Fortinet NSE4_FGT_AD-7.6 Practice Test 7

Question 60

A FortiOS 7.6.0 FGCP cluster has enabled `session-pickup` for transit TCP flows. A long-lived connection using PROXY-based inspection nevertheless restarts after failover. Which limitation explains this?

Enabling session pickup always preserves every proxied connection without interruption.
Proxy-based inspection can maintain connection/proxy state that FGCP does not fully synchronize; `session-pickup` is not a universal guarantee for proxy-scanned sessions.
Failure is always caused by FortiGuard licensing and never by session-state synchronization.
Changing only the cluster administrator GUI certificate guarantees existing proxied TCP flows survive.

Explanation

Correct Answer

Fortinet documents that proxy-based inspection sessions do not generally fail over via FGCP session-pickup; the behavior differs from supported flow-based transit TCP sessions.

Incorrect Answers

Not all proxy application state is synchronized, so this statement exceeds the documented support.

The scenario isolates a proxy session continuity limitation independent of whether the security subscription is active.

Administrative certificate selection is unrelated to connection state continuity across an HA failover.

Question 61

An FGCP active/passive cluster has been changed to prevent a recovered high-priority unit from unnecessarily taking over a healthy primary. Select TWO checks that validate the election behavior without confusing it with session pickup.

Check an IPS category database version as the evidence of primary selection.
Disable heartbeat permanently so the current primary cannot be challenged.
Confirm only that new TCP sessions use the Internet after recovery.
Record HA override/priority settings and the active member before a controlled recovery test.
Reconnect the recovered unit and verify the healthy primary retains its role according to the chosen no-preemption election policy.

Explanation

Correct Answer

Election policy and the starting primary state are needed to interpret whether preemption should occur.

Post-recovery role observation tests the actual desired behavior of the HA election after the member rejoins.

Incorrect Answers

An IPS update is unrelated to FGCP override/election settings.

Permanent heartbeat loss destroys stable cluster membership and can create split-brain behavior.

New forwarding sessions can succeed even if an unnecessary primary role swap occurred.

Question 62

A FortiOS 7.6.0 cluster has reserved port8 management interfaces with different addresses and gateways on each unit. Which controlled test verifies the *secondary* can be managed without failing over production traffic?

From an authorized OOB host, reach the secondary's unique port8 IP directly, authenticate, and confirm its device identity while the primary remains active.
Ping only the shared cluster data-plane address.
Disable all heartbeat links and see if the subordinate becomes primary.
Check that a forwarding policy has UTM profiles enabled.

Explanation

Correct Answer

Member-specific management reachability proves the reservation, address and admin access work independently of the shared data interface.

Incorrect Answers

This usually tests the current primary and does not prove access to the subordinate member.

This changes the cluster role and introduces split-brain risk rather than validating OOB access.

User data-flow inspection cannot verify direct administrative reachability to the standby unit.

Question 63

After an FGCP configuration-sync incident was corrected, an administrator needs proof that a newly added firewall address group is present in both units. Which acceptance evidence is appropriate?

Check the two units use the same GUI hostname.
Check HA synchronization state/checksum consistency and verify the shared address group exists on both members.
Confirm only the primary can ping the Internet.
Compare the member device priorities.

Explanation

Correct Answer

HA status alone without checking the affected shared object can miss a remaining configuration difference; both checksum and object presence support closure.

Incorrect Answers

HA hostnames are intentionally member-specific and do not attest to a shared address-group object.

WAN reachability on one member cannot prove secondary shared-object synchronization.

Priority controls election behavior and is not a policy-object consistency check.

Question 64

A supported FGCP firmware change has finished. Before closing the maintenance ticket, which combination of observations is most relevant?

A screenshot that the firmware image finished uploading to one unit.
Both members report the intended compatible FortiOS build, synchronized configuration and expected active/subordinate state, with forwarding tested.
The GUI login page has new artwork.
The secondary unit can resolve a FortiGuard hostname.

Explanation

Correct Answer

The exact versions and synchronization prove the upgrade ended in a supported HA steady state, while traffic testing catches forwarding regression.

Incorrect Answers

An uploaded image does not prove both members booted the same version or regained cluster service.

Cosmetic GUI changes are not evidence of cluster health, peer versions or traffic recovery.

External DNS on one member cannot establish full HA firmware, synchronization and forwarding acceptance.

Question 65

A client on port5 cannot reach 203.0.113.20:443 through a FortiGate, although an administrator sees a broad accept rule. Which bounded diagnostic provides the actual processing decision for that connection?

Read only the GUI policy name and conclude it must match.
Clear the complete session table repeatedly without collecting a trace.
Raise the IPS signature threshold on every policy.
Filter `diagnose debug flow` to the client/destination, generate one test connection, and interpret the route and matched-policy/drop lines.

Explanation

Correct Answer

A flow trace records the packet tuple and the FortiOS route/policy decision, which is more discriminating than the apparent rule configuration.

Incorrect Answers

A visible policy does not prove the session selected that policy or had a usable route.

Resetting state may disrupt unrelated users and hides the policy/route reason for the denial.

The failure may occur in routing or policy selection before inspection; broad IPS changes cannot localize it.

Question 66

FortiOS reports conserve mode during peak traffic and new proxied sessions intermittently fail. A process memory chart shows one worker using unusually large RAM. What action isolates the operational issue safely?

Disable all antivirus and IPS profiles immediately on every firewall rule.
Increase the administrative HTTPS timeout.
Inspect memory/conserve status and process consumption, identify the growth source, then apply a supported targeted mitigation.
Raise SD-WAN member cost on the healthy WAN link.

Explanation

Correct Answer

Conserve mode is a memory-pressure protection state; process and threshold evidence is needed before changing process limits or inspection settings.

Incorrect Answers

Disabling protections has a security cost and is not justified without showing that they cause the memory pressure.

Management login timers do not cure RAM consumption or conserve-mode triggers.

WAN selection is not a direct remedy for FortiOS system memory exhaustion.

Question 67

A switch reports sending packets toward FortiGate port2, but an appropriately filtered firewall policy-flow trace shows no matching inbound packet. Which next test separates delivery loss from downstream policy denial?

Run a bounded `diagnose sniffer packet` on port2 with a filter for the expected source and destination.
Add an any-to-any accept policy without observing ingress.
Check only the user's authentication group in FSSO.
Change the web-filter category of the destination.

Explanation

Correct Answer

A capture at the ingress interface establishes whether the packet actually arrives; if absent, investigate cabling/VLAN/upstream delivery before policy order.

Incorrect Answers

An accept policy cannot act on a packet that never reaches the correct FortiGate interface.

Identity policy is downstream and cannot distinguish missing ingress traffic from a policy denial.

A rating adjustment does not reveal whether the frame reached port2.

Question 68

Immediately after applying a broad IPS sensor, FortiGate CPU usage spikes while interface bandwidth changes little. Which evidence supports identifying the real CPU consumer before tuning?

Correlate per-process/IPS engine CPU utilization with sensor activation and affected traffic or signature logs.
Assume every CPU spike is caused by BGP neighbor resets.
Increase the GUI session timeout to reduce CPU load.
Disable all WAN interfaces until graphs look normal.

Explanation

Correct Answer

Per-process attribution and test intervals can distinguish costly inspection from unrelated routing or log activity.

Incorrect Answers

BGP may use CPU, but that hypothesis ignores the observed signature-sensor change and process attribution.

Administrator idle sessions are not evidence of signature scanning CPU demand.

Disconnecting traffic obscures the responsible process and creates avoidable downtime.

Question 69

A wired uplink drops existing sessions each time its speed/duplex renegotiates. Traffic logs show different policy IDs at different times, but interface error counters rise with every renegotiation. What should be investigated first?

Check transceiver, cabling, interface negotiation and peer speed/duplex settings alongside CRC/error counters.
Increase user group authentication cache duration.
Turn on proxy antivirus for the affected link.
Lower the application-control block severity.

Explanation

Correct Answer

Repeated carrier negotiation and physical errors can terminate sessions before the security policy is relevant, so both ends of the physical link need examination.

Incorrect Answers

Authentication mapping does not produce Ethernet CRC errors or repeated link renegotiation.

Malware inspection does not correct physical-layer clocking or cabling issues.

An IPS/application decision cannot stabilize a flapping physical port.

Question 70

From the FortiGate CLI, an approved public IPv4 address responds to a ping, but `execute ping example.net` fails because the hostname cannot resolve. Which system dependency should be checked?

Increase the IPv4 firewall policy session TTL.
Change the virtual IP mapping for an unrelated inbound service.
Verify configured DNS servers, resolver reachability and name-resolution responses before changing internet routing.
Enable IPS on all LAN policies.

Explanation

Correct Answer

Successful direct IP transport with failed hostname lookup points to DNS lookup or its upstream connectivity, not necessarily a missing default route.

Incorrect Answers

A session timer does not supply A/AAAA records for a hostname.

DNAT for a published server does not govern FortiGate-originated DNS queries.

Intrusion inspection cannot create a missing resolver response.

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests

Fortinet NSE4_FGT_AD-7.6 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 7 - 10 Questions (Last Reviewed 07-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
Fortinet NSE4_FGT_AD-7.6 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)

Pass Your Fortinet NSE4_FGT_AD-7.6 Exam Easy!

Question 60

Explanation

Correct Answer

Incorrect Answers

Question 61

Explanation

Correct Answer

Incorrect Answers

Question 62

Explanation

Correct Answer

Incorrect Answers

Question 63

Explanation

Correct Answer

Incorrect Answers

Question 64

Explanation

Correct Answer

Incorrect Answers

Question 65

Explanation

Correct Answer

Incorrect Answers

Question 66

Explanation

Correct Answer

Incorrect Answers

Question 67

Explanation

Correct Answer

Incorrect Answers

Question 68

Explanation

Correct Answer

Incorrect Answers

Question 69

Explanation

Correct Answer

Incorrect Answers

Question 70

Explanation

Correct Answer

Incorrect Answers

Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests