Fortinet NSE4_FGT_AD-7.6 Practice Test 39

Question 380

A finance terminal connects to 198.51.100.10. The FIB default prefers wan1 but a matching policy route sends source 10.5.5.0/24 TCP/443 out wan2. Which rule applies to this terminal session?

Always use wan1 solely because its default appears in the ordinary routing table.
The matching eligible policy route can steer it to wan2 before ordinary routing-table ECMP is considered.
Use both WANs for each packet independently of the matched policy.
Use the antivirus profile action to choose egress.

Explanation

Correct Answer

Policy routing evaluates source, destination, ingress and protocol/port criteria and can override the regular route for matching flows.

Incorrect Answers

A matching policy route is considered before ordinary ECMP selection.

A deliberate steering match does not mean every session is split across links.

Security inspection profiles do not replace the route-policy decision.

Question 381

A branch cannot use its new static 0.0.0.0/0 route via 203.0.113.1 on port2. The router is actually connected to port1, where L2 is up. Which TWO independent configuration checks are needed before declaring the default valid?

Verify that the configured default gateway is a reachable L3 next hop on its actual subnet.
Bind the default route to the correct port1 egress and verify its IP/subnet addressing.
Increase DNS TTL for all internal clients.
Enable deep SSL inspection on port2.
Change the web-filter category for ISP portals.

Explanation

Correct Answer

A static next hop must resolve on the intended reachable network; a syntactically valid gateway value is insufficient.

The route interface and L3 adjacency must agree; referring to disconnected port2 leaves the next hop unreachable.

Incorrect Answers

DNS caching does not repair a routing next-hop/interface mismatch.

TLS inspection cannot make a misbound static gateway reachable.

Website category decisions are unrelated to forwarding toward the configured gateway.

Question 382

A specific /32 route for 198.51.100.44 was entered in the intended VDOM, but diagnostic lookup still chooses the encompassing /24 route. What evidence should be checked before changing application policies?

Increase the /32 route distance to guarantee its use over the /24.
Remove every policy route from all VDOMs without testing the affected source.
Check the active routing table for the /32 and inspect its disabled state, next-hop resolution and route installation.
Assume the /24 is always more specific because it covers more addresses.

Explanation

Correct Answer

Longest-prefix matching only chooses a more specific route when that route is installed and eligible; an unreachable next hop can prevent its use.

Incorrect Answers

Distance does not make a missing or unresolved route eligible and cannot override a prefix-length mismatch.

Broad removal is unjustified; first determine if the /32 installed and whether any relevant policy route matches.

A /32 is the exact host prefix, but its presence must be verified.

Question 383

A VPN route for 10.77.0.0/16 may disappear when the tunnel fails, and default Internet access must remain available. What route design prevents 10.77/16 traffic from leaking to the ISP on failure?

Add a correctly scoped blackhole route for 10.77.0.0/16 with preference behind the healthy VPN route.
Replace 0.0.0.0/0 with a highest-preference blackhole for all traffic.
Use a DNS sinkhole to direct all routes for 10.77.0.0/16.
Change the VPN encryption algorithm without configuring a fallback route.

Explanation

Correct Answer

The discard route catches traffic for the private prefix only when the preferred tunnel route is absent, preventing fallback to the Internet default.

Incorrect Answers

A default blackhole would also disrupt legitimate Internet destinations.

A DNS filter does not enforce IP forwarding for numeric private addresses.

Cryptography cannot prevent traffic from following a surviving default after the private route disappears.

Question 384

A primary ISP router keeps Ethernet carrier up while losing its upstream transit. Static default wan1 stays selected and internet probes time out despite a good wan2 gateway. What failure-detection control is needed?

Increase the client MTU to make the dead transit recover.
Assign the same default IP gateway to both unrelated ISP interfaces.
Use a supported link-health monitor or SD-WAN SLA to withdraw the unreachable path and select a working backup.
Enable HA heartbeat on the failed WAN as a route monitor.

Explanation

Correct Answer

Monitoring beyond carrier state can remove an active-looking but unusable next hop from route eligibility.

Incorrect Answers

MTU does not fix an ISP route blackhole.

Duplicating a next hop does not establish provider reachability or failure detection.

FGCP heartbeat detects cluster peers rather than end-to-end ISP path health.

Question 385

HR and Finance VDOMs must exchange only a specific service. The Finance VDOM has a route to HR, but there is no inter-VDOM interface link. What is missing from the design?

Add both VDOMs to one web-filter category.
Create an authorized inter-VDOM link and matching per-VDOM routing and accept policies across that link.
Enable global SD-WAN and skip per-VDOM interfaces.
Use the management port as the inter-VDOM next hop.

Explanation

Correct Answer

A VDOM has a separate routing/policy context; a route cannot cross to another without a configured transit connection and per-side policy.

Incorrect Answers

Web profiles cannot construct a Layer 3 transit between isolated routing contexts.

SD-WAN membership does not automatically bridge independently isolated VDOMs.

An out-of-band administrative interface is not the required inter-VDOM data link.

Question 386

A static route points to port3.205 for 10.205.0.0/16. Packets leave tagged VLAN 205, but the connected upstream switch expects VLAN 250 on the trunk. What change corrects the route’s L2 path?

Increase the static route priority value until ARP succeeds.
Make the FortiGate VLAN subinterface and switch trunk agree on the intended 802.1Q VLAN ID.
Enable application-control signatures on VLAN 205.
Allow HTTPS management on the uplink.

Explanation

Correct Answer

The L3 gateway on a tagged subinterface is only reachable when the peer trunk carries the same VLAN.

Incorrect Answers

Route preference cannot repair missing L2 VLAN adjacency to a next hop.

IPS signatures are unrelated to trunk VLAN tagging.

Local admin access settings do not fix 802.1Q tag mismatch for forwarding.

Question 387

A FortiGate route to the customer VLAN is installed and packet capture sees the SYN arrive, but flow debug shows an implicit policy deny before egress. What configuration change addresses this finding?

Lower the BGP local preference on an unrelated neighbor.
Add or correct a narrowly scoped IPv4 forward firewall policy for the actual ingress, egress, addresses and required service.
Use the CPU utilization widget to change static priorities.
Enable HTTPS administrative access on a WAN interface.

Explanation

Correct Answer

Routing only selects where a packet could go; a matched allow policy is independently required to forward it.

Incorrect Answers

The packet already has an appropriate route and is dropped by policy, not BGP choice.

CPU dashboards do not alter the implicit deny result.

A local-in management setting is unrelated to this forwarded session.

Question 388

A FortiGate learns the same /24 from two iBGP peers in the same AS. The network team wants all routers inside its AS to favor one exit while leaving the prefix length identical. What BGP policy attribute is appropriate?

Increase MED on the preferred route as the guaranteed intra-AS preference.
Make the outgoing firewall policy service name shorter.
Disable all neighbors and use only a default route.
Assign an evaluated higher BGP local preference to the preferred exit’s accepted routes.

Explanation

Correct Answer

Local preference propagates within an AS and favors higher values for iBGP exit selection; it is not static prefix-length matching.

Incorrect Answers

MED is a different path attribute, often considered in limited comparison scope and lower value is normally preferred.

Policy object naming does not control BGP path selection.

Removing BGP peering prevents intentional multi-exit route selection.

Question 389

A branch establishes a BGP session and receives UPDATEs, but the required 172.24.6.0/24 never appears in its routing table. A new inbound prefix list denies 172.24.0.0/16. What should be examined?

Lower WAN antivirus scanning aggressiveness.
Correct the inbound route filter and confirm an allowed 172.24.6.0/24 candidate is received and eligible.
Set a higher outbound firewall policy ID.
Enable HTTP cache on the branch.

Explanation

Correct Answer

BGP neighbor establishment does not guarantee every advertised prefix is imported; an inbound deny can suppress a more-specific prefix.

Incorrect Answers

Traffic inspection cannot override a BGP route import filter.

Forwarding-policy IDs do not import denied BGP prefixes.

Caching does not cause a filtered route to be installed.

Question 390

Outbound server traffic prefers a static /16 to MPLS, but hosts within 10.50.8.0/24 instead follow BGP toward broadband. The static route has lower distance. What explains the exception?

A firewall interface label named broadband always outranks MPLS.
All BGP routes outrank all static routes regardless of destination prefix.
BGP will automatically reject any route shorter than /32.
A valid more-specific /24 BGP route can win destination lookup over a less-specific /16 static route.

Explanation

Correct Answer

Longest-prefix lookup precedes route preference among different prefix lengths, even when the /16 has a low distance.

Incorrect Answers

Interface names do not determine longest-prefix routing.

Different prefix matches—not protocol alone—explain the /24 over the /16.

BGP can carry network prefixes of differing lengths.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 37 - 10 Questions (Last Reviewed 08-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 380

Explanation

Correct Answer

Incorrect Answers

Question 381

Explanation

Correct Answer

Incorrect Answers

Question 382

Explanation

Correct Answer

Incorrect Answers

Question 383

Explanation

Correct Answer

Incorrect Answers

Question 384

Explanation

Correct Answer

Incorrect Answers

Question 385

Explanation

Correct Answer

Incorrect Answers

Question 386

Explanation

Correct Answer

Incorrect Answers

Question 387

Explanation

Correct Answer

Incorrect Answers

Question 388

Explanation

Correct Answer

Incorrect Answers

Question 389

Explanation

Correct Answer

Incorrect Answers

Question 390

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests