Fortinet NSE4_FGT_AD-7.6 Practice Test 4

Question 30

An organization is reordering firewall policies during cleanup. Analysts need to correlate historic traffic with the same policy object after the rule number changes. Which FortiOS log field is better suited for that relationship?

Use the TCP destination port alone as the durable policy identity.
Enable policy UUID information in traffic logs and correlate on the stable policy object identifier rather than only the displayed numeric order.
Use the FortiGate DHCP lease time as the policy reference.
Remove policy identifiers from logging and rely on traffic byte counts.

Explanation

Correct Answer

Policy UUID logging provides an object identity that can be correlated across changed policy ordering better than relying solely on a policy sequence number.

Incorrect Answers

Different policies can allow the same service, so the destination port cannot uniquely identify a policy object.

A DHCP timer is unrelated to the policy object that matched a traffic record.

Byte counts cannot show which security rule permitted a historical session.

Question 31

The security operations team wants email alerts when an IPS attack signature fires, without sending an email for every normal accepted web session. Which FortiOS alert mechanism is appropriate?

Enable log-all on every firewall policy and assume it automatically sends IPS email.
Configure alert-email filtering for IPS/security events with approved recipients and thresholds, and test using a controlled signature event.
Configure NTP and expect every synchronized clock tick to trigger an IPS alert.
Increase FortiGuard license scope without configuring any alert recipient.

Explanation

Correct Answer

FortiOS alertemail supports IPS log triggers; limiting the alert category avoids one email per ordinary forwarded session.

Incorrect Answers

Traffic record production is not equivalent to an alert-email trigger subscription.

Time sync does not generate an IPS attack classification or email notification.

Security service entitlements do not supply the alert-email destination settings.

Question 32

A live firewall session fails, and the packet has no traffic log yet. An engineer needs to see the route and policy decisions made by FortiOS as the packet is processed. Which diagnostic provides that decision trace?

Enable higher FortiAnalyzer storage quota and wait for old sessions to reappear.
Inspect only antivirus signature update timestamps.
Change FortiGate administrative passwords as the first test of a transit packet drop.
Use a narrowly filtered `diagnose debug flow` capture for the test source/destination/service and correlate the policy/route outcome.

Explanation

Correct Answer

Debug flow reveals packet processing and can identify a policy or routing rejection even before the relevant session record is available.

Incorrect Answers

Storage quota does not expose the current packet’s live policy/route evaluation.

A signature update does not indicate the route or firewall rule selected for a particular packet.

Management identity is unrelated to how the forwarding engine evaluated that session.

Question 33

A compliance review asks who changed a FortiGate firewall policy yesterday. The investigator has a set of Forward Traffic logs and local-in HTTPS connection records but no policy-configuration change events. What type of record is missing?

Increase the size of the policy’s forwarded-session log to reconstruct the administrator’s edit.
Collect the relevant System Events / administrator configuration-change audit records so changes can be attributed to an administrative action.
Enable more HTTPS local-in traffic logs and assume every successful TLS session is a configuration edit.
Collect FortiGuard web category ratings to infer which administrator saved the policy.

Explanation

Correct Answer

A login or local-in connection establishes access to the device, but a configuration-change event is required to establish that a policy object was modified.

Incorrect Answers

A traffic session record shows how client packets were handled, not necessarily who edited the policy configuration.

A management session can browse without changing any settings; connection evidence is not a change-audit record.

URL ratings classify destinations and do not identify an administrator’s configuration writes.

Question 34

A FortiGate with a physical log disk has seven-day default local log retention; the incident team must retain 30 days locally where storage permits. What native log setting should be assessed?

Increase the device’s in-memory log buffer and assume this establishes 30-day disk retention.
Enable the DHCP server on the disk management VLAN.
Configure local disk logging retention limits such as maximum-log-age and verify available disk capacity/rotation under Log Settings.
Turn off syslog forwarding and assume the local disk automatically retains every record forever.

Explanation

Correct Answer

The log disk supports age and size controls; retention depends on enabled disk logging and actual capacity, unlike volatile memory buffers.

Incorrect Answers

Memory buffering is transient and does not set on-disk maximum age.

DHCP server operation cannot define disk logging age/rotation.

Disabling remote transport does not change local retention age or disk capacity limits.

Question 35

A FortiGate sends traffic logs to FortiAnalyzer. An operator wants lower event delay for a live SOC view; the setting is currently configured to batch store-and-upload. Which FortiOS remote logging control matters?

Select an appropriate supported FortiAnalyzer upload mode such as realtime and verify delivery latency and downstream load.
Change the IPS signature action from block to pass.
Decrease the DHCP lease time of all branch clients.
Reconfigure the GUI administrator HTTPS port as the only way to speed log delivery.

Explanation

Correct Answer

`config log fortianalyzer setting` includes upload modes such as realtime and scheduled intervals; these affect forwarding cadence, not whether device identity is registered.

Incorrect Answers

The signature action does not set the remote logging upload interval.

Lease length has no bearing on FortiAnalyzer log transport scheduling.

Management port selection does not control FortiAnalyzer realtime logging mode.

Question 36

An analyst enables Resolve Hostnames in the FortiOS log viewer. Log list loading now pauses when a reverse-DNS server becomes slow. Which action best explains the GUI behavior?

Erase all local logs because IP addresses are invalid without hostnames.
Change policy action from deny to accept to restore DNS display speed.
Disable NTP synchronization on all FortiGates.
Disable or repair slow reverse hostname resolution in log-viewer preferences; stored source/destination IPs can still be searched without a PTR lookup.

Explanation

Correct Answer

FortiOS can perform reverse-DNS for display names; an unavailable/slow resolver may delay viewing but does not change underlying logged IP data.

Incorrect Answers

The IP fields are still valid numeric evidence without successful PTR resolution.

Forwarding decision does not repair a slow log-viewer resolver.

Time synchronization and reverse-DNS lookup latency are different subsystem behaviors.

Question 37

Security events arrive on FortiAnalyzer, but an operator enabled a destination log filter severity stricter than the desired informational events. What change is appropriate?

Change the device firmware release number in the GUI without modifying log filters.
Adjust the FortiAnalyzer destination log filter severity/categories to include required events without indiscriminately enabling all traffic.
Disable all IPS profiles to reduce event creation.
Add a VLAN subinterface to the LAN without configuring any logging policy.

Explanation

Correct Answer

The remote filter controls which levels and record categories leave FortiGate for the chosen target; valid but filtered-out records may never arrive.

Incorrect Answers

Firmware display metadata cannot include filtered-out log categories.

Removing inspection reduces useful security events and does not correct the receiving severity filter.

A VLAN interface is unrelated to the configured severity threshold on an established collector.

Question 38

A help-desk operator searches Forward Traffic logs and sees denied sessions, but cannot identify which destination IP and service combination is tied to an incident. Which log-search method gives verifiable correlation?

Search only by the FortiGate hostname and assume every record belongs to the incident.
Filter the stored traffic records on the incident source, destination, service, time range and policy ID, then confirm the action against the actual event.
Use a FortiGuard category list to infer which precise packet the incident involved.
Use only the aggregate daily byte counter to identify the denied destination.

Explanation

Correct Answer

Combining packet tuple fields, policy identity and event time links the reported issue to a specific logged session rather than inferring from policy names.

Incorrect Answers

One device hosts many unrelated sessions; hostname alone is insufficient evidence.

Category identity cannot replace the actual session five-tuple and matched policy.

An aggregate statistic lacks the destination and policy decision of a particular flow.

Question 39

An FGCP cluster is planned with two FortiGate appliances that have identical interfaces but DIFFERENT hardware model identifiers. Both run FortiOS 7.6.0. What blocks creation of a supported cluster?

Change only the HA group name while keeping the two different model types.
Use two compatible members of the same supported FortiGate model and hardware configuration; matching firmware alone is insufficient.
Enable session-pickup to compensate for different appliances.
Add a FortiGuard service contract to the secondary appliance.

Explanation

Correct Answer

The FortiOS 7.6.0 FGCP guide requires same hardware model, equivalent hardware configuration and matching firmware among cluster units.

Incorrect Answers

Matching group identity does not remove the FortiOS hardware model compatibility requirement.

Session synchronization assists failover of compatible members and cannot authorize different-model FGCP membership.

Licensing may be necessary for services but cannot make incompatible hardware members join an FGCP cluster.

Question 40

Two identical FortiGate 7.6.0 units have matching HA group settings but never discover a peer. The primary has heartbeat on port3 and port4, while the cabling connects its port3 to the peer port4 and vice versa. What physical correction is appropriate?

Reconnect port3-to-port3 and port4-to-port4 on matching heartbeat networks, then confirm heartbeat reachability.
Add a forward-traffic allow policy between internal users.
Disable administrator trusted hosts on both units.
Enable antivirus scanning on the cluster uplinks.

Explanation

Correct Answer

FGCP heartbeat interfaces communicate with the same selected heartbeat interface on the other member; cross-connected mismatched ports can prevent peer discovery.

Incorrect Answers

Heartbeat negotiation between FortiGate peers is not a user forwarding session selected by a LAN firewall policy.

Administrator trusted hosts constrain management login sources, not FGCP heartbeat interface pairing.

Content scanning a client session does not fix cross-connected HA heartbeat ports.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 30

Explanation

Correct Answer

Incorrect Answers

Question 31

Explanation

Correct Answer

Incorrect Answers

Question 32

Explanation

Correct Answer

Incorrect Answers

Question 33

Explanation

Correct Answer

Incorrect Answers

Question 34

Explanation

Correct Answer

Incorrect Answers

Question 35

Explanation

Correct Answer

Incorrect Answers

Question 36

Explanation

Correct Answer

Incorrect Answers

Question 37

Explanation

Correct Answer

Incorrect Answers

Question 38

Explanation

Correct Answer

Incorrect Answers

Question 39

Explanation

Correct Answer

Incorrect Answers

Question 40

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests