Fortinet NSE4_FGT_AD-7.6 Practice Test 50

Question 490

The remote-access pool was moved from overlapping 192.168.1.0/24 to 10.250.100.0/24. What should be checked to prove that the overlap problem is resolved?

Read the configured new remote-access pool but do not check the address received by a real client.
Verify VPN password acceptance while the client still reports a 192.168.1.x tunnel address.
Confirm a client receives a 10.250.100.x tunnel address, has the intended office routes, and can reach an approved office host without local-LAN route collision.
Confirm the client receives 10.250.100.x but has no route to the allowed office destination and never tests reachability.

Explanation

Correct Answer

Both address assignment and usable route behavior must be demonstrated; a new pool in configuration does not prove clients obtained it.

Incorrect Answers

A configuration value is not evidence the client renegotiated a nonoverlapping tunnel address.

Authentication can pass even though the assigned prefix still collides with the client local LAN.

An assigned address alone does not prove end-to-end path selection is free of overlap or policy problems.

Question 491

Two FortiGates now agree on Phase 2 PFS group 14 and form a CHILD SA. The ticket arose after previous connections failed only at rekey. Which test proves durable correction?

Confirm that the first CHILD SA became established after the PFS change but do not observe any rollover.
Compare only the configured Phase 2 PFS group, without inspecting the negotiated replacement SA.
Trigger/observe a controlled CHILD SA rekey and confirm the replacement SA negotiates the required PFS group while user traffic remains encrypted.
Increase application TCP timeouts during rekey but do not inspect tunnel SA replacement.

Explanation

Correct Answer

A successful rekey verifies the exact lifecycle and PFS negotiation that previously failed, beyond a one-time initial green SA.

Incorrect Answers

The reported failure occurred at rekey, so first establishment alone does not test the defect.

Matching proposals in configuration do not show that an actual rekey completed and maintained the intended group.

Longer tolerance can hide outages but does not prove the cryptographic exchange now succeeds.

Question 492

After a dynamic DNS update, HQ should reach branch at a newly assigned public address. What observation confirms the new endpoint is actually in use?

The peer hostname resolves to the updated public address and filtered IKE traffic/gateway state shows a successful exchange with that address.
Verify the hostname resolves to the new address, but the IKE gateway still shows the old public peer.
Observe an established IKE SA to the prior public address after the DNS update.
Check only that DPD attempts continue against the old peer without a new exchange.

Explanation

Correct Answer

Both DNS resolution and contacted remote IKE peer state must match; a new DNS record alone may not prove reconnection.

Incorrect Answers

DNS update is not proof the FortiGate has established a new session with the changed address.

A previously established SA is not evidence of re-negotiation to the newly assigned endpoint.

Dead-peer checks can continue on a stale remote endpoint and do not validate the desired address switch.

Question 493

A branch has primary `vpn-a` and backup `vpn-b`, both permitted for HQ 10.44.0.0/16. After introducing health-aware routing, what acceptance test proves resilience?

Observe that both `vpn-a` and `vpn-b` CHILD SAs are listed as up, without withdrawing the primary underlay.
Fail the primary underlay and observe that a preferred static route keeps new sessions pointed at dead `vpn-a`.
Fail the primary underlay in a controlled test and verify the active route plus new permitted session switches to `vpn-b` within the required recovery objective.
Check only that the secondary tunnel has a larger configured priority number, without a controlled failure test.

Explanation

Correct Answer

An actual failure test demonstrates the route table withdraws the unusable primary path and data-plane traffic takes the healthy alternate.

Incorrect Answers

Configured or negotiated backup SAs do not prove routes and traffic switch when the primary path fails.

The route remains tied to an unusable underlay, which is the opposite of successful failover.

Priority configuration cannot establish route withdrawal, convergence time or working backup data plane.

Question 494

A carrier NAT expires UDP flows after 45 seconds; the FortiGate NAT-T keepalive was reduced to 15 seconds. Which test demonstrates that the prior idle VPN outage is resolved?

Maintain a continuous encrypted stream through the full test and observe no disconnect.
Leave the tunnel idle beyond the NAT mapping timeout, confirm keepalive packets refresh UDP state, then pass encrypted traffic without reauthenticating unexpectedly.
Wait longer than 45 seconds without observing NAT-T keepalives, then check only that the FortiGate GUI still shows a tunnel icon.
Check only that the keepalive value is 15 seconds in configuration, without testing an idle interval and resumed encrypted traffic.

Explanation

Correct Answer

The failure mode was idle state expiry; a realistic idle test plus successful resumed data transfer confirms the timer is effective.

Incorrect Answers

Data packets themselves refresh NAT state, so this cannot isolate idle keepalive behavior.

A displayed tunnel icon can persist while the translation mapping needed for the next encrypted packet has expired.

A configured timer does not demonstrate packets reached the carrier NAT or kept the mapping alive.

Question 495

A branch-to-HQ request reaches HQ over an IPsec tunnel. Return routing was corrected. Which observation confirms the original asymmetric path problem is gone?

Both peers show matching directionally increasing encrypt/decrypt counters for the test and the reply arrives over the IPsec interface.
The branch encrypt counter rises, but the hub has no corresponding decrypt or encrypted return counter.
A public host can ping both FortiGate WAN addresses, while the site-to-site request has no private reply.
HQ has a default ISP route while the private branch subnet has no observed tunnel-route return flow.

Explanation

Correct Answer

A bidirectional encrypted request/response requires each peer to encrypt its outgoing direction and decrypt the corresponding incoming direction.

Incorrect Answers

Only one transmission direction is evident and return-path asymmetry remains unresolved.

Independent public reachability cannot establish that the protected return packet used the IPsec path.

A generic default could cause asymmetric return; it is not evidence of a protected bidirectional path.

Question 496

The hub installed the correct CA chain and replaced a certificate with a subject matching its configured branch peer ID. What evidence best verifies identity-based IKE success?

The leaf certificate chain is trusted, but IKE logs still reject the remote peer identity.
A generic IKE SA with a different peer identity establishes on another tunnel interface.
The new CA certificate is installed, but the filtered IKE daemon still reports an identity or authentication failure.
An established authenticated IKE SA to the intended peer and certificate/identity verification logs without chain or ID errors.

Explanation

Correct Answer

A certificate can be trusted yet belong to another peer; successful exchange with matched identity establishes the authorization condition.

Incorrect Answers

A trusted certificate alone is insufficient when the specific IKE peer ID is wrong.

Success with an unrelated gateway does not authenticate the intended peer configuration.

Configuration or trust-store presence does not prove the authenticated exchange passed identity checks.

Question 497

An upstream firewall was changed to allow UDP 500/4500. Two FortiGates behind NAT now negotiate; what transport evidence confirms the required services are correctly allowed?

ICMP reaches the remote WAN and a local capture sees outbound UDP/500, but the peer returns no IKE packets.
UDP/500 IKE establishes but the upstream ACL still drops all encapsulated UDP/4500 ESP traffic.
A stale CHILD SA appears established, but test packets have no encrypt/decrypt counter change across the upstream ACL.
Capture bidirectional UDP/500 IKE and, when NAT-T is selected, UDP/4500 encapsulated traffic with a working IPsec SA.

Explanation

Correct Answer

The actual IKE exchange and NAT-T data flow establish the ACL permits this deployment’s transport rather than just generic ICMP.

Incorrect Answers

ICMP and one-way IKE do not prove the upstream ACL permits the required bidirectional negotiation.

NAT traversal needs the encrypted UDP/4500 data path in addition to IKE negotiation.

An SA display without active bidirectional IPsec traffic can mask an ACL block in the data plane.

Question 498

Both peers now use compatible Phase 2 rekey policy. What evidence distinguishes a durable repair from an initially established but unstable tunnel?

Verify only the first successful CHILD SA lifetime value after initial tunnel establishment.
Review the matching local Phase 2 configured timers without observing replacement SA negotiations.
Run a brief application ping that ends before the first scheduled CHILD SA rekey.
Monitor several scheduled CHILD SA rekeys and confirm new SAs replace old ones within negotiated lifetime while permitted user sessions continue.

Explanation

Correct Answer

Repeated successful rollover verifies timer/proposal interoperability that a one-time SA status snapshot cannot prove.

Incorrect Answers

A one-time state cannot demonstrate the later rekey transition that previously caused blackouts.

Configuration equality does not guarantee remote interoperability or a stable actual rekey.

This fails to exercise the multi-cycle failure window and cannot establish durable tunnel operation.

Question 499

An IPsec Phase 2 was expanded to carry two separate branch subnets 10.8.1.0/24 and 10.8.2.0/24. The first subnet works. What test demonstrates that the second was not omitted?

Send permitted traffic from 10.8.2.0/24, check the correct CHILD SA selector/policy match and verify encrypt/decrypt counters for that flow.
Send only 10.8.1.0/24 traffic through its existing CHILD SA and assume the second /24 is covered.
Read only the locally configured selector for 10.8.2.0/24 without verifying a negotiated SA or packet counters.
See increasing total IKE parent-SA lifetime but no source-identified traffic from 10.8.2.0/24.

Explanation

Correct Answer

A successful first subnet does not prove another protected selector is accepted; test the second distinct source pair directly.

Incorrect Answers

A successful first source prefix does not prove new selectors or policies match the other source subnet.

A configured selector can be rejected or remain unused; the actual protected traffic must exercise it.

Parent SA liveness does not establish additional CHILD SA source-prefix coverage.

Question 500

An administrator migrated a site-to-site connection into FortiOS 7.6.0 interface-based IPsec with policy-based NGFW operating-mode considerations. The tunnel now negotiates, but the original outage involved missing data-plane allows. Which THREE independent acceptance observations prove the private application path is usable and scoped correctly?

The IKE SA reports established, but no destination-specific FIB path or protected application test is performed.
The active route in the correct VDOM resolves the approved remote subnet over the virtual IPsec interface.
An all-to-all firewall accept policy now permits tunnel traffic, with no restriction to approved business networks or ports.
Actual source/destination/service traffic matches intended accept policies in the necessary directions and no implicit deny.
A single public WAN connectivity test passes, but no source-scoped private application traffic enters the IPsec interface.
A representative approved application transaction completes over the IPsec path with bidirectional encrypt/decrypt counters and source/destination evidence.

Explanation

Correct Answer

A successful SA alone does not route protected application packets into the tunnel.

Tunnel forwarding still requires approved firewall permissions for its real ingress/egress interfaces.

End-to-end traffic plus SA counters confirms both security policy and data-plane tunnel delivery work.

Incorrect Answers

Cryptographic Phase 1 alone does not demonstrate route installation or data-plane service authorization.

A broad allow does not demonstrate that the migrated application path is scoped to the requested source/destination/service boundary.

WAN reachability is not the protected private application transaction the acceptance test must prove.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 49 - 10 Questions (Last Reviewed 26-Sep-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 50 - 10 Questions (Last Reviewed 25-Sep-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 490

Explanation

Correct Answer

Incorrect Answers

Question 491

Explanation

Correct Answer

Incorrect Answers

Question 492

Explanation

Correct Answer

Incorrect Answers

Question 493

Explanation

Correct Answer

Incorrect Answers

Question 494

Explanation

Correct Answer

Incorrect Answers

Question 495

Explanation

Correct Answer

Incorrect Answers

Question 496

Explanation

Correct Answer

Incorrect Answers

Question 497

Explanation

Correct Answer

Incorrect Answers

Question 498

Explanation

Correct Answer

Incorrect Answers

Question 499

Explanation

Correct Answer

Incorrect Answers

Question 500

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests