Question 440
A WAN has latency 41 ms, jitter 8 ms and packet loss 0%. The voice SLA requires latency under 50 ms and jitter under 5 ms; a backup job only requires loss below 2%. Which outcome is correct?
- The WAN must fail every service because one voice criterion fails.
- Jitter is calculated from the number of client DNS queries.
- The WAN passes voice merely because latency is under 50 ms.
- The WAN can fail the voice SLA on jitter while remaining eligible for the loss-only backup-job SLA.
Explanation
Correct Answer
D:Quality eligibility is per defined threshold/SLA target, not one universal up/down state.
Incorrect Answers
A:Different service rules can reference different SLA objectives.
B:Jitter is packet delay variation, not DNS query volume.
C:The voice target also imposes an independent jitter requirement.
Question 441
An SLA monitor shows repeated probe timeouts on wan2, yet ordinary user TCP sessions via wan2 can reach public sites. Packet capture finds health-check packets sourced via wan1 due to an unexpected probe path. What should be checked?
- Correct the probe source/member and target routing, then validate returned probes on wan2.
- Increase the default BGP local AS number.
- Create a client web-filter exemption to the portal.
- Disable FortiGate configuration backups.
Explanation
Correct Answer
A:An active probe must genuinely exercise the intended WAN member; measurements from another path are not evidence of wan2 quality.
Incorrect Answers
B:Changing the AS identifier is not a health-check source-route fix.
C:A filter exemption does not ensure the SLA probe uses wan2.
D:Backup cadence cannot influence probe return routing.
Question 442
After an SD-WAN deployment, the health check is alive and rules show eligible members. DNS lookups succeed from FortiGate, but user packets to arbitrary public IPs still receive a no-route result. What check is decisive?
- Confirm an active 0.0.0.0/0 route via the intended SD-WAN zone is in the user ingress VDOM and resolves to valid egress members.
- Assume every SD-WAN member automatically injects a default route merely by joining a zone.
- Enable all SIP ALG functions.
- Replace FortiGuard certificates.
Explanation
Correct Answer
A:Local control-plane DNS success does not prove the user forwarding VDOM has default route coverage.
Incorrect Answers
B:Member membership alone does not supply a correct route to every Internet destination.
C:VoIP protocol helpers do not install generic IP forwarding routes.
D:TLS trust changes do not add a missing default route.
Question 443
A corporate ERP site uses 10.90.40.0/24 reachable over MPLS. The branch should send that prefix over MPLS while general Internet remains broadband, without depending on a cloud ISDB signature. Which steering selector fits?
- Use the CDN category for public video streaming.
- Match the approved corporate destination address or route tag in a specific SD-WAN rule for the private overlay.
- Disable all broadband routing for every user.
- Identify MPLS by WAN MAC address in a web filter.
Explanation
Correct Answer
B:Corporate internal prefixes are known and stable; destination/route-tag matching selects the intended private member without relying on public SaaS classification.
Incorrect Answers
A:An unrelated public Internet service category is not the private 10.90.40/24 destination.
C:General Internet must remain broadband, so a global shutdown violates scope.
D:Web filtering is not the correct SD-WAN destination match policy.
Question 444
An explicit video rule selects wan1; all other traffic uses an implicit rule with available wan1/wan2. After video service stops matching, a newly opened DNS session uses wan2. Why is that consistent?
- All DNS traffic automatically inherits the last successful video member.
- A web-filter block action chooses whichever route has a lower latency.
- The FortiGate must be using physical port aggregation.
- DNS is unmatched and follows the implicit rule’s eligible-member selection rather than inheriting the video rule.
Explanation
Correct Answer
D:SD-WAN processes specific rule matches before an implicit rule; changing video session state does not bind unrelated DNS flows.
Incorrect Answers
A:Unrelated flows are matched against their own service criteria, not a previous application session.
B:Web filtering does not control implicit SD-WAN member selection.
C:An implicit SD-WAN rule does not require aggregating unrelated provider links.
Question 445
After an ISP repair, wan1 returns from an SD-WAN health failure. Which TWO observations demonstrate that it is both healthy again and used where policy permits?
- WAN1 shows physical carrier but all external probes still fail.
- Health-monitor output shows wan1 meets the targeted SLA and is an eligible participant.
- An unrelated administrative login to the FortiGate completes.
- The old failure alarm has been manually cleared while monitoring still reports loss.
- A new representative matching flow can select wan1 under the intended service rule and has successful end-to-end traffic.
Explanation
Correct Answer
B:Recovery must be reflected in the health state and member set rather than merely link carrier.
E:An actual selected member/flow test checks use after health recovery, not only the monitor UI.
Incorrect Answers
A:Carrier alone does not prove upstream SLA recovery.
C:Local management login does not exercise the WAN member in a forwarded service rule.
D:Clearing an alert is not evidence of recovered forwarding eligibility.
Question 446
Two branch FortiGates negotiate matching IKEv2 cryptographic algorithms, but IKE AUTH fails because the hub expects a different PSK than the spoke uses. What correction directly resolves the failure?
- Configure mutually agreed IKE authentication credentials and identity on the two peers, then rerun negotiation.
- Increase an unrelated firewall policy session timeout.
- Change the LAN static route distance while preserving the wrong PSK.
- Change the Phase 2 lifetime only.
Explanation
Correct Answer
A:A matched encryption suite does not authenticate a peer when its configured PSK or identifier is wrong; that failure occurs in IKE authentication.
Incorrect Answers
B:A forwarded traffic timer cannot repair IKE peer authentication failure.
C:Routing LAN traffic does not validate IKE credentials.
D:CHILD SA lifetimes are downstream of an IKE authentication that has not succeeded.
Question 447
An IKEv2 initiator offers AES256-GCM with DH group 19, while its peer permits only AES128-SHA256 with group 14. Logs show no proposal chosen before authentication. What is required?
- Regenerate the S3 object encryption key.
- Turn on NAT-T while leaving all incompatible crypto suites unchanged.
- Coordinate a mutually supported approved IKE proposal and DH group on both ends before retrying.
- Add an allow firewall rule for application TCP/443 after the tunnel.
Explanation
Correct Answer
C:IKE Phase 1 negotiation needs at least one compatible proposal; otherwise authentication and Phase 2 cannot be reached.
Incorrect Answers
A:Cloud storage encryption is unrelated to FortiGate IKE proposal matching.
B:NAT encapsulation cannot resolve an encryption/DH proposal mismatch.
D:A forwarded application permit cannot make IKE Phase 1 choose a cryptographic proposal.
Question 448
A branch FortiGate is behind an upstream PAT router. IKE can reach the public hub, but native ESP cannot traverse the NAT reliably. Both peers support RFC NAT traversal. Which change fits?
- Enable compatible NAT traversal and verify the translated UDP 4500 return path on both peers.
- Force a plain ESP-only tunnel through the translating router without any NAT mapping.
- Increase the VPN user password length until ESP is routed.
- Change the static LAN route prefix from /24 to /16.
Explanation
Correct Answer
A:NAT-T encapsulates ESP inside UDP so stateful NAT can identify and forward the session correctly.
Incorrect Answers
B:Native ESP has no UDP port to distinguish address-translated flows under PAT.
C:Credential length does not change ESP encapsulation through NAT.
D:This does not add NAT-T or repair transport across the provider NAT.
Question 449
IKE Phase 1 reports established, but a new CHILD SA is rejected. Branch proposes local 10.1.0.0/24 ↔ HQ 10.20.0.0/24; HQ expects Branch 10.2.0.0/24 instead. What must be reconciled?
- Set the management GUI port to 443 at both peers.
- Increase web-filter category score for both networks.
- Disable routing on each LAN subnet entirely.
- Correct both peers’ corresponding Phase 2 source and destination traffic selectors for the intended protected subnets.
Explanation
Correct Answer
D:The selectors/proxy IDs describe which networks a CHILD SA may carry; mismatched networks can reject that negotiation even while IKE Phase 1 is up.
Incorrect Answers
A:Administrative port settings do not change negotiated Phase 2 protected subnet identities.
B:Website content categories cannot align IPsec selectors.
C:Removing routes prevents data forwarding but does not agree on intended CHILD SA selectors.
Question 450
An interface-mode IKE/CHILD SA is already established and shows no cipher mismatch. LAN 10.1.0.0/24 must reach remote 10.9.0.0/24, but no user traffic passes. Which THREE checks are required to make this a valid routed site-to-site flow?
- Install or verify a usable route toward 10.9.0.0/24 over the VPN interface in the sending VDOM.
- Replace the IKE PSK even though the IKE and CHILD SA are authenticated and up.
- Match a scoped LAN-to-IPsec firewall accept policy for the intended source, destination and service.
- Verify a usable return route from the remote FortiGate toward 10.1.0.0/24 through IPsec, with stateful reply traffic delivered to the initiating session.
- Disable all antivirus filtering globally.
- Remove all local interface addressing to force tunnel encryption.
Explanation
Correct Answer
A:Without a destination route toward the tunnel, forwarded packets can take the wrong interface despite a healthy SA.
C:Interface-mode tunnels require an ordinary forwarding allow policy for outbound user packets.
D:The remote peer needs a valid path back to the initiating LAN; replies matching an established accepted stateful session do not automatically require a separate reverse-initiation policy.
Incorrect Answers
B:The evidence already shows negotiation succeeded; user-data routing/policy is the missing layer.
E:Inspection disablement cannot create route and policy coverage across an established VPN.
F:A route-based VPN relies on valid local routing; deleting addresses is destructive.
Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests