Fortinet NSE4_FGT_AD-7.6 Practice Test 42

Question 410

A retailer has two internet transports: fiber costs 12 units and LTE costs 3. Both pass required latency and jitter targets in normal conditions. The CFO wants the cheaper eligible transport without selecting it during quality failure. Which SD-WAN rule fits?

Use source-IP ECMP without an SLA.
Always bind the policy to fiber only.
Use Lowest Cost (SLA) with the documented quality thresholds and member costs.
Choose a web-filter action of Monitor for LTE.

Explanation

Correct Answer

Lowest Cost (SLA) selects the lower-cost eligible member among those meeting the relevant SLA; it is not a blind cost comparison when quality is poor.

Incorrect Answers

Static ECMP can distribute flows but does not ensure each chosen path meets application quality limits.

A fixed fiber egress ignores the lower-cost healthy LTE option.

Content filtering has no role in SD-WAN cost-aware member selection.

Question 411

A support hotline has two usable WANs: A jitter 24 ms, B jitter 3 ms, equal permitted costs. Voice quality suffers when A is selected. What FortiOS steering strategy targets the measured symptom?

Force Lowest Cost without regard to jitter.
Change DNS client search suffix to the ISP hostname.
Increase antivirus detection thresholds for all traffic.
Use Best Quality with jitter as the link-cost factor, supported health measurements and a voice-matching service rule.

Explanation

Correct Answer

The measured variation in delay is jitter; SD-WAN quality steering can prefer the link with better measured jitter.

Incorrect Answers

Cost equality or pricing cannot by itself fix a voice jitter problem.

DNS suffix settings do not control physical path jitter.

Anti-malware settings do not select the low-jitter WAN path.

Question 412

A backup service generates many independent TCP sessions and is permitted to use either of two healthy 500-Mbps circuits. The objective is more aggregate capacity rather than a single cheapest path. What design is appropriate?

Send every backup flow through the same low-bandwidth member by default.
Replace every routing policy with an implicit deny.
Configure a supported SD-WAN load-balancing strategy with both eligible members, then benchmark per-flow distribution and total throughput.
Aggregate physical ports with 802.3ad across unrelated public ISPs.

Explanation

Correct Answer

An SD-WAN rule can distribute multiple eligible sessions across available links, provided the selected strategy and health checks suit the traffic.

Incorrect Answers

Pinning all sessions to one member wastes healthy capacity.

Blocking sessions cannot improve backup capacity.

Link aggregation requires compatible L2 peers and cannot combine unrelated provider routes into one Ethernet bundle.

Question 413

A branch port1 still reports link-up although its ISP cannot route beyond its local gateway. Branch port2 works. Which TWO controls allow FortiOS SD-WAN to avoid the failed upstream for Internet traffic?

Probe a reachable external SLA target through each intended WAN member.
Check only local port1 speed and duplex.
Change only application-control signature category order.
Increase all interface ARP cache timeouts indefinitely.
Apply an SD-WAN rule that excludes the failed SLA member and steers eligible traffic via a healthy alternative.

Explanation

Correct Answer

External active probes reveal upstream reachability that local Ethernet carrier alone cannot detect.

An operational health signal must actually influence member selection to prevent use of the dead upstream.

Incorrect Answers

A good L1 port can coexist with failed ISP transit.

Application signatures cannot mark a WAN transit path failed.

ARP caching does not measure reachability beyond the ISP gateway.

Question 414

Two ISP interfaces are members of a single SD-WAN zone. A web client traffic rule correctly selects wan2, but the firewall accept policy targets only wan1. What should the firewall policy reference?

Reference both physical WAN member names in an unrestricted any-interface permit.
Reference the appropriate SD-WAN zone as the destination interface and scope its source/service/security profiles.
Reconfigure the browser to use wan1 by hostname.
Replace the rule with a local-in management policy.

Explanation

Correct Answer

FortiOS firewall policies select SD-WAN zones, whereas member selection is handled by the SD-WAN rule.

Incorrect Answers

FortiOS SD-WAN policy design expects zone interfaces; a broad any-policy sacrifices precision.

Browser DNS cannot substitute for firewall policy/SD-WAN zone alignment.

This is forwarded user traffic, not an administrator connection to FortiGate.

Question 415

A finance destination 10.88.5.0/24 should use private overlay, but a first SD-WAN rule matching all traffic selects broadband. The new finance rule is second and never sees the flow. What adjustment is needed?

Raise only application maximum token counts.
Place the finance-specific service rule above the all-destination rule and test that its match conditions apply.
Add a firewall policy on the administrative management interface.
Remove the finance route to force an overlay decision.

Explanation

Correct Answer

SD-WAN rule matching is ordered, so a broad early match shadows a later specific steering rule.

Incorrect Answers

Generation settings do not affect SD-WAN steering matches.

A local management policy does not reorder forwarding-service rules.

Without a compatible route the desired service can become ineligible rather than selected.

Question 416

A voice application’s contractual maximum one-way latency is 50 ms and jitter is 5 ms. What should the SD-WAN health definition include?

Set only a data-transferred counter limit of 5 GB.
Use WAN carrier speed as the only health metric.
Define latency and jitter thresholds at the actual limits, choose representative targets, and test member compliance.
Allow all links until their cost falls below 50.

Explanation

Correct Answer

Performance SLAs evaluate measured delay/jitter/loss and determine whether a member satisfies rule quality requirements.

Incorrect Answers

Byte usage cannot establish delay variation or latency bounds.

A gigabit link may still have excessive jitter and delay.

A price metric cannot stand in for latency and jitter limits.

Question 417

A probe server at 172.30.1.1 is inside a private MPLS network reachable only via member MPLS. The same health-check template runs against Internet member wan2 and always fails. What should the engineer change?

Declare wan2 physically down despite its working Internet reachability.
Lower the firewall administration timeout.
Disable all SD-WAN members outside MPLS.
Use probe targets and participants reachable through each tested member and aligned with that member’s real service path.

Explanation

Correct Answer

A health check cannot characterize wan2 when its destination is intrinsically unreachable via wan2; use suitable per-link targets or SLA groups.

Incorrect Answers

An unreachable private probe does not establish physical or public-WAN failure.

Management idle limits do not fix health-check target design.

Removing healthy public members is unnecessary when the probe design is wrong.

Question 418

Two Internet SD-WAN members and zone internet-z exist, with successful health checks. No default route points to their zone. Users with no specific destination route receive routing failures. What is missing?

Configure a second web-filter profile.
Configure the supported 0.0.0.0/0 static route toward the SD-WAN zone for Internet-bound traffic.
Enable DHCP on the WAN zone itself.
Increase SD-WAN member weight without route coverage.

Explanation

Correct Answer

SD-WAN steering needs an eligible route to the destination; defining members and probes alone does not install a usable default.

Incorrect Answers

Web inspection cannot create a missing default route.

Client address assignment is not equivalent to a default routing entry.

A weight influences selection among eligible routes, not route existence.

Question 419

An enterprise wants private ERP traffic over MPLS with no cloud web filter while Internet sessions on broadband need web filtering. Both are WAN members. What architecture preserves distinct security policy for each?

Place every interface in the same zone and assume a policy can target individual member ports.
Use the ISP bandwidth counter as an ERP authorization list.
Make MPLS a FortiGate local-in management interface.
Create separate SD-WAN zones for the private overlay and public links, and bind appropriate firewall policies and steering rules.

Explanation

Correct Answer

Different zones allow different forwarding-policy security profiles while steering determines the eligible member inside the zone.

Incorrect Answers

FortiOS firewall policies select zones, so a single shared zone removes desired separate security treatment.

Bandwidth statistics do not implement application security policy separation.

The MPLS overlay carries forwarded enterprise traffic, not only FortiGate administrative connections.

Question 420

An explicit rule steers videoconference traffic to best-quality WAN, while unmatched DNS and office browsing use the default SD-WAN strategy. Where should the engineer examine the latter sessions?

Assume the video rule also steers every unmatched session.
Inspect the implicit SD-WAN rule strategy and selected eligible members after checking no explicit service rule matches.
Assume unmatched sessions can never be forwarded through SD-WAN.
Force an administrator local-in rule to decide DNS egress.

Explanation

Correct Answer

The implicit rule applies to traffic not matched by configured service rules, with its own distribution behavior.

Incorrect Answers

An explicit application rule applies only to matching traffic.

Implicit member selection provides a fallback for otherwise unmatched eligible traffic.

Local-in rules do not govern forwarded user traffic.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 40 - 10 Questions (Last Reviewed 05-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 43 - 10 Questions (Last Reviewed 02-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 44 - 10 Questions (Last Reviewed 01-Oct-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 410

Explanation

Correct Answer

Incorrect Answers

Question 411

Explanation

Correct Answer

Incorrect Answers

Question 412

Explanation

Correct Answer

Incorrect Answers

Question 413

Explanation

Correct Answer

Incorrect Answers

Question 414

Explanation

Correct Answer

Incorrect Answers

Question 415

Explanation

Correct Answer

Incorrect Answers

Question 416

Explanation

Correct Answer

Incorrect Answers

Question 417

Explanation

Correct Answer

Incorrect Answers

Question 418

Explanation

Correct Answer

Incorrect Answers

Question 419

Explanation

Correct Answer

Incorrect Answers

Question 420

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests