Fortinet NSE4_FGT_AD-7.6 Practice Test 46

Question 450

An interface-mode IKE/CHILD SA is already established and shows no cipher mismatch. LAN 10.1.0.0/24 must reach remote 10.9.0.0/24, but no user traffic passes. Which THREE checks are required to make this a valid routed site-to-site flow?

Install or verify a usable route toward 10.9.0.0/24 over the VPN interface in the sending VDOM.
Replace the IKE PSK even though the IKE and CHILD SA are authenticated and up.
Match a scoped LAN-to-IPsec firewall accept policy for the intended source, destination and service.
Verify a usable return route from the remote FortiGate toward 10.1.0.0/24 through IPsec, with stateful reply traffic delivered to the initiating session.
Disable all antivirus filtering globally.
Remove all local interface addressing to force tunnel encryption.

Explanation

Correct Answer

Without a destination route toward the tunnel, forwarded packets can take the wrong interface despite a healthy SA.

Interface-mode tunnels require an ordinary forwarding allow policy for outbound user packets.

The remote peer needs a valid path back to the initiating LAN; replies matching an established accepted stateful session do not automatically require a separate reverse-initiation policy.

Incorrect Answers

The evidence already shows negotiation succeeded; user-data routing/policy is the missing layer.

Inspection disablement cannot create route and policy coverage across an established VPN.

A route-based VPN relies on valid local routing; deleting addresses is destructive.

Question 451

Both VPN peers show active Phase 2 SAs and the correct remote routes. FortiGate flow debug for LAN-to-remote TCP/445 ends at implicit policy deny. What is required?

Enable client-side SSL VPN portal authentication for every site-to-site LAN host.
Replace the IKE DH group while its SA is active.
Configure the appropriate LAN-to-IPsec accept policy and required reciprocal IPsec-to-LAN accept policy with exact networks and services.
Set SD-WAN jitter threshold to zero on all WANs.

Explanation

Correct Answer

Route-based IPsec uses normal firewall accept policies per direction; successful SA setup does not grant general forwarding permission.

Incorrect Answers

An SSL portal is not the forwarding-policy prerequisite for an existing IPsec route-based tunnel.

Negotiation succeeded and the observed failure is the firewall policy decision.

Jitter criteria cannot override an implicit firewall deny.

Question 452

Remote IPsec users receive 10.10.1.50–10.10.1.100, but the office LAN already uses 10.10.1.0/24 and some clients cannot reach office servers. What should the allocator change?

Widen the existing overlapping pool to 10.10.0.0/16.
Enable deep SSL inspection for the remote clients.
Assign a dedicated nonoverlapping remote-access address pool and provide appropriate return routing and policies.
Raise the Phase 1 key lifetime to 48 hours.

Explanation

Correct Answer

The same addresses on tunnel clients and the office LAN create ambiguous routes and ARP/host identity; distinct pool addressing prevents the conflict.

Incorrect Answers

A larger overlapping pool worsens address ambiguity.

TLS inspection does not assign collision-free tunnel addresses.

Rekey duration is not the cause of overlapping IP prefixes.

Question 453

Two peers share compatible IKEv2 Phase 1 credentials and algorithms. One peer requires PFS group 14 for CHILD SAs but the other has PFS disabled; Phase 2 negotiation fails. What is required?

Configure compatible Phase 2 PFS settings and DH group on both peers according to the approved policy.
Create an HTTP web-filter exception for the site.
Add a DNS CNAME for the tunnel name.
Increase SD-WAN route priority for an unrelated WAN.

Explanation

Correct Answer

Perfect forward secrecy for Phase 2 is negotiated as a CHILD SA property independent of Phase 1 authentication.

Incorrect Answers

Web categorization cannot agree on cryptographic PFS group.

DNS aliases cannot satisfy CHILD SA PFS parameters.

Route selection does not reconcile mismatched Phase 2 PFS negotiation.

Question 454

A branch site changes ISP and receives a new public IP; the fixed hub phase 1 gateway address still points to the old IP. Branch-to-hub client addressing is otherwise valid. Which operation addresses the stale peer endpoint?

Change the HQ protected LAN network to the branch public IP.
Update the hub’s remote gateway to the new verified endpoint or use an approved dynamic peer identity/DDNS design.
Delete every FortiGuard IPS signature.
Double the subnet mask on the branch private LAN.

Explanation

Correct Answer

IKE initiates to the configured peer endpoint; a stale public address prevents reaching the correct gateway regardless of Phase 2 subnets.

Incorrect Answers

Protected inside networks are unrelated to the peer’s public transport endpoint.

IPS signature content cannot correct an outdated IKE remote gateway address.

Changing an internal prefix does not update the hub’s remote public peer IP.

Question 455

Two route-based IPsec tunnels connect a branch to HQ. Primary tunnel’s ISP fails but its old static destination route remains selected; backup tunnel SA is healthy. What route design should be assessed?

Change anti-spam policy to permit backup IPsec packets.
Give both tunnels identical administrator GUI passwords.
Use tested route/SD-WAN health eligibility to withdraw or deprefer the failed primary tunnel and permit the healthy backup.
Turn off the backup tunnel’s Phase 2 SA.

Explanation

Correct Answer

A logically configured IPsec interface route can remain preferred during an underlay outage unless a health-linked routing mechanism detects the failed data path.

Incorrect Answers

Email spam control does not withdraw the dead preferred tunnel route.

Administrative logins do not control route failover.

Disabling the healthy backup prevents resilience.

Question 456

A route-based IPsec tunnel behind an ISP NAT works under continuous traffic but loses connectivity after ten idle minutes. A new session eventually re-establishes it. What timers should be examined?

Increase the web-filter quota for remote users.
Change the LAN DNS search suffix.
Compare NAT translation idle timeout with NAT-T keepalive frequency and supported dead-peer detection/reestablishment settings.
Turn off IPsec Phase 1 and rely on plain ESP.

Explanation

Correct Answer

NAT devices can remove idle UDP 4500 mappings; keepalives and DPD behavior must be compatible with that timer.

Incorrect Answers

Website quotas cannot preserve a UDP NAT mapping for IKE/ESP.

Domain suffixes have no control over idle NAT state.

This would not keep a secure NAT-traversing VPN available.

Question 457

FortiGate A encrypts 10.10.0.0/24 to 10.40.0.0/24 and peer B decrypts successfully. Replies from B’s LAN reach its default Internet gateway instead of the tunnel. What change is required on peer B?

Install or correct the return route for 10.10.0.0/24 toward the IPsec interface and verify matching reverse firewall policy.
Rotate A’s administrator password.
Disable anti-virus profiles on B’s LAN.
Increase the phase 2 PFS strength.

Explanation

Correct Answer

Replies require their own routing/policy path back to the initiating private network; the inbound encrypted session does not construct it automatically.

Incorrect Answers

Management credentials cannot correct peer B’s incorrect return route.

The fault is path asymmetry, not an observed malware scan block.

The peer already decrypts the traffic; PFS does not create a return route.

Question 458

A certificate-authenticated IKEv2 peer presents an unexpired leaf certificate, but the peer identity in the certificate does not match the gateway’s required identity. How should the administrator proceed?

Skip all peer identity checks whenever a chain is trusted.
Increase the SD-WAN health probe interval.
Allow all LAN-to-WAN traffic without certificates.
Verify trusted issuer chain, the required peer identity and certificate validity; use the correctly issued certificate/configuration.

Explanation

Correct Answer

Successful certificate-based IKE authentication needs chain trust and identity match, not simply a signature or unexpired date.

Incorrect Answers

A trusted CA can issue certificates for different peers; trust is not identity.

Link quality monitoring does not authenticate IKE certificates.

Forwarding policy cannot bypass configured certificate authentication.

Question 459

An ISP router ACL between two public FortiGate IPsec peers denies UDP 500 and UDP 4500. Neither peer sees the other’s IKE packets. What transport change is appropriate?

Permit only TCP 443 for standard IKEv2 and ignore UDP.
Raise a web proxy timeout on internal browser clients.
Permit the required IKE UDP 500 and NAT-T UDP 4500 paths, plus ESP where used without UDP encapsulation.
Change the FortiGate administrative HTTPS listening port.

Explanation

Correct Answer

IKE negotiations use UDP 500, NAT traversal can switch encrypted packets to UDP 4500, and native ESP has its own IP protocol when not encapsulated.

Incorrect Answers

Standard IKEv2/NAT-T is not a generic HTTPS/TCP 443 session.

Browser proxy settings do not permit blocked peer transport packets.

Admin GUI port is distinct from the IKE/NAT-T transport requirements.

Question 460

A CHILD SA initially succeeds, but it is torn down every hour during a provider interoperability test. The two peers use different Phase 2 lifetime units/policies and one rejects rekey. What is the next action?

Compare the actual negotiated CHILD SA lifetime/rekey parameters and align mutually supported Phase 2 policy before validating repeated rekeys.
Change only the address of the FortiGate management interface.
Disable all tunnel Phase 2 policy and expect an SA to remain forever.
Increase browser cache TTL at remote sites.

Explanation

Correct Answer

Phase 2 lifetime and rekey handling govern child-SA renewal; mismatches should be diagnosed from tunnel state and peer logs rather than inferred from GUI clock time alone.

Incorrect Answers

An administrative IP does not govern CHILD SA rekey negotiation.

An IPsec CHILD SA has a negotiated lifecycle; deleting policy cannot sustain encryption.

HTTP cache does not affect IPsec security association lifetime.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 44 - 10 Questions (Last Reviewed 01-Oct-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 45 - 10 Questions (Last Reviewed 30-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 46 - 10 Questions (Last Reviewed 29-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 47 - 10 Questions (Last Reviewed 28-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 450

Explanation

Correct Answer

Incorrect Answers

Question 451

Explanation

Correct Answer

Incorrect Answers

Question 452

Explanation

Correct Answer

Incorrect Answers

Question 453

Explanation

Correct Answer

Incorrect Answers

Question 454

Explanation

Correct Answer

Incorrect Answers

Question 455

Explanation

Correct Answer

Incorrect Answers

Question 456

Explanation

Correct Answer

Incorrect Answers

Question 457

Explanation

Correct Answer

Incorrect Answers

Question 458

Explanation

Correct Answer

Incorrect Answers

Question 459

Explanation

Correct Answer

Incorrect Answers

Question 460

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests