is no exploit prevention to preserve.

DHCP metrics are unrelated to IPS resource cost and signature hits.

Category minutes do not measure IPS resource cost.

Question 371

A monitored exploit signature was changed to Block under a compliance requirement. Which test proves the effective action actually changed?

The event continues to show Pass/Monitor for the exploit.
All WAN routes disappear during the test.
A safe exploit signature test triggers a Block event on the intended sensor and denies the offending flow while benign control traffic remains allowed.
An unrelated user logs on successfully through FSSO.

Explanation

Correct Answer

The event must show the signature and blocking action, and the connection behavior must agree with that action rather than merely logging a hit.

Incorrect Answers

This is still detection, not the mandated prevention.

A route outage would block unrelated traffic without IPS signature evidence.

Identity acceptance is not IPS exploit blocking evidence.

Question 372

An IPS false-positive rule was exempted for an accounting client. How should the team verify the exception has not disabled other attacks against that server?

Run approved ERP traffic and a separate controlled genuine-attack signature test, confirming ERP passes and the other attack remains blocked.
Disable the entire IPS engine while both tests run.
Verify only that the ERP connects normally.
Change the WAN route for the ERP server.

Explanation

Correct Answer

Paired allow/block outcomes show only the problematic signature was exempted and the sensor still protects against different exploits.

Incorrect Answers

This would make both flows pass and conceal the protection loss.

A positive-only ERP test cannot prove the sensor retained other attack detection.

Routing does not validate an IPS signature exclusion’s scope.

Question 373

A FortiGate downloads IPS packages successfully after an outage, and SOC wants to claim protection from a named new CVE. What verification is still required?

Assume every newly published CVE has a FortiGuard block signature instantly.
Enable all website categories to Allow.
Confirm a relevant FortiGuard IPS signature covering the CVE is installed and active in the sensor applied to the vulnerable service.
Check FortiGate admin login session time only.

Explanation

Correct Answer

A recent package date does not guarantee a specific CVE has a matching signature or that the matching policy actually runs it.

Incorrect Answers

Signature availability can lag publication or require specific supported coverage.

Web category actions do not ensure IPS CVE coverage.

Control-plane login state cannot establish exploit signature availability.

Question 374

An IPS sensor was combined with deep SSL inspection for an HTTPS server. Which observation distinguishes functioning encrypted exploit prevention from a certificate-only rule?

Only the server certificate’s issuer is visible in logs.
All HTTPS traffic fails at certificate validation.
HTTP plaintext reaches a different server successfully.
A controlled encrypted exploit is decrypted and blocked with an IPS signature log, while a benign HTTPS request succeeds under the same policy.

Explanation

Correct Answer

A payload-dependent IPS detection on TLS plus normal benign service is proof of content inspection rather than host or certificate-only denial.

Incorrect Answers

Issuer metadata alone is available to certificate inspection and does not prove request-body analysis.

An untrusted interception CA would break TLS, not demonstrate attack-signature blocking.

A plaintext test does not validate inspection inside this HTTPS service.

Question 375

After deploying an IPS rule on a Modbus/TCP industrial control network, what evidence establishes that it watches the intended OT protocol without disrupting legitimate process messages?

Only a generic HTTP vulnerability signature matches port 80 traffic.
All Modbus traffic is denied regardless of command.
A lab-controlled Modbus exploit signature triggers the configured action while normal function-code traffic stays within the accepted operational envelope.
A WAN dynamic route changes preferred gateway.

Explanation

Correct Answer

Industrial IPS profiles need both protocol-specific detection evidence and safe normal-control operation under realistic device traffic.

Incorrect Answers

HTTP detections do not demonstrate Modbus/TCP decoder coverage.

This would disrupt process operation rather than provide tuned detection.

Routing preference is not evidence of OT protocol IPS inspection.

Question 376

A FortiGate has valid static routes to 10.1.0.0/16 via an MPLS router and 10.1.10.0/24 via a dedicated ERP firewall. An ERP server is 10.1.10.45. Which forward path is selected if no higher-precedence policy route matches?

Forward the ERP flow toward the next hop for 10.1.10.0/24 because its prefix is more specific.
Use the /16 solely because it was configured earlier.
Select the gateway with the smallest interface port number.
Randomly alternate between /16 and /24 gateways.

Explanation

Correct Answer

A longest-prefix match is considered before comparing preference of routes covering different prefixes; the /24 supplies the tightest matching network.

Incorrect Answers

Configuration order does not override a more-specific active route in the routing table.

A port index is not the route lookup preference between overlapping prefixes.

These routes do not form same-prefix ECMP; the more-specific destination owns the lookup.

Question 377

Two FortiOS static routes both target 172.20.0.0/16; an approved primary has distance 5 and a backup has distance 20. Their gateways are reachable. Which route is preferred in the routing table?

Prefer the route with the highest distance because it has greater redundancy.
Use a route with a longer interface description.
Install and prefer the eligible lower-administrative-distance route via the approved primary.
Drop all 172.20.0.0/16 packets until one distance is set to zero.

Explanation

Correct Answer

Distance compares route preference for the same prefix and eligible route source; the lower distance is ordinarily preferred.

Incorrect Answers

Higher distance generally makes a route less preferred, allowing it to remain backup.

Interface labels do not influence administrative distance selection.

Two valid static routes can have unequal distances without a blackhole action.

Question 378

Two static routes share prefix 192.0.2.0/24 and distance 10, but route X has priority 2 and route Y priority 15. Both gateways are live. What is the expected preference?

Route Y because a larger priority number always wins.
Route X, whose priority numeric value is lower, is preferred among these otherwise comparable static routes.
Both routes necessarily load balance, regardless of priority.
Send the flow to the gateway with the lowest IP address.

Explanation

Correct Answer

FortiOS static-route priority is a lower-is-preferred value within equivalent route candidates after distance.

Incorrect Answers

FortiOS defines the opposite numeric ordering for static route priority.

Their different priority values fail the equal-cost criteria for static ECMP.

Gateway address ordering does not determine route priority.

Question 379

A 7.6.0 branch should share new TCP sessions across two equally capable ISP gateways for the same default prefix, not force every packet on a separate path. Which configuration is eligible for static ECMP?

Set two default routes to different priorities to force equal-cost balancing.
Configure active same-prefix static routes with matching distance and priority, then select and test an appropriate supported ECMP distribution method.
Enable two firewall policies to different ports with no matching routes.
Set one next hop to a null blackhole interface.

Explanation

Correct Answer

FortiOS ECMP requires equal prefix and comparable costs and balances eligible flows rather than ignoring route preference.

Incorrect Answers

Different priorities can cause one default to dominate instead of ECMP eligibility.

Accept policies do not alone construct equal-cost routing entries.

A discard route is not a usable equal-cost forwarding gateway for live sessions.

Question 380

A finance terminal connects to 198.51.100.10. The FIB default prefers wan1 but a matching policy route sends source 10.5.5.0/24 TCP/443 out wan2. Which rule applies to this terminal session?

Always use wan1 solely because its default appears in the ordinary routing table.
The matching eligible policy route can steer it to wan2 before ordinary routing-table ECMP is considered.
Use both WANs for each packet independently of the matched policy.
Use the antivirus profile action to choose egress.

Explanation

Correct Answer

Policy routing evaluates source, destination, ingress and protocol/port criteria and can override the regular route for matching flows.

Incorrect Answers

A matching policy route is considered before ordinary ECMP selection.

A deliberate steering match does not mean every session is split across links.

Security inspection profiles do not replace the route-policy decision.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 36 - 10 Questions (Last Reviewed 09-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 370

Explanation

Correct Answer

Incorrect Answers

Question 371

Explanation

Correct Answer

Incorrect Answers

Question 372

Explanation

Correct Answer

Incorrect Answers

Question 373

Explanation

Correct Answer

Incorrect Answers

Question 374

Explanation

Correct Answer

Incorrect Answers

Question 375

Explanation

Correct Answer

Incorrect Answers

Question 376

Explanation

Correct Answer

Incorrect Answers

Question 377

Explanation

Correct Answer

Incorrect Answers

Question 378

Explanation

Correct Answer

Incorrect Answers

Question 379

Explanation

Correct Answer

Incorrect Answers

Question 380

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests