Fortinet NSE4_FGT_AD-7.6 Practice Test 47

Question 460

A CHILD SA initially succeeds, but it is torn down every hour during a provider interoperability test. The two peers use different Phase 2 lifetime units/policies and one rejects rekey. What is the next action?

Compare the actual negotiated CHILD SA lifetime/rekey parameters and align mutually supported Phase 2 policy before validating repeated rekeys.
Change only the address of the FortiGate management interface.
Disable all tunnel Phase 2 policy and expect an SA to remain forever.
Increase browser cache TTL at remote sites.

Explanation

Correct Answer

Phase 2 lifetime and rekey handling govern child-SA renewal; mismatches should be diagnosed from tunnel state and peer logs rather than inferred from GUI clock time alone.

Incorrect Answers

An administrative IP does not govern CHILD SA rekey negotiation.

An IPsec CHILD SA has a negotiated lifecycle; deleting policy cannot sustain encryption.

HTTP cache does not affect IPsec security association lifetime.

Question 461

A branch IPsec design must carry both 10.11.0.0/24 and 10.12.0.0/24 to HQ. The hub accepts specific Phase 2 selectors; only the first subnet currently passes. Which TWO paired change areas must be validated?

Change only the FortiGate web-filter language.
Raise the Phase 1 password complexity alone.
Configure matching Phase 2 selectors/CHILD SA coverage for the second approved subnet pair on both peers.
Assign both subnets the same IP addresses to simplify matching.
Ensure bidirectional routes and ordinary firewall policies include the second network through the route-based tunnel.

Explanation

Correct Answer

Specific subnet selectors determine which protected traffic may be encrypted; the second network needs coverage on each end.

Even a successful CHILD SA does not supply routes or forwarding permission for traffic outside existing network objects.

Incorrect Answers

Website categorization cannot expand protected tunnel selectors.

The first subnet already works, so generic IKE credential strength is not the missing path coverage.

Duplicate private addressing would create new routing conflicts instead of adding an approved second network.

Question 462

A firewall in policy-based NGFW operation has newly created IPsec interface objects but a template assumes legacy policy-based IPsec security policy semantics. Tunnel comes up but no matching normal forwarding permission exists. What must be reviewed?

Rely on the wizard display icon as proof that LAN traffic is allowed.
Apply the policies supported by the current NGFW/VPN mode, including explicit route-based IPsec interface accept rules, rather than assuming the wizard added every required policy.
Add a random Internet default route to bypass the VPN.
Disable IKE peer authentication because policy-based NGFW is enabled.

Explanation

Correct Answer

Policy and NAT operating mode affects how firewall rules are defined; an IPsec interface still needs accepted data-plane traffic as documented.

Incorrect Answers

A wizard-created tunnel does not prove all source/destination/service rules were installed.

Routing around the tunnel does not satisfy private tunnel traffic authorization.

NGFW policy mode does not abolish IKE authentication.

Question 463

A ticket reports only that an IPsec site-to-site tunnel is down. The administrator needs to distinguish IKE SA authentication from CHILD SA/selector failures without guessing. Which evidence should be gathered first?

Immediately disable all site firewall rules.
Judge IKE success from a website category log alone.
Inspect filtered IKE daemon logs and Phase 1 gateway state alongside `diagnose vpn tunnel list` Phase 2 SA state.
Change DHCP scope to match the peer public address.

Explanation

Correct Answer

FortiOS provides separate IKE gateway and tunnel/CHILD SA diagnostics, enabling a phase-specific fault finding.

Incorrect Answers

Before locating the failing phase, broad security-policy removal is unsafe and diagnostically weak.

Web-filter logs do not expose the IKE security association negotiation sequence.

DHCP client address assignment is not a diagnostic for IKE/CHILD SA negotiation.

Question 464

A regulated company will remove AES128-CBC from its IPsec policy, retaining AES256-GCM. The remote FortiGate currently offers only AES128-CBC. What deployment sequence avoids a failed Phase 1?

Delete all remote gateway addresses at the hub.
Disable IKE daemon logging for the change window.
Add an approved mutually supported stronger IKE proposal on both peers, verify negotiation, then retire the weak suite in a coordinated change.
Raise WAN speed negotiation to 10 Gbps to enable AES256-GCM.

Explanation

Correct Answer

IKE cannot select a proposal that only one end offers; coordinated overlap before retirement preserves secure interoperation.

Incorrect Answers

Removing the peer endpoint does not establish a compatible stronger proposal.

This removes useful negotiation evidence and cannot improve cryptographic compatibility.

Link speed is not the negotiated IKE cipher suite.

Question 465

Two IKE peers have matching PSKs and supported proposals. IKE trace shows the hub rejects the peer’s ID because `branch-west` was configured but the initiator presents `branch-east`. What is the fault?

The VPN’s application service port is not TCP 443.
The LAN DHCP pool has too many free addresses.
The expected IKE peer identity does not match the identity presented by the initiator.
An outbound policy has web-filter category Block.

Explanation

Correct Answer

Peer ID is an authenticated identity contract independent of whether the PSK bytes and cryptographic proposal match.

Incorrect Answers

IKE peer identity negotiation is not decided by the protected application port.

Host DHCP capacity cannot cause an IKE identity mismatch.

Forwarding web inspection does not determine the peer ID verified during IKE.

Question 466

A hub offers AES256/SHA256 with DH group 19, while a spoke offers the same algorithms only with DH group 14. IKE logs show `NO_PROPOSAL_CHOSEN` before peer authentication. What setting prevents agreement?

A destination LAN firewall policy has the wrong name.
The tunnel uses 10.0.0.0/8 as an inside route.
The admin GUI listens on TCP 10443.
No common supported IKE Diffie–Hellman group exists in the proposals the peers offer.

Explanation

Correct Answer

A matching cipher is insufficient when key-exchange group choice differs; proposal selection fails before identity authentication.

Incorrect Answers

Forwarding-policy labels do not appear in cryptographic IKE proposal matching.

Internal prefix scope is not the disputed IKE DH group.

Admin HTTPS port is separate from IKE proposal negotiation.

Question 467

A remote FortiGate believes it has public address 198.51.100.20, but the hub sees the IKE source as 203.0.113.90 and later UDP 4500 packets. Which observed condition best explains this difference?

An upstream NAT has rewritten the peer transport address and the session is using NAT-T encapsulation.
Phase 2 PFS must be disabled for every IPsec deployment.
The remote LAN automatically inherits the hub’s DNS server.
The BGP AS number was shortened to four digits.

Explanation

Correct Answer

The translated source address and switch to UDP 4500 are consistent with NAT detection and IPsec UDP encapsulation.

Incorrect Answers

PFS choice does not explain a changed public source IP in IKE transport.

DNS inheritance does not translate the outer IKE packet source.

Autonomous system numbering is not a cause of upstream NAT source rewrite.

Question 468

FortiGate shows a healthy IKE SA, but only traffic 10.70.1.0/24↔10.80.0.0/24 triggers an encrypted CHILD SA. Another approved subnet 10.70.2.0/24 is missing from all selectors. Why does the second subnet fail despite an up IKE SA?

An IKE PSK must necessarily differ between subnets of one peer.
The FortiGuard category score is too low for the remote subnet.
All remote subnets must be translated to the hub public IP.
The Phase 2 traffic selectors do not include the 10.70.2.0/24 protected network pair.

Explanation

Correct Answer

IKE SA establishment authenticates peers; the CHILD SA selector identifies specific protected IP traffic.

Incorrect Answers

One authenticated IKE SA can negotiate multiple CHILD SAs; the subnet selector is the missing constraint.

Web category filtering is not a CHILD SA selector definition.

Generic source NAT is not required to replace missing protected-subnet selectors.

Question 469

An IKEv2 tunnel is up and the remote network is 172.31.50.0/24. A source host sends packets, but FortiGate’s selected route is the public default via wan1 rather than the IPsec interface. What is the immediate forwarding cause?

The remote Phase 1 password must be invalid because routing uses wan1.
No active route covering 172.31.50.0/24 directs this traffic into the IPsec interface.
The IPS signature severity is too high for the branch.
The local admin trusted hosts list lacks the source LAN.

Explanation

Correct Answer

Tunnel negotiation does not by itself guarantee the user VDOM chooses the tunnel interface for destination forwarding.

Incorrect Answers

Successful IKE and CHILD SA state rules out that specific negotiation failure.

The packet misses tunnel egress at route lookup before IPS content decisions.

Administrative login ACLs do not determine forwarded VPN destination routing.

Question 470

A site-to-site FortiGate shows tunnel interface vpn-hq as selected route and established IKE/CHILD SAs. `diagnose debug flow` says `Denied by forward policy check`. Why is the traffic blocked?

The IKEv2 exchange uses an invalid DH group.
The remote site is physically unreachable for all traffic.
The application needs a stronger encryption cipher suite.
The forwarded source, destination, interfaces or service do not match a required accept policy for the route-based IPsec path.

Explanation

Correct Answer

An established route and SA do not override firewall policy; the flow debug identifies the permission stage explicitly.

Incorrect Answers

A live SA contradicts a Phase 1 negotiation-failure explanation.

The recorded deny occurs during local forwarding-policy evaluation.

Changing encryption cannot make an implicit local firewall deny into a permit.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 45 - 10 Questions (Last Reviewed 30-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 46 - 10 Questions (Last Reviewed 29-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 47 - 10 Questions (Last Reviewed 28-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 49 - 10 Questions (Last Reviewed 26-Sep-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 460

Explanation

Correct Answer

Incorrect Answers

Question 461

Explanation

Correct Answer

Incorrect Answers

Question 462

Explanation

Correct Answer

Incorrect Answers

Question 463

Explanation

Correct Answer

Incorrect Answers

Question 464

Explanation

Correct Answer

Incorrect Answers

Question 465

Explanation

Correct Answer

Incorrect Answers

Question 466

Explanation

Correct Answer

Incorrect Answers

Question 467

Explanation

Correct Answer

Incorrect Answers

Question 468

Explanation

Correct Answer

Incorrect Answers

Question 469

Explanation

Correct Answer

Incorrect Answers

Question 470

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests