Fortinet NSE4_FGT_AD-7.6 Practice Test 41

Question 400

A migration introduces a new specific 10.60.2.0/24 gateway alongside an existing 10.60.0.0/16 summary route. Which THREE tests distinguish a correct unoverridden /24 forwarding path from a policy-route exception?

Assume a /16 outranks /24 when its distance is numerically lower.
Confirm that the /24 route is active and its intended next hop resolves in the ingress VDOM.
Run a lookup for a 10.60.2.x destination without a matching policy-route override.
Change the web-filter category and treat it as a route lookup test.
Check a representative session debug for a policy-route match before attributing an unexpected gateway to longest-prefix logic.
Delete all default routes before performing a single affected host lookup.

Explanation

Correct Answer

A configured but absent or unresolved route cannot win a lookup.

Testing the targeted destination isolates longest-prefix behavior from source-specific steering.

Policy routing can legitimately override ordinary route selection for selected traffic.

Incorrect Answers

Distance does not overturn a longer active destination prefix.

Content classification has no bearing on prefix selection.

Removing unrelated defaults is unnecessary and disruptive.

Question 401

An iBGP UPDATE includes 203.0.113.0/24 with next hop 10.10.200.1. Neighbor is Established, prefix passes import filter, but there is no route to the next-hop address. What must be fixed?

Provide a valid resolving route to the BGP next hop, then confirm the received prefix becomes eligible.
Raise the web-filter logging level to Warning.
Disable all BGP prefix filters regardless of which route is missing.
Increase SD-WAN probe frequency only, without changing next-hop reachability.

Explanation

Correct Answer

BGP can receive a prefix but not install it for forwarding when its next-hop is unreachable in the local routing context.

Incorrect Answers

Web filtering does not satisfy a BGP next-hop resolution requirement.

The prefix is already received and permitted; its unresolved next hop is the observed blocker.

Link SLA polling is not the missing BGP next-hop route.

Question 402

A policy route is configured for incoming port1, source 10.9.0.0/16 and destination 192.0.2.0/24. Traffic with those IP addresses arrives instead on port7 and uses normal routing. What explains the behavior?

The route has to be installed from BGP for the policy rule to work.
FortiOS policy routes ignore incoming interfaces by design.
Client DNS always overrides route-policy source conditions.
The input-interface match condition excludes packets arriving on port7, so the policy route does not match.

Explanation

Correct Answer

Policy routes can include incoming interface; an otherwise matching source/destination does not override that condition.

Incorrect Answers

A policy route may choose an outgoing interface/next hop independently of BGP.

Incoming interface is a supported policy routing match field.

DNS resolution does not alter the packet’s physical ingress interface.

Question 403

A test sends 500 TCP connections from one NAT source IP to many destinations. ECMP uses a source-IP-based distribution mode and all sessions leave wan2. Which adjustment makes the evaluation meaningful?

Declare ECMP broken because source-IP hashing must alternate every connection.
Disable the healthy second gateway and retest with the same NAT source.
Use representative distinct source addresses or compare the configured ECMP hashing method; a single source may consistently select one path.
Enable antivirus scan-on-demand to alter routing hashing.

Explanation

Correct Answer

Source-IP hashing can map all flows from one apparent source to the same gateway even with both ECMP paths active.

Incorrect Answers

The chosen algorithm need not vary with a destination when only source IP is used.

Removing a path cannot verify balancing across available gateways.

Content scanning does not change the ECMP source hashing input.

Question 404

A policy route for finance traffic specifies gateway 192.0.2.254 on port6. Normal default via wan1 works, but only finance traffic stalls; ARP on port6 never resolves that gateway. What is the correct focus?

Replace the working default route on wan1 with a blackhole.
Increase IPsec Phase 2 lifetime for an unrelated tunnel.
Raise browser session timeout for finance users.
Fix the policy route’s port6 gateway reachability or remove the invalid match, not the healthy default route.

Explanation

Correct Answer

A selectively matched policy route can override ordinary routing and forward toward its own unreachable next hop.

Incorrect Answers

That broad change would interrupt unaffected traffic.

This is a policy-routing adjacency fault rather than IKE rekey behavior.

Management session timers do not make the policy-route gateway reachable.

Question 405

After re-enabling a trunk, a FortiGate connected static route’s next hop becomes reachable. What evidence establishes actual forwarding rather than relying only on link-up?

Show the intended route installed, verify ARP/neigh resolution and confirm a test packet exits toward the correct gateway.
Read the FortiGuard web-filter license expiration date.
Validate only that the local interface description contains WAN.
Check that a policy banner appears at GUI login.

Explanation

Correct Answer

Layer-1 carrier is not proof of L3 next-hop availability or actual use; route and packet evidence are required.

Incorrect Answers

License state does not prove a gateway has a resolved L2 neighbor.

Interface labels do not prove reachability or the selected route.

An administrative banner is unrelated to data-plane forwarding.

Question 406

An exfiltration source IP 203.0.113.77 must be made unreachable while the rest of 203.0.113.0/24 remains via the existing upstream. Which route-level exception is precise?

Install a higher-specificity /32 blackhole for 203.0.113.77, leaving the /24 route active for other addresses.
Replace the complete /24 route with a blackhole.
Increase route distance on the /24 and hope only one host is blocked.
Delete the firewall’s entire policy table.

Explanation

Correct Answer

Longest-prefix lookup makes the exact-host discard entry affect only that IP, not the whole subnet.

Incorrect Answers

That would discard unrelated destinations within the /24.

Distance is compared for matching route candidates and does not isolate a single IP.

Broad policy deletion is unnecessary and can produce wider outages.

Question 407

The FortiGate has a blackhole 10.201.0.0/16 behind active /24s. A packet to unused 10.201.99.10 is discarded, but ordinary policy deny logs are absent. What component can explain this observation?

The default route must be broken for all Internet traffic.
The SSL inspection profile blocks only unknown destinations.
An HA heartbeat member election filters these packets.
The most-specific eligible route for that unused destination is the /16 blackhole, which drops forwarding before an ordinary egress session exists.

Explanation

Correct Answer

A route-level discard is not the same as a matched deny policy and can appear differently in route/flow diagnostics.

Incorrect Answers

A scoped blackhole for private /16 does not imply global default loss.

SSL profiles are not the configured discard route mechanism.

FGCP peer election is unrelated to private-prefix blackholing.

Question 408

An ISP recovers but exhibits repeated 1-second packet-loss spikes. A branch wants failover recovery only after stable health, not rapid oscillation between WAN routes. Which validation is suitable?

Use supported health-monitor recovery/failure thresholds and observe sustained successful probes before restoring the preferred route.
Disable all health checks and trust Ethernet carrier.
Raise firewall session timeouts without monitoring the uplink.
Switch all traffic to a permanent blackhole despite two working providers.

Explanation

Correct Answer

SLA health-based route eligibility should require stable recovery when configured; oscillating on single transient probes causes flapping.

Incorrect Answers

Carrier may remain up during upstream outages and would defeat the failure objective.

Session timers cannot measure WAN path health.

A blackhole is not a resilience strategy for recovered Internet access.

Question 409

A finance VDOM can now ping an inter-VDOM transit endpoint, yet an HR-to-finance HTTPS application still times out. Which acceptance test validates the end-to-end flow?

Trace the HTTPS session across each VDOM’s forwarding policy and reciprocal routing to confirm data and return packets use the intended inter-VDOM path.
Check whether the inter-VDOM link’s GUI description matches the ticket.
Enable public FortiGuard category allow for all sites.
Compare the HA device serial numbers only.

Explanation

Correct Answer

A link ping only proves local adjacency; the actual TCP service needs appropriate per-VDOM policies and reverse routes.

Incorrect Answers

An object name does not prove L4 access or return path.

Web category changes do not establish routing/policy across the VDOM link.

Hardware inventory cannot validate this cross-VDOM HTTPS service.

Question 410

A retailer has two internet transports: fiber costs 12 units and LTE costs 3. Both pass required latency and jitter targets in normal conditions. The CFO wants the cheaper eligible transport without selecting it during quality failure. Which SD-WAN rule fits?

Use source-IP ECMP without an SLA.
Always bind the policy to fiber only.
Use Lowest Cost (SLA) with the documented quality thresholds and member costs.
Choose a web-filter action of Monitor for LTE.

Explanation

Correct Answer

Lowest Cost (SLA) selects the lower-cost eligible member among those meeting the relevant SLA; it is not a blind cost comparison when quality is poor.

Incorrect Answers

Static ECMP can distribute flows but does not ensure each chosen path meets application quality limits.

A fixed fiber egress ignores the lower-cost healthy LTE option.

Content filtering has no role in SD-WAN cost-aware member selection.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 39 - 10 Questions (Last Reviewed 06-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 43 - 10 Questions (Last Reviewed 02-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 400

Explanation

Correct Answer

Incorrect Answers

Question 401

Explanation

Correct Answer

Incorrect Answers

Question 402

Explanation

Correct Answer

Incorrect Answers

Question 403

Explanation

Correct Answer

Incorrect Answers

Question 404

Explanation

Correct Answer

Incorrect Answers

Question 405

Explanation

Correct Answer

Incorrect Answers

Question 406

Explanation

Correct Answer

Incorrect Answers

Question 407

Explanation

Correct Answer

Incorrect Answers

Question 408

Explanation

Correct Answer

Incorrect Answers

Question 409

Explanation

Correct Answer

Incorrect Answers

Question 410

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests