Fortinet NSE4_FGT_AD-7.6 Practice Test 40

Question 390

Outbound server traffic prefers a static /16 to MPLS, but hosts within 10.50.8.0/24 instead follow BGP toward broadband. The static route has lower distance. What explains the exception?

A firewall interface label named broadband always outranks MPLS.
All BGP routes outrank all static routes regardless of destination prefix.
BGP will automatically reject any route shorter than /32.
A valid more-specific /24 BGP route can win destination lookup over a less-specific /16 static route.

Explanation

Correct Answer

Longest-prefix lookup precedes route preference among different prefix lengths, even when the /16 has a low distance.

Incorrect Answers

Interface names do not determine longest-prefix routing.

Different prefix matches—not protocol alone—explain the /24 over the /16.

BGP can carry network prefixes of differing lengths.

Question 391

An auditing terminal at 10.20.7.15 must send TCP/443 through a dedicated compliance gateway. Other office users must keep ordinary default routing. What routing mechanism is most precise?

Make the whole office default point to compliance WAN.
Use a URL web-filter exception as the gateway.
Turn on ECMP for every default route.
Use a scoped top-down policy route matching the terminal source and TCP service to the compliant gateway.

Explanation

Correct Answer

Policy routing can match source and service, steering only eligible sessions without changing the default for all hosts.

Incorrect Answers

That affects unrelated office devices and violates selective steering.

URL categorization does not implement a source-specific next-hop decision.

Equal-cost splitting cannot guarantee the terminal uses the designated gateway.

Question 392

Two policy routes match TCP/443 from 10.10.0.0/16. A broad rule for all of 10.10/16 is above the new finance-only 10.10.30/24 rule. The finance flows still take the broad route. What causes it?

The finance source must use a longer BGP AS number.
The longest route prefix always reorders policy routes automatically.
FortiGate disables source filtering if TCP uses port 443.
The earlier eligible broad policy route matches first; the intended specific rule must precede it.

Explanation

Correct Answer

FortiOS evaluates policy routes top-down, so a broad rule can shadow a later more-selective rule.

Incorrect Answers

The problem is policy-route ordering, not path-vector neighbor identity.

Policy route list priority is an explicit match order, unlike ordinary FIB longest-prefix lookup.

Policy route rules can match TCP service as well as addresses.

Question 393

For an IPsec backup WAN test, a FortiGate has an installed default via port4, but `get system arp` shows no resolved MAC for the local Ethernet next hop despite repeated probes. Which dependency should be checked?

Change BGP route-map MED for a different prefix.
Validate the port4 IP/netmask, switch VLAN and next-hop L2 adjacency before altering route preference.
Disable certificate inspection on LAN policy.
Add a source NAT rule to the FortiGate management interface.

Explanation

Correct Answer

An Ethernet next hop requires reachable Layer 2 neighbor resolution; a route entry alone cannot forward through an unreachable peer.

Incorrect Answers

BGP path attributes do not repair local ARP resolution.

TLS visibility does not cause Ethernet next-hop ARP to resolve.

NAT cannot supply the missing local next-hop MAC.

Question 394

An administrator checks `get router info routing-table all` in root VDOM and sees a route to 172.30.0.0/16. A packet entering sales VDOM still gets no route. Which diagnostic is decisive?

Assume the root table is globally shared across all VDOMs.
Disable sales VDOM policies and assume routing is thereby created.
Lower the output IPS severity threshold.
Inspect the active route table in the sales VDOM for the packet’s exact destination and required VDOM link path.

Explanation

Correct Answer

FortiOS VDOMs maintain separate forwarding contexts; root’s route does not prove the ingress VDOM has a usable path.

Incorrect Answers

VDOM partitioning means interface and route instances are scoped, not shared automatically.

Removing security policies does not install a route or inter-VDOM link.

Intrusion detection does not populate the sales VDOM route table.

Question 395

A core FortiGate advertises summary 10.80.0.0/16 but dynamically learns several more-specific office /24s. If a /24 withdraws, traffic must not return to the default ISP or loop toward a remote core. What local fallback matches the summary design?

Make a public WAN next hop the guaranteed fallback for 10.80.0.0/16.
Install a blackhole route for the summary behind valid specific internal routes and keep the summary advertisement consistent.
Turn off all longer internal /24 routes when the first /24 disappears.
Use equal-cost HTTP inspection for each /24.

Explanation

Correct Answer

The discard summary catches unmatched space in the announced aggregate while active /24s still win longest-prefix lookup.

Incorrect Answers

That can leak internal aggregate traffic to the ISP during a withdrawal.

Deleting healthy specifics unnecessarily breaks valid reachable offices.

Content inspection cannot prevent a Layer 3 summary loop.

Question 396

Two static default routes satisfy all equal-cost criteria, but a technician runs only one long TCP transfer and sees packets on wan1. They conclude wan2 is broken. What interpretation is correct?

A single TCP connection must be packet-striped over both ECMP gateways.
IPsec Phase 1 must be reset on both WANs to activate ECMP.
Route priority 255 ensures equal cost with priority 5.
One long-lived session can hash to one gateway; test multiple independent flows while confirming both ECMP routes are installed.

Explanation

Correct Answer

FortiOS ECMP selects among gateways using supported flow-distribution rules; a single test session need not appear on both links.

Incorrect Answers

Ordinary session-based forwarding does not guarantee per-packet alternating paths.

IKE state is not the prerequisite for unrelated static ECMP load balancing.

Mismatched priorities would defeat equivalence for equal-cost selection.

Question 397

A service is permitted to cross from VDOM-A to VDOM-B through a configured inter-VDOM link. The link is up but TCP fails. Which TWO independent configuration domains must be validated for the cross-VDOM packet?

Give the customer a higher web-filter category rating.
Verify destination and reverse routing through the proper VDOM link in both VDOM routing contexts.
Verify an appropriately matched allow policy for the forwarded flow in each relevant VDOM.
Make both VDOMs share the same root admin password.
Disable the inter-VDOM interface entirely.

Explanation

Correct Answer

Each VDOM must resolve the destination/return traffic through its own routing table and transit interface.

A connected transit link and routes alone do not bypass per-VDOM traffic policy decisions.

Incorrect Answers

Web category data does not install inter-VDOM routes or permit a denied session.

Administrative credentials are not a packet-routing or security-policy prerequisite.

Removing the only transit path cannot restore flow connectivity.

Question 398

A FortiGate router-on-a-stick port5.200 interface correctly uses VLAN 200. Packet capture shows 802.1Q VLAN 200 frames leaving, but an upstream switch uplink permits only VLAN 300. Which correction belongs on the switch?

Increase FortiGate static route distance for the same prefix.
Permit the intended VLAN 200 on the trunk and ensure its L3 peer is present in that VLAN.
Replace the gateway IP with an unrelated public DNS server.
Enable deep inspection on the VLAN interface.

Explanation

Correct Answer

The FortiGate sends VLAN-tagged frames; the switch must carry that VLAN before a route next hop can be reached.

Incorrect Answers

Routing preference cannot make a switch accept filtered VLAN tags.

A DNS resolver is not an equivalent L3 next hop on the tagged transit segment.

Decryption profiles do not change 802.1Q membership.

Question 399

A dual-homed server replies through a different FortiGate interface than the one that received the SYN. Route lookup for the destination is valid, yet the first packet fails an anti-spoofing reverse-path check. What should be diagnosed?

Increase the model output-token budget.
Give the user more administrative trusted-host entries.
Disable the WAN link merely because its interface description differs.
Compare the source reverse-route/interface with the configured RPF/asymmetric routing behavior, then correct the routing design.

Explanation

Correct Answer

FortiOS may apply source route checks before normal policy acceptance; a valid route to the destination does not prove the source has a consistent return path.

Incorrect Answers

This is IP forwarding/RPF behavior, not generative inference.

Trusted-host settings do not control forwarded RPF decisions.

Name differences do not establish an anti-spoof route mismatch.

Question 400

A migration introduces a new specific 10.60.2.0/24 gateway alongside an existing 10.60.0.0/16 summary route. Which THREE tests distinguish a correct unoverridden /24 forwarding path from a policy-route exception?

Assume a /16 outranks /24 when its distance is numerically lower.
Confirm that the /24 route is active and its intended next hop resolves in the ingress VDOM.
Run a lookup for a 10.60.2.x destination without a matching policy-route override.
Change the web-filter category and treat it as a route lookup test.
Check a representative session debug for a policy-route match before attributing an unexpected gateway to longest-prefix logic.
Delete all default routes before performing a single affected host lookup.

Explanation

Correct Answer

A configured but absent or unresolved route cannot win a lookup.

Testing the targeted destination isolates longest-prefix behavior from source-specific steering.

Policy routing can legitimately override ordinary route selection for selected traffic.

Incorrect Answers

Distance does not overturn a longer active destination prefix.

Content classification has no bearing on prefix selection.

Removing unrelated defaults is unnecessary and disruptive.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 38 - 10 Questions (Last Reviewed 07-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 390

Explanation

Correct Answer

Incorrect Answers

Question 391

Explanation

Correct Answer

Incorrect Answers

Question 392

Explanation

Correct Answer

Incorrect Answers

Question 393

Explanation

Correct Answer

Incorrect Answers

Question 394

Explanation

Correct Answer

Incorrect Answers

Question 395

Explanation

Correct Answer

Incorrect Answers

Question 396

Explanation

Correct Answer

Incorrect Answers

Question 397

Explanation

Correct Answer

Incorrect Answers

Question 398

Explanation

Correct Answer

Incorrect Answers

Question 399

Explanation

Correct Answer

Incorrect Answers

Question 400

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests