Fortinet NSE4_FGT_AD-7.6 Practice Test 43

Question 420

An explicit rule steers videoconference traffic to best-quality WAN, while unmatched DNS and office browsing use the default SD-WAN strategy. Where should the engineer examine the latter sessions?

Assume the video rule also steers every unmatched session.
Inspect the implicit SD-WAN rule strategy and selected eligible members after checking no explicit service rule matches.
Assume unmatched sessions can never be forwarded through SD-WAN.
Force an administrator local-in rule to decide DNS egress.

Explanation

Correct Answer

The implicit rule applies to traffic not matched by configured service rules, with its own distribution behavior.

Incorrect Answers

An explicit application rule applies only to matching traffic.

Implicit member selection provides a fallback for otherwise unmatched eligible traffic.

Local-in rules do not govern forwarded user traffic.

Question 421

A link went down for packet loss, then its SLA graph shows stable good performance but it remains excluded from eligible services. What should the engineer investigate?

Force all sessions to the member regardless of its health.
Check active performance-SLA status, participant membership and recovery/failure criteria used by the affected service rule.
Change DNS cache TTL from 60 to 30 seconds.
Disable IPS signatures for the subnet.

Explanation

Correct Answer

Restoring a physical link is insufficient if its health-check or rule eligibility remains failed, suspended or excluded.

Incorrect Answers

This defeats the very route-protection behavior that prevents a blackhole.

Local DNS caching does not control member recovery state.

Inspection signatures do not mark an SD-WAN SLA member eligible.

Question 422

Two permitted links both meet the same SD-WAN SLA. The lower-cost link is selected. After the administrator makes their costs equal, FortiGate consistently prefers the first configured priority member. What explains this?

The link with the highest configured numeric cost is always preferred.
The Lowest Cost (SLA) strategy selects lower cost among passing members, and interface preference order resolves equal-cost eligible links.
The SD-WAN health probe automatically becomes BGP next hop.
FortiGate rotates all equal-cost links randomly for every packet.

Explanation

Correct Answer

The documented strategy uses link cost first and interface preference when those are equal; this need not indicate packet loss.

Incorrect Answers

Higher costs are not the desired lower-cost criterion.

SLA probes are link-quality evidence, not a replacement BGP next-hop selection policy.

The described Lowest Cost rule has a deterministic preference order when costs tie.

Question 423

WAN-A has 18 ms latency but 22 ms jitter; WAN-B has 34 ms latency but 3 ms jitter. Both meet a permissive loss SLA. The SD-WAN voice rule specifies jitter as the Best Quality metric. Which link is preferred?

WAN-A solely because latency is lower.
Both links are automatically combined into one L2 trunk.
WAN-B, since it has the lower measured jitter for the selected quality factor.
Neither link because they have different latency values.

Explanation

Correct Answer

The configured link-cost factor is jitter; lower latency on WAN-A does not override the explicit jitter comparison.

Incorrect Answers

The rule was specifically configured to compare jitter, not latency.

Quality-based SD-WAN selection does not physically aggregate unrelated providers.

Differing latency alone does not disqualify both under a jitter-focused eligible rule.

Question 424

SD-WAN is configured to distribute sessions using source IP. A branch NAT consolidates all users to one source, so almost all outbound flows land on one healthy member. What is the first design investigation?

Increase web-filter category threshold to spread traffic.
Declare wan2 failed without checking its health or member eligibility.
Disable both ISP gateways for an hour to reset hashes.
Assess the actual session-distribution algorithm and source-IP diversity, and test a supported strategy better suited to the post-NAT flow mix.

Explanation

Correct Answer

Source-based balancing can concentrate sessions sharing the same observed address; two healthy links do not prove a suitable hash selection.

Incorrect Answers

Web category severity cannot change a source-IP load-balancing hash.

Uneven distribution with a single NAT source can occur even when both links are alive.

Removing active route candidates is unrelated to choosing an appropriate load-balance method.

Question 425

A primary broadband port reports `up` at 1 Gbps. Performance SLA detects 85% packet loss to an Internet target beyond the provider gateway, and service steering moves away from the link. What is the correct conclusion?

The FortiGate must have a bad Ethernet cable whenever any SLA fails.
The WAN can be link-up but SLA-ineligible because end-to-end path loss exceeds the measured quality threshold.
The SLA result proves antivirus signature updates are stale.
The backup member cannot be used until wan1 goes link-down.

Explanation

Correct Answer

SD-WAN health checks judge path quality beyond carrier; a member can be physically up yet excluded from services.

Incorrect Answers

Upstream routing or ISP loss can fail probes without a local physical defect.

Path loss does not measure inspection database age.

SD-WAN probes can change route/member eligibility while the physical port remains up.

Question 426

A firewall debug shows SD-WAN correctly selects wan2 for a customer HTTPS session, yet the session gets a firewall-policy deny because an allow policy has outgoing interface wan1. What should be corrected?

Change the selected WAN’s system hostname.
Disable FortiGuard IP reputation checking globally.
Match the actual SD-WAN zone and traffic tuple in the forward accept policy rather than binding only the former physical member.
Increase BGP update timers on a LAN neighbor.

Explanation

Correct Answer

An SD-WAN route decision and a forward security-policy match are separate; the policy interface must align with zone-based steering.

Incorrect Answers

Hostnames do not change an egress firewall policy interface match.

The log identifies interface/policy mismatch, not an IP reputation block.

Routing converges correctly to wan2; the deny is due to policy scope.

Question 427

A high-priority general web rule matches all TCP/443 before a later finance-specific TCP/443 rule. Both WANs are healthy, but finance sessions select the general member. Which control explains the observed rule?

A failed FortiGuard license necessarily forces the general rule.
Service rule ordering: the earlier broad match consumes the session before the finance-specific rule can be evaluated.
The firewall automatically sorts SD-WAN rules by narrowest IP mask.
A larger route table forces the first rule.

Explanation

Correct Answer

SD-WAN service rules are evaluated by order and match criteria; a broad rule can shadow a later specific rule.

Incorrect Answers

The scenario confirms matching and healthy WANs; a rule-order issue explains the selection.

An explicit service list retains its configured order rather than auto-reordering by specificity.

Number of FIB entries is not the determining criterion for rule-list match precedence.

Question 428

A voice service requires jitter under 5 ms. Probes show jitter 3 ms but the configured jitter target is 2 ms, causing unnecessary failover. Which configuration fault is present?

No health probes ran because the interface is physically up.
The configured jitter threshold is stricter than the actual business SLA; validate and align it to the approved 5 ms limit.
Lowering output token limit would solve jitter quality.
Increase the member cost until it passes the lower jitter threshold.

Explanation

Correct Answer

A link with 3 ms jitter fails the 2 ms rule even though it meets the 5 ms user contract; rule thresholds and business SLO must align.

Incorrect Answers

The scenario supplies measured jitter, so probes or observation were active.

Generative token settings do not alter WAN jitter measurement.

Link cost changes steering preference, not whether measured jitter meets 2 ms.

Question 429

A public WAN2 can reach internet DNS 8.8.8.8, but its shared health-check uses a private datacenter server accessible only from MPLS member WAN1. Which TWO changes properly measure WAN2?

Choose a WAN2-reachable probe destination representative of its Internet path.
Raise only the FortiGate management idle timeout.
Assume a failed private probe proves all Internet destinations are unreachable.
Turn off WAN2 forwarding policies permanently.
Associate the active probe and its source/member path with WAN2 and verify replies return on that member.

Explanation

Correct Answer

A target that is inaccessible by design cannot measure whether public WAN2 service is healthy.

Member-specific health requires the probe to traverse and receive replies on the route being evaluated.

Incorrect Answers

Administrative session timers do not change SLA target reachability.

A private target cannot generalize WAN2 public Internet health.

Disabling users is not an appropriate health-measurement fix.

Question 430

A new SD-WAN member is included in the intended priority list and its health probe succeeds, but the service rule shows inactive for a public Internet destination. There is no default route for the zone. Which prerequisite is missing?

A larger SSL deep-inspection certificate chain.
An anti-spam engine update.
A web-filter monitor action for all categories.
A valid active route covering the destination through the intended SD-WAN zone.

Explanation

Correct Answer

SD-WAN service rules need route coverage to be active; member definition alone is not an installed destination path.

Incorrect Answers

TLS inspection settings do not create a route.

Email scanning has no bearing on route presence.

Content categorization does not install default route coverage.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 41 - 10 Questions (Last Reviewed 04-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 43 - 10 Questions (Last Reviewed 02-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 44 - 10 Questions (Last Reviewed 01-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 45 - 10 Questions (Last Reviewed 30-Sep-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 420

Explanation

Correct Answer

Incorrect Answers

Question 421

Explanation

Correct Answer

Incorrect Answers

Question 422

Explanation

Correct Answer

Incorrect Answers

Question 423

Explanation

Correct Answer

Incorrect Answers

Question 424

Explanation

Correct Answer

Incorrect Answers

Question 425

Explanation

Correct Answer

Incorrect Answers

Question 426

Explanation

Correct Answer

Incorrect Answers

Question 427

Explanation

Correct Answer

Incorrect Answers

Question 428

Explanation

Correct Answer

Incorrect Answers

Question 429

Explanation

Correct Answer

Incorrect Answers

Question 430

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests