Fortinet NSE4_FGT_AD-7.6 Practice Test 49

Question 480

A tunnel uses broad 0.0.0.0/0 selectors and the CHILD SA is established; only one approved LAN is supposed to communicate with HQ. What security control still limits forwarding to the approved subnet?

Apply precise routes and firewall accept policy source/destination/service objects despite broad SA selectors.
Assume broad IPsec selectors grant every LAN host transit permission.
Disable all logging so unapproved subnets remain hidden.
Convert the encrypted WAN transport into an administrator management network.

Explanation

Correct Answer

Broad selectors describe possible encryption, but route-based VPN security policies must still authorize actual user traffic.

Incorrect Answers

An established SA cannot bypass ordinary forwarding-policy authorization.

Log suppression does not enforce access control.

Admin interface roles are not the required source/destination security boundary.

Question 481

A legacy runbook tells staff to create an IPsec action policy for every tunnel. The deployed connection uses route-based IPsec virtual interfaces and expects separate LAN→tunnel and tunnel→LAN permits. Which assumption is wrong?

That protected network objects should have explicit addresses.
That a legacy policy-based IPsec action rule is interchangeable with route-based VPN ordinary accept policies.
That the actual tunnel interface should appear in the route-based policy.
That both sides should verify the SAs.

Explanation

Correct Answer

Fortinet distinguishes policy-based tunnel actions from interface-mode VPN security policies; the interface-mode path needs normal accepts.

Incorrect Answers

Explicit source and destination address objects are appropriate and do not cause this mode mismatch.

The virtual IPsec interface is specifically used in interface-mode policy matching.

Checking phase 1/2 negotiation is still necessary regardless of policy mode.

Question 482

A FortiGate displays an active IKE gateway in `diagnose vpn ike gateway list`, but the named VPN shows zero established proxyid/CHILD SAs in `diagnose vpn tunnel list`. What should be investigated next?

Phase 2 selector/proposal negotiation and IKE logs for the missing CHILD SA, rather than re-proving successful IKE establishment.
Disable the FortiGate admin web portal because it may have a certificate.
Assume a Phase 1 parent SA proves every Phase 2 data selector is up.
Change all office DHCP DNS servers.

Explanation

Correct Answer

Gateway diagnostics show Phase 1 parent state while tunnel-list contains data-plane Phase 2 SAs; the two checks isolate the failing layer.

Incorrect Answers

GUI management certificates are not evidence of a missing CHILD SA.

An IKE SA can exist without an accepted child security association.

DHCP DNS settings cannot create a missing negotiated CHILD SA.

Question 483

Security policy now requires AES256-GCM. HQ removed AES128-CBC from Phase 1, but its older branch peer still only offers AES128-CBC. The tunnel immediately stops with no proposal chosen. What is the causal difference?

The protected subnet is no longer in the web-filter profile.
The peers have no overlapping approved IKE encryption proposal after one-sided cipher-suite removal.
The phase2 tunnel route metric was raised one point.
The administrator account lacks SD-WAN monitor permissions.

Explanation

Correct Answer

IKE negotiation compares offered suites; unilateral removal can eliminate the common set and break an otherwise reachable peer.

Incorrect Answers

Web-filter category coverage cannot cause IKE proposal mismatch.

Route selection does not prevent IKE from choosing an agreed Phase 1 cipher.

GUI access permissions cannot make cryptographic proposals disjoint.

Question 484

After replacing a mismatched PSK at an IKEv2 site-to-site peer, UDP/500 reaches both devices. Which result proves Phase 1 authentication succeeded, rather than only network connectivity?

The filtered log shows only IKE_SA_INIT exchanges, followed by an IKE_AUTH rejection.
A capture shows the peer replies on UDP/500, but IKE_AUTH still reports a bad PSK or rejected identity.
The IKE gateway reports an established authenticated SA for the expected peer identity in the filtered IKE/gateway diagnostics.
Both peers have a matching Phase 2 proposal configured, but the IKE gateway has no established authenticated SA.

Explanation

Correct Answer

An established IKE SA after identity/credential exchange demonstrates Phase 1 progressed beyond transport reachability.

Incorrect Answers

IKE_SA_INIT can negotiate parameters, but authentication and authenticated SA establishment have not succeeded.

Transport reachability and an IKE response can coexist with unsuccessful authentication.

Locally configured CHILD SA parameters do not demonstrate successful Phase 1 peer authentication.

Question 485

The branch and HQ have updated an incompatible Phase 1 proposal. The dashboard now says the tunnel is up, but compliance requires AES256-GCM and DH group 19. Which evidence is decisive?

Show that the local Phase 1 proposal includes AES256-GCM, without checking what the peer actually negotiated.
Check only that the IKE gateway status reads established without inspecting the negotiated transform.
Check that both peers can ping a WAN test address and that the VPN interface icon is green.
Inspect the negotiated IKE SA cryptographic parameters on both peers and confirm they match the approved cipher/DH policy.

Explanation

Correct Answer

A green status can hide what was actually negotiated; the accepted IKE proposal is the cryptographic proof.

Incorrect Answers

Configured offers do not show the final chosen suite or whether a weaker alternative was selected.

An established tunnel does not prove the precise encryption, integrity, and DH group required by compliance.

Reachability and interface status do not attest to the negotiated IKE cryptographic suite.

Question 486

A remote FortiGate behind PAT has enabled NAT traversal. Which observed transport behavior demonstrates the protected traffic is using the configured NAT-compatible tunnel path?

UDP/500 IKE succeeds, but the subsequent protected traffic remains native ESP and fails across the PAT device.
Captured post-negotiation encrypted tunnel packets use UDP/4500 encapsulation and translate/return successfully through the NAT device.
The peer reports NAT-T enabled in configuration, but no UDP/4500 encrypted packets return through the carrier NAT.
The branch sends UDP/4500 packets and shows increasing encrypt counts, but the hub never sees those packets.

Explanation

Correct Answer

NAT-T encapsulates ESP into UDP, providing ports and state for a translating middlebox; both directions must be observed.

Incorrect Answers

IKE negotiation alone cannot prove NAT-T data encapsulation; ESP without transport ports can fail through PAT.

A configured flag without observed bidirectional UDP-encapsulated ESP is not a successful NAT-T data path.

One-direction transmission does not prove returnable NAT state or that the translating network passes encrypted payloads.

Question 487

Phase 1 IKEv2 remains up. A new Phase 2 selector for branch 10.9.3.0/24 to HQ 10.20.3.0/24 was added at both peers. What result specifically verifies that protected pair was negotiated?

The established IKE parent SA still lists only the older 10.9.2.0/24 selector pair.
The FortiGate GUI shows the new 10.9.3.0/24 selector in configuration, but no corresponding negotiated CHILD SA.
The IKE gateway is established and sends NAT-T keepalives, but `diagnose vpn tunnel list` has no SA for the new pair.
A CHILD SA appears with the expected local and remote proxy IDs/selectors and relevant encrypt/decrypt counters rise for test traffic.

Explanation

Correct Answer

Phase 2 tunnel state and selector identities show the protected pair is active; counters tie that SA to actual packets.

Incorrect Answers

A working parent SA or unrelated CHILD SA does not validate the newly added protected /24 pair.

Configuration is a proposal; a successfully negotiated SA must appear for the required source/destination pair.

Phase 1 transport and liveness do not attest to selector-specific Phase 2 agreement.

Question 488

After creating the remote subnet route to interface `vpn-hq`, tunnel SAs are already up. What test best proves the new route—not an old Internet default—is carrying office traffic?

The configured static route mentions `vpn-hq`, but the active FIB still chooses the old default route.
Combine a destination route lookup in the correct VDOM with a flow trace/packet counter showing an office packet exits `vpn-hq`.
IKE and CHILD SAs are up, but the next permitted office packet has no flow trace confirming tunnel egress.
The new static route has a lower distance, but only unrelated Internet test traffic has been observed.

Explanation

Correct Answer

An installed destination route and observed tunnel egress establish the actual forwarding decision for that subnet.

Incorrect Answers

A route in configuration is not proof it is installed and preferred for the actual destination.

SA establishment by itself does not tell which route a user packet uses.

Route preference alone is insufficient without destination-specific forwarding and egress verification.

Question 489

After an interface-based site-to-site VPN and routes were corrected, both sites must independently INITIATE TCP/445 connections to the other site. The team added narrowly scoped LAN-to-VPN and VPN-to-LAN accept policies for those separately initiated sessions. Which test verifies both initiations are permitted rather than merely that an IKE SA exists?

Test only the branch-initiated TCP/445 connection and assume its return ACK proves independently originated HQ sessions are also allowed.
Verify the IKE and CHILD SA are established without testing either newly initiated application session.
Send a branch-initiated ping to the HQ tunnel endpoint and infer both hosts can initiate TCP/445.
Run a fresh TCP/445 connection initiated from each site and verify each session matches its intended accept policy and crosses the tunnel.

Explanation

Correct Answer

FortiOS forwarding is stateful: return packets for an accepted session do not by themselves require a separate reverse rule. New connections initiated from both sites must each match their own appropriate policies.

Incorrect Answers

Return packets belong to an established stateful flow; they do not test an independently initiated reverse-direction connection.

Security associations authenticate and encrypt a tunnel, but do not prove the forwarding policies permit each TCP/445 initiation.

A tunnel endpoint ping differs in source, destination, protocol and session-initiation direction from the required application tests.

Question 490

The remote-access pool was moved from overlapping 192.168.1.0/24 to 10.250.100.0/24. What should be checked to prove that the overlap problem is resolved?

Read the configured new remote-access pool but do not check the address received by a real client.
Verify VPN password acceptance while the client still reports a 192.168.1.x tunnel address.
Confirm a client receives a 10.250.100.x tunnel address, has the intended office routes, and can reach an approved office host without local-LAN route collision.
Confirm the client receives 10.250.100.x but has no route to the allowed office destination and never tests reachability.

Explanation

Correct Answer

Both address assignment and usable route behavior must be demonstrated; a new pool in configuration does not prove clients obtained it.

Incorrect Answers

A configuration value is not evidence the client renegotiated a nonoverlapping tunnel address.

Authentication can pass even though the assigned prefix still collides with the client local LAN.

An assigned address alone does not prove end-to-end path selection is free of overlap or policy problems.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 47 - 10 Questions (Last Reviewed 28-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 49 - 10 Questions (Last Reviewed 26-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 50 - 10 Questions (Last Reviewed 25-Sep-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 480

Explanation

Correct Answer

Incorrect Answers

Question 481

Explanation

Correct Answer

Incorrect Answers

Question 482

Explanation

Correct Answer

Incorrect Answers

Question 483

Explanation

Correct Answer

Incorrect Answers

Question 484

Explanation

Correct Answer

Incorrect Answers

Question 485

Explanation

Correct Answer

Incorrect Answers

Question 486

Explanation

Correct Answer

Incorrect Answers

Question 487

Explanation

Correct Answer

Incorrect Answers

Question 488

Explanation

Correct Answer

Incorrect Answers

Question 489

Explanation

Correct Answer

Incorrect Answers

Question 490

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests