Question 70
From the FortiGate CLI, an approved public IPv4 address responds to a ping, but `execute ping example.net` fails because the hostname cannot resolve. Which system dependency should be checked?
- Increase the IPv4 firewall policy session TTL.
- Change the virtual IP mapping for an unrelated inbound service.
- Verify configured DNS servers, resolver reachability and name-resolution responses before changing internet routing.
- Enable IPS on all LAN policies.
Explanation
Correct Answer
C:Successful direct IP transport with failed hostname lookup points to DNS lookup or its upstream connectivity, not necessarily a missing default route.
Incorrect Answers
A:A session timer does not supply A/AAAA records for a hostname.
B:DNAT for a published server does not govern FortiGate-originated DNS queries.
D:Intrusion inspection cannot create a missing resolver response.
Question 71
A route-based IPsec tunnel shows established IKE and CHILD SAs, yet traffic from 10.1.0.0/24 to 10.2.0.0/24 does not increment the tunnel's outbound counters. What forwarding boundary should be checked next?
- Change the remote peer's certificate expiration date.
- Increase DNS TTL for the FortiGuard update hostname.
- Set an administrator profile to read-only.
- Inspect the route to 10.2.0.0/24, selected firewall policy and matching selectors for the actual source/destination flow.
Explanation
Correct Answer
D:A negotiated tunnel does not automatically route or allow protected traffic; outbound counters remaining zero suggest the flow is not being sent into the SA.
Incorrect Answers
A:IKE and CHILD SAs are already established; the immediate issue is dataplane path selection.
B:Update-service DNS cache does not decide which route carries the protected subnets.
C:Administrator RBAC does not determine encrypted client forwarding.
Question 72
An employee is moved from Finance to Engineering. The Engineering policy is present, but the current authenticated session still carries the old group and receives the Finance deny action. Which state must be refreshed?
- Replace the firewall's default route with an SD-WAN rule.
- Disable packet logging on the Finance rule.
- Enable HTTPS admin access on the outside interface.
- Inspect and refresh the effective user-to-group authentication mapping, then verify the matching identity policy.
Explanation
Correct Answer
D:User authentication caches can retain prior group data; a rule can be correct while the current identity/session does not match its group.
Incorrect Answers
A:Routing does not update the user's effective authentication group.
B:Log suppression does not change the policy decision for a stale group identity.
C:Local administrator access is unrelated to forward-user group selection.
Question 73
A filtered FortiOS debug flow shows a valid next-hop lookup, followed by `Denied by forward policy check` for a test TCP SYN. Which conclusion is supported by this order of events?
- The FortiGate lacks an L3 route to the destination.
- The route lookup succeeded, but the packet failed the forwarding-policy decision for the actual tuple.
- The WAN physical carrier is down.
- The TLS server certificate is expired.
Explanation
Correct Answer
B:The trace narrows failure to the policy check rather than absent routing; the engineer should inspect matching rules, order and interfaces.
Incorrect Answers
A:The displayed trace explicitly found a valid next hop before the policy denial.
C:A received/processed SYN and successful route lookup do not prove a failed physical interface.
D:The packet was denied at forwarding policy, before HTTPS certificate validation.
Question 74
During an incident, interface carrier stays up and existing ICMP traffic sometimes works, but FortiOS emits conserve-mode transition events and new proxied requests fail. What does this evidence most strongly implicate?
- The upstream ISP removed the route to the DNS resolver.
- The administrative HTTPS certificate is untrusted.
- The SD-WAN rule must have the wrong traffic steering SLA.
- Memory pressure has crossed a configured conserve threshold and is affecting allocation of some new sessions.
Explanation
Correct Answer
D:Conserve-mode events identify the FortiOS resource protection state; a link can stay healthy while memory-sensitive flows are limited.
Incorrect Answers
A:A route loss would not itself generate conserve-mode threshold transitions.
B:A GUI trust error cannot explain systemwide low-memory events and new flow allocation failures.
C:Link selection symptoms do not establish the recorded memory-protection state.
Question 75
On an NP7-capable FortiGate, a long-lived forwarded TCP session carries traffic and its interface counters rise, but a new `diagnose debug flow` trace displays no packets from that established session. Which limitation should be considered before declaring packets lost?
- All such traffic must be blocked by an implicit firewall policy.
- The device's DHCP pool must be exhausted.
- The administrator profile does not allow viewing logs.
- Hardware-offloaded sessions may bypass software flow tracing; use supported NP7 sniffer diagnostics or a safe controlled test.
Explanation
Correct Answer
D:Fortinet documents that NPU offload can hide accelerated packets from software debug flow, so empty output is not proof of network loss.
Incorrect Answers
A:An established offloaded session can continue forwarding without fresh software trace lines.
B:The observed established TCP session and NPU forwarding are unrelated to LAN address leasing.
C:Debug-flow visibility for offloaded packets is a dataplane-path limitation, not just GUI log permissions.
Question 76
FortiGate CPU rises from 30% to 95% only while a newly enabled IPS sensor processes a traffic replay. `diagnose sys top` attributes most CPU to inspection workers, while BGP routes remain stable. What is the defensible diagnosis?
- The default route administrative distance is too low.
- The remote user's LDAP password was rejected.
- The tested IPS workload/sensor is driving CPU consumption; inspect relevant signatures and processing behavior before tuning.
- The management GUI SSL certificate requires renewal.
Explanation
Correct Answer
C:Time-correlated inspection-worker CPU and stable routing exclude a route flap as the primary explanation for this observation.
Incorrect Answers
A:Routing distance does not explain inspection-worker CPU saturation during controlled replay.
B:Directory authentication failure cannot account for the measured inspection process CPU.
D:Certificate trust affects HTTPS admin login, not CPU attributable to IPS traffic processing.
Question 77
A FortiGate port repeatedly renegotiates speed while forwarded TCP sessions reset. Select TWO observations that directly corroborate a physical link negotiation fault before changing a security policy.
- Interface/link logs show repeated carrier or speed/duplex transitions at the time sessions fail.
- The URL filtering category applied to HTTPS was changed last week.
- The HA member's administrator trusted-host list is too broad.
- Physical interface CRC/frame error counters rise on the FortiGate or connected peer during the same interval.
- A user lacks an FSSO group mapping for the login policy.
Explanation
Correct Answer
A:Time-correlated link-state changes identify a physical interruption independent of the firewall policy action.
D:Increasing link-level errors are evidence of physical cabling/transceiver/negotiation trouble, not a content-inspection false positive.
Incorrect Answers
B:Web categorization does not demonstrate physical carrier renegotiation or frame errors.
C:Management-source restrictions do not create data-interface link errors.
E:Identity policy mismatch can deny sessions, but it does not explain physical port renegotiation and CRC growth.
Question 78
A FortiGate resolves no domain names after its upstream DNS server is changed, but `execute ping 1.1.1.1` works and traceroute to public IPs succeeds. What failure layer is isolated?
- A missing WAN interface default route is certain.
- The application-control signature package is stale.
- DNS server configuration, access or resolver response handling—not basic default-route connectivity.
- The FortiGate HA override setting is enabled.
Explanation
Correct Answer
C:Numeric IP communication proves the FortiGate can route some traffic, while hostname resolution relies on separate DNS services.
Incorrect Answers
A:Successful external numeric IP pings and traces contradict a complete absence of IP routing.
B:Signature age cannot prevent the FortiGate CLI from resolving an arbitrary hostname.
D:HA election preference does not define the DNS lookup protocol path.
Question 79
A route-based IPsec tunnel is up, and the intended LAN-to-LAN policy explicitly accepts the flow, but the routing table sends the remote 10.22.0.0/16 network out WAN1. Where is the remaining fault?
- The remote protected subnet does not have an effective route via the IPsec interface.
- The phase 1 pre-shared key is wrong.
- The IPS signature action is Monitor rather than Block.
- The administrative login role has insufficient permissions.
Explanation
Correct Answer
A:The route lookup selects WAN1 despite a valid tunnel; policy accept alone cannot redirect packets into the IPsec route-based interface.
Incorrect Answers
B:Established IKE and CHILD SAs show that initial authentication and negotiation already succeeded.
C:An IPS action does not direct accepted packets into the route-based tunnel.
D:Administrator authorization is not the installed route for LAN traffic.
Question 80
A FortiGate forward policy allows group Engineering. After a laptop takes a different DHCP address, the identity monitor still lists its prior address under Engineering. New traffic from the new IP is denied by the default rule. What is the most direct root cause?
- The IPsec peer has a Phase 2 proposal mismatch.
- The HTTPS web category is incorrect.
- The current source IP is not associated with the authenticated Engineering identity in the effective user/IP mapping.
- The DHCP option for NTP is not configured.
Explanation
Correct Answer
C:Identity-based policy matching uses the current endpoint identity/IP state; an old address entry cannot authorize sessions from a new address.
Incorrect Answers
A:The failure is LAN identity matching on a non-VPN session, not IKE negotiation.
B:No web-filter decision is reached if user authentication mapping fails the intended firewall policy.
D:NTP provisioning does not populate the source address into the authenticated identity table.
Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests