NSE4_FGT_AD-7.6 — Fortinet NSE 4 · FortiOS 7.6 Administrator All 84 questions & answers on one page · harvested from ExamTopics discussion threads, Google search + Fortinet official docs · 74 exhibit images

Padlock icon shown in D means reliable logging is enabled. The CLI command for reliable logging is ‘set reliable enable’ which doesn't appear in B. This means that D is correct as it shows the padlock

Padlock icon means reliable logging is enabled

• In the GUI: • Navigate to Log & Report > Log Settings. • Look at the Remote Logging and Archiving section. • If you are sending logs to FortiAnalyzer/FortiManager, look for a Padlock Icon next to the configuration. In newer versions of FortiOS (like 7.4/7.6), this icon explicitly indicates that a secure, reliable connection (TCP/SSL) is being used

Option B is a red herring It should have "set reliable enable" in the output.

Statement B: Technically true, but exam-flawed Scenario: Source IP 10.100.110.10 arrives on port3. Strict RPF is disabled. Logic: The packet arrives on port3, but the route back to it is the default route on port2. Because Strict RPF is disabled, the FortiGate checks for any route. The default route technically acts as a valid route for Loose RPF in FortiOS, which would mean the packet is allowed. However, in Fortinet exam logic, Option D is the intended answer because it directly tests your understanding of how the default route interacts with Strict RPF, whereas Option A already serves as the designated test for Loose RPF using an explicit route.

With strict RPF disabled, asymmetric routing is allowed. So, a packet sourced from 10.100.110.10 (not present in the routing table) and arriving on port3 will be accepted as long as a return route exists (default route via port2). With strict RPF disabled, a packet from 10.0.13.10 arriving on port2 is also allowed, even though the routing table expects it to come via port6, since the system does not enforce the interface check without strict RPF.

A is correct with strict RPF disabled since it is in the routing table. D is correct with strict RPF enabled because it's the default route

When technically C is the only Incorrect Answer, I expect the Correct answer is B and D as it shows you understand the concept between the Loose and Strict RPF. So picking One of each is Probably the best option even if A is technically correct

A. FortiGate SD-WAN Performance SLAs can monitor link quality using two methods: Active measurement and Passive measurement B. Performance SLAs are commonly used with SD-WAN strategies such as: Lowest Cost (SLA) Best Quality Maximize Bandwidth Manual D. When configuring a Performance SLA, you can define thresholds for all supported metrics, including: Latency Jitter Packet loss If any metric exceeds its configured threshold, the SLA is considered failed.

The correct answer are ABD

✅ Correct answers: A, B, D ✔️ A. They can be measured actively or passively True ✅ Active → probes (ping, HTTP, etc.) Passive → real traffic monitoring ✔️ B. They are applied in a SD-WAN rule lowest cost strategy True ✅ SLAs are used to select best link, including lowest cost + performance ✔️ D. All the SLA targets can be configured True ✅ You can configure thresholds like: latency jitter packet loss

The correct answers are ABD

A. Both interfaces must have directly connected routes on the routing table. (Correct) When an interface receives an IP address with a network mask, the FortiGate automatically creates a directly connected route to that network in the routing table. B. In NAT mode, each Layer 3 interface must have an IP address to: serve as the gateway for the connected network; participate in routing; enable the creation of the directly connected route. Without an assigned IP, the interface functions merely as a physical port with no routing capability.

✅ Correct answers: A and B ✔️ A. Both interfaces must have directly connected routes on the routing table True ✅ When you assign an IP to an interface → FortiGate automatically creates a connected route Needed for proper routing between LAN and DMZ ✔️ B. Both interfaces must have IP addresses assigned True ✅ In NAT mode, interfaces must have IPs to: route traffic act as gateway for networks

ANS: A and B

It's not mandatory to select roles. But you need IP addresses and connected routes

D. When Full SSL Inspection is enabled, the FortiGate performs a process known as SSL/TLS Interception (or authorized Man-in-the-Middle). This is exactly the behavior described in the question: HTTPS → displays a certificate warning. HTTP → does not use TLS certificates, so it does not display an error.

With full SSL inspection, FortiGate: Decrypts HTTPS traffic Re-signs it using its own certificate (CA) If that FortiGate CA is not installed/trusted in the browser/device → Browser shows certificate warning

With full SSL inspection, FortiGate: Decrypts HTTPS traffic Re-signs it using its own certificate (CA) If that FortiGate CA is not installed/trusted in the browser/devic

The only reason not to present a user with the login page must be that the user is already known/authenticated to the firewall. FSSO seems to be one of the valid ways this is possible.

DNS must be allowed to do resolution. Important protocols to add for active authentication: DNS HTTPS HTTP FTP Telnet

Firewall authentication generally requires the DNS service to be enabled in the firewall policy to correctly resolve hostnames during the authentication process. If DNS is not allowed in the firewall policy, the FortiGate cannot resolve external domains, and as a result, the user may not be presented with the login prompt when attempting to access an external website. Reference: FortiOS 7.4.1 Administration Guide: Firewall Authentication Configuration

Correct answer: ✅ A. The Service DNS is required in the firewall policy.

FortiGate allows you to view firewall policies in two main ways: 1. Interface Pair View In this view, policies are grouped by interface pair (Incoming Interface → Outgoing Interface). 2. By Sequence View In this view, all policies appear in a single list, exactly in the order in which FortiGate evaluates them.

The Core Concept: Top-Down Evaluation FortiGate evaluates firewall policies top-down. When a packet enters the firewall, FortiOS checks it against the very first policy on the list. If it matches, the firewall applies the action (Accept or Deny) and stops looking. If it doesn't match, it moves to the second policy, and so on, until it hits the implicit deny rule at the bottom.

Interface Pair View Groups policies by incoming → outgoing interface pairs Not actual execution order By Sequence View Shows top-to-bottom order This is the real processing order FortiGate uses

On the FortiGate, security profiles (such as Web Filter, Application Control, IPS, etc.) are created with a specific feature set, which can be: Flow-based Proxy-based If there is an incompatibility, the profile will not appear in the policy's drop-down list. This is exactly the behavior described in the question.

Web filter profiles (especially with features like quota) require a specific inspection mode If the policy is using: Flow-based vs Proxy-based mismatch The profile will NOT appear in dropdown

Correct answer: ✅ A. The inspection mode in the firewall policy is not matching with web filter profile feature set.

"Some features of security profiles, such as quota in Web Filter, require the policy to use proxy-based inspection. If the policy is set to flow-based mode, profiles that use those features will not be selectable."

Disable: FortiGate never sends DPD probes to the remote peer, but responds to DPD probes received On-idle: FortiGate sends DPD probes when no traffic is observed in the tunnel (outbound or inbound). On-demand: FortiGate sends DPD probes if there is only outbound traffic through the tunnel, but no inbound. On-demand is the default setting.

on-idle sends probes when the tunnel has no traffic in either direction

Answer is On-Demand when there is no Inbound connection. On-idle is for when there is no inbound/outbound.Disabled option is that the FW will only respond to DPD probes and is like listener.

On Idle → Trigger: lack of inbound traffic → Action: send DPD probes ✔ This directly matches the requirement On Demand → Trigger: outbound traffic is sent but no response is received → Action: send DPD probes ✖ This does not trigger just because the tunnel is quiet

B and D. You tube falls into Excessive BWD and according to App override filter , it would be blocked. Facebook is the social media category and it is blocked by that

Youtube search is under the excessive bandwidth behaviour and googel vendor, given that the behaviour is first in the override section that will block search as it matches

Application Scan order 1. Application and filter override 2. Categories => Youtube is blocked by application and filter Override Excessive BWD => facebook blocked by Social media Category

Facebook belongs to the Social Media application category, which is set to Block in the application sensor. Therefore, any Facebook application traffic is blocked by category. The Google application override is set to Monitor, which means traffic is allowed, just logged. The Video/Audio category (which includes YouTube video playback) is blocked, but this does not block YouTube Search, which is just browsing and searching on the site, is not blocked by the Video/Audio category unless the actual video stream starts.

HSTS is not enabled in any of the listed sites and reputable domains are not enabled. As a result B,D are correct

A. HSTS issue Some websites (especially banking/secure ones) use HSTS (HTTP Strict Transport Security) When FortiGate does deep SSL inspection, it replaces the certificate → browser sees it as untrusted Result: site may break or be blocked So they are excluded to avoid access issues D. Privacy & legal reasons Categories like: Finance & Banking Health & Wellness These handle sensitive personal data Many regulations (GDPR, privacy laws) → you should NOT inspect/decrypt this traffic So FortiGate exempts them to protect privacy

This configuration is found within the SSL/SSH Inspection Profile. It allows administrators to bypass the "Man-in-the-Middle" decryption process for specific types of traffic. • C. Reputable Domain Names (FortiGuard): The addresses shown (Adobe, Apple, Appstore) are part of a predefined list of reputable domain names maintained by FortiGuard. • D. Privacy and Sensitive Information: The categories Finance and Banking and Health and Wellness are exempted primarily for legal and privacy compliance (such as GDPR or HIPAA).

The categories are exempt from SSL Deep Inspection because: ✔️ A. Technical issues with HSTS and certificate pinning ✔️ D. Legal and privacy requirements

Answer: A, D Explanation: Based on the FortiOS 7.6 Administrator Guide regarding Fortinet Single Sign-On (FSSO) polling modes.

Agentless Polling Mode - Similar to agent based polling but FG polls instead - Event logging must be enabled on DC’s - Method is only WinSecLog with two events id 4768 and 4769 - Uses SMB protocol to read the event viewer logs ( TCP 445 ) - Workstation checks is not available

From the FortiOS_7.6_Administrator_Study_Guide: Agentless Polling Mode • Similar to agent-based polling, but FortiGate polls instead • Doesn't require an external DC agent or collector agent FortiGate collects the data directly • Event logging must be enabled on the DCs • More CPU and RAM required by FortiGate • Support for polling option WinSecLog onlv FortiGate uses the SMB protocol to read the event viewer logs •Fewer available features than collector agent-based polling mode •FortiGate doesn't poll workstation Workstation verification is not available in agentless polling

Agentless polling mode operates in a similar way to WinSecLog, but with only two event IDs: 4768 and 4769. Because there's no collector agent, FortiGate uses the SMB protocol to read the event viewer logs from the DCs. In agentless polling mode, FortiGate acts as a collector. It is responsible for polling on top of its normal ESSO tasks but does not have all the extra features, such as workstation checks, that are available with the external collector agent. Page 184

type="utm" + subtype="app-ctrl" → Application Control log action="block" → traffic blocked by policy poluuid="..." → policy UUID present This is a forward traffic (user traffic) security log, not implicit deny

Simple explanation In AWS CNF setup: FortiGate CNF sits behind a GWLB (in Fortinet side) Your EC2 is in customer VPC To send traffic from EC2 → FortiGate: You MUST create GWLBe in the customer VPC This endpoint acts like a bridge/tunnel between your VPC and the GWLB (where FortiGate is)

This is about wording. A is partially correct about strict RPF, but “port1 will be enable for asymmetric routing” is not the most accurate wording. The config exempts it from RPF, which results in allowing asymmetric routing, but C is more precise.

The global setting enables strict source checking (RPF) on all interfaces by default. The perinterface setting disables the source check on port1, exempting it from strict RPF enforcement

While A is true, it describes a use case of what the configuration is accomplishing. C describes the actual mechanism (RPF exempt). The exam should be testing for Configuration -> exact behavior matching, not inferred intent or use case. We're being asked what is the impact of this configuration, not what is the purpose of using this command. Therefore C is correct in this case.

In the world of FortiOS, the command set src-check disable isn't just a "bypass" or an "exemption." It is the specific configuration used to allow asymmetric routing. • Option C uses the word "exempted," which is a bit vague. • Option A uses the phrase "enable for asymmetric routing," which is the formal technical purpose of that command. The NSE exam prefers the answer that describes the functional goal of the configuration.

The answer is A, but the question itself is misleading. The FortiGate automatically generates and adds the UUID to every new firewall policy (and most other objects) when it is created. The administrator does not manually type or "include" it — it's handled by FortiOS automatically.

Each firewall policy can have a UUID This UUID is used by FortiAnalyzer and FortiManager to: uniquely track the policy correlate logs even if policy ID/order changes Logs include poluuid → this is what those systems rely on Without UUID, tracking and reporting become inconsistent

the Universally Unique Identifier (UUID) is a critical metadata attribute automatically assigned to every firewall policy and object.

Overrides take precedence over category‑based actions. So even if the P2P category is set to Block Network Protocol Enforcement This feature checks protocol compliance (e.g., HTTP on port 80). It does not override application control decisions.

The answer is B, but you should check 'C' too in real life (overrides can bypass category actions), but it is not the primary reason for traffic on known ports bypassing the category block.

Network Protocol Enforcement settings control how FortiGate inspects and enforces protocols on traffic, including peer-to-peer applications on known ports. If not properly enabled, peer-to-peer traffic may bypass blocking despite the application control profile.

You have already: Blocked peer-to-peer (P2P) under Application Control Categories Applied the profile to the firewall policy Yet traffic is still passing because: 👉 P2P applications can use well-known ports (e.g., TCP 80/443) to bypass detection 👉 Without deeper inspection, FortiGate may classify this traffic as regular web traffic instead of P2P Why Network Protocol Enforcement fixes this: It ensures that traffic on a port actually matches the expected protocol Example: If P2P traffic tries to use port 80 (HTTP) but is not truly HTTP → it gets flagged and blocked This prevents application evasion techniques

engine count = 0 (+1) This means: IPS engine is NOT actively processing traffic It’s loaded (+1), but not in use

engine count = 0 indicates that no IPS engines are active, usually because no firewall policy is currently using an IPS security profile.

D. FortiGate enters conserve mode When memory > red/extreme threshold FortiGate goes into conserve mode A. FortiGate drops new sessions In conserve mode: System tries to protect memory So it drops new sessions

Threshold red: Fortigate enters Conserve Mode. In this mode, System configurations cannot be changed, skips quarantine actions, set fail-open setting kicks in. Extreme: New sessions are dropped

Hearbeat ip's are not manually assigned

Heartbeat IP addresses are used to distinguish between cluster members → Each FortiGate in the HA cluster uses unique heartbeat IPs so members can identify one another. A change in the heartbeat IP address happens when a FortiGate device joins or leaves the cluster → Heartbeat IPs are dynamically reassigned when the cluster membership changes to maintain proper communication.

A and C C because Heartbeat IP assignment is dynamic and based on factors such as serial number order. When a new FortiGate joins the cluster or an existing member leaves/fails, the cluster renegotiates and may reassign the heartbeat IPs to maintain uniqueness among the current members.

D. You need to decode the HTTPS to determine that this is a Google app. E. The order of the rules matters. Google Docs and Google Drive are both Excessive-Bandwidth risks. Therefore, you need to raise it for these apps to work. A. Doesn't make sense. B. Monitor and Allow both allow traffic; they differ in how they log. C. Google apps aren't limited to the google.com URL.

Question is a little unspecific. What issue? It is not described. The behavior could be intended. B

B doesn't make a difference. Monitor = allow plus log.

The application override rule for Google should be moved higher .So, it matches that one first and I believe we need deep inspection to categorize Google app

A, D is incorrect. The flip-timeout protects against subsequent memory-based failovers, not the initial one.

The HA configuration shows that override is disabled (set override disable), but despite this, HQ-NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ-NGFW-1 is the primary device.

A is correct, memory failover threshold is set

A. HQ-NGFW-2 with the parameter memory-failover-threshold setting Even though memory-failover-flip-timeout is set to 60 seconds, it does not delay the initial memory-based failover. Because memory utilization remains above the 70% threshold for longer than the memory-failover-monitor-period of 50 seconds, a memory-based failover does occur.

B -set AD to 11 on port3 C -set AD to 9 on port2 -> Port2 will have lower AD, Port2 will be new StaticRoute

Existing route: 172.20.1.0/24 → port3 Distance = 9 Priority = 2 To make traffic go through port2 only, the new route via port2 must win route selection. FortiGate route selection mainly checks: Longest prefix match Lowest distance Lowest priority

B and C together would force traffic via port 2

Correct answers: ✅ B and ✅ D

A is irrelevant here and C is for agentless proxy configs

In FortiSASE Secure Internet Access (SIA) agent-based mode, traffic steering and security enforcement rely on components integrated with the FortiClient agent. Components used in SIA agent-based mode D . FortiSASE Firewall-as-a-Service (FWaaS) Correct. FWaaS is a core security component of FortiSASE. It enforces firewall policies, security inspection, and access control for agent-based users. All user traffic tunneled by the agent is inspected by FWaaS. B . VPN policies Correct. In agent-based mode, the FortiClient establishes a secure tunnel to FortiSASE. VPN policies define: Authentication Access control Traffic steering These policies are fundamental to agent-based connectivity.

B and D Pac file is for Secure Web Gateway /SWG

For agent-based mode in FortiSASE, the key concept is that traffic is steered and secured by the endpoint agent, not by PAC files or external devices. What agent-based mode includes Uses an endpoint agent (FortiClient) Traffic is tunneled securely to the cloud Security inspection is enforced in the cloud (FWaaS) Correct answers B. VPN policies Agent-based mode relies on secure tunnels (VPN-like behavior) VPN policies define how traffic is routed to FortiSASE D. FortiSASE Firewall-as-a-Service (FWaaS) Core component of SIA Provides: Application control Web filtering IPS All enforced in the cloud

A & C. The FortiGate will accept the key lifetime, but it can cause issues later. The tunnel will however come up. This is what the question is asking.

Phase 2 (Quick Mode) requires exact parameter symmetry between both peers—especially for: Proxy IDs (local/remote subnets) Encryption/authentication settings From the exhibit: 1. Subnet (Proxy ID) mismatch HQ-NGFW Local: 10.0.11.0/24 Remote: 172.20.1.0/24 BR1-FGT Local: 172.20.1.0/24 Remote: 10.11.0.0/24 (incorrect) This must mirror HQ exactly. Fix: Change BR1-FGT remote subnet to 10.0.11.0/24 A is correct 2. Encryption mismatch HQ-NGFW: AES128 BR1-FGT: AES256 Phase 2 proposals must match exactly. Fix: Change HQ-NGFW to AES256 (to match BR1-FGT) C is correct

Encryption has to match

In FortiOS 7.6, SD-WAN steering decisions are recorded in traffic logs only when traffic matches an explicit SD-WAN rule (SD-WAN service rule). When no configured SD-WAN rule matches a session, FortiGate uses the implicit (default) SD-WAN rule/behavior to select a member (often resulting in load-balancing or default selection based on the configured SD-WAN algorithm). In the exhibit, traffic is permitted by firewall policy ID 1, and the Destination Interface alternates between port1 and port2, but SD-WAN Rule Name remains empty. This is consistent with the sessions being forwarded by the implicit SD-WAN rule, which does not populate a named rule in the log columns.

C. A - Incorrect wording ("CN and SAN" instead of "CN or SAN").

Anser is C .Even if you check the GUI of FGT for SSL inspection-Check the SNI with the CN or SAN field

Check the SNI in the hello message with the CN or SAN field in the returned server certificate. Enable: If mismatched, use the CN in the server certificate to do URL filtering. Strict: If mismatched, close the connection. Disable: Server certificate SNI check is disabled. https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/505842/certificate-inspection

So, answer should be C

I believe it’s answer A. Facebook should be recognized as Social Networking, but instead it’s categorized as a Malicious Website, which I can only explain as the result of a web rating override.

there's only one way that facebook has been categorised as Malicious and that is option A

C is correct, action must be changed exempt. If the static URL filter action is set to “monitor/allow,” FortiGate performs the category check in the following order. Since it was blocked by the category check, it must be set to “exempt.” ## FortiOS 7.6 Administrator Study Guide 299 page

The Web Filter profile is configured with Feature set = Flow-based. The Firewall policy is configured with Inspection mode = Proxy-based and has Web Filter enabled.

With override enabled on HQ-NGFW-2 and its higher priority (110 vs. 90), HQ-NGFW-2 will become the primary device, preempting HQ-NGFW-1 despite the current primary status.

Correct answers: A and C ✅ A. Advanced mode supports nested/inherited groups In collector agent advanced mode, it integrates with AD more deeply It can resolve: Nested groups Inherited memberships 👉 More accurate user-group mapping ✅ C. FortiGate can act as LDAP client with group filters In advanced mode: FortiGate firewall can query AD via LDAP You can configure group filters on FortiGate 👉 Gives more control over which groups are used ❌ Why others are wrong B ❌ Domain\Username (NetBIOS format) is not specific to advanced mode Used generally in FSSO D ❌ Security profiles can be applied to: Users OR groups Not limited to groups only

From https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-switch-FSSO-operation-mode-from-Standard/ta-p/194343 FSSO has two modes of operation: Standard Mode and Advanced Mode. Standard: The FSSO Collector Agent receives group information from the DC Agent in the NetBIOS domain\user format. Advanced: The FSSO Collector Agent obtains user group information using LDAP. The benefit of this method is that it is possible to nest groups within groups. The group information is in standard LDAP format 'CN=myGroup,OU=myOrganizationUnit,DC=myDomain'. In this mode, the monitored groups are specified on the FortiGate. .... so A and C

Correct answer: C DC Agent Mode flow (how it really works) User logs into Windows domain DC Agent (on Domain Controller) detects logon event DC Agent → Collector Agent Collector Agent → FortiGate FortiGate maps IP → user

In DC Agent Mode, the communication path is a three-tier architecture. The Domain Controller (DC) does not have the "intelligence" to communicate with the FortiGate directly; it relies on a middleman.

The correct answer is: D. The collector agent forwards login event data to FortiGate. Explanation In DC Agent Mode on FortiGate, the expected process is: User logs into the Windows domain DC Agent captures the login event DC Agent sends the login event data directly to FortiGate FortiGate maps the user identity based on the IP address Why option D ? D introduces the Collector Agent, which is not used in DC Agent Mode The Collector Agent is only part of Collector Agent Mode, not DC Agent Mode

It is C.IT is collector agent sending login events to fortigate and not DC agent

Why A is correct In admin profiles, there is: Override Idle Timeout If enabled, it overrides global admin timeout You can increase the idle time just for this profile Exactly solves: “don’t disconnect too early”

config system accprofile edit NOC_Access set override-idle-timeout enable set idle-timeout <minutes>

"The Override Idle Timeout option allows the admintimeout value, under config system accprofile, to be overridden for each access profile. You can configure administrator profiles to increase inactivity timeout and facilitate use of the GUI for central monitoring. Note that you can do this on a per-profile basis, to prevent the option from being unintentionally set globally."

admintimeout: "Sets the amount of time that an administrator can be idle before being automatically logged out." Applies per admin profile, not globally.

A, is correct per Fortinet documentation as the weight is increased when packets are lost and decreased if no packets are lost. B, is incorrect as the default port is TCP 443 for FortiOS 6.4.2 and above. C, is incorrect because the D flag is not present in the exhibit. D, is correct as unreliable protocols can be used. When Anycast is disabled the default port is UDP 8888.

✅ C. FortiGate identified server using DNS lookup FortiGate is using a specific server (10.0.1.241) Not using default servers → likely resolved via DNS ✔️ Correct ✅ D. You can configure unreliable protocols FortiGate supports: UDP (unreliable) HTTPS (reliable) 👉 Admin can configure protocol choice ✔️ Correct

B. FortiGate is using the default port for FortiGuard communication. Reasoning: In the exhibit, Anycast is set to Disable. When Anycast is disabled, the FortiGate uses the "Legacy" or "Unicast" communication method. In this mode, the system defaults to using either UDP port 53 or port 8888 for FortiGuard rating services. Since the output explicitly shows Port: 8888, the device is indeed using a default port designated for this specific architecture.

D. You can configure unreliable protocols to communicate with FortiGuard Server. Reasoning: FortiGuard services allow the use of both reliable (TCP/HTTPS) and unreliable (UDP) protocols. While your exhibit shows the protocol set to https, the administrator has the flexibility to switch to UDP (via ports 53 or 8888) to minimize overhead or bypass certain network restrictions. The ability to choose an "unreliable" transport like UDP is a core feature of the FortiGuard configuration.

Why D is correct In site-based (remote internet access) with FortiSASE: The branch/site device (FortiExtender) connects to the SASE cloud using: IPsec tunnel (secure transport) VXLAN overlay (to extend Layer 2 / network segmentation) This allows the site to behave like it’s directly connected to the SASE fabric

By selecting the "Include in every user group" option in the RADIUS configuration, FortiGate automatically includes this RADIUS server as an authentication source for all user groups. This means any user group configured on the FortiGate will authenticate using this RADIUS server, allowing users to authenticate against the server for any group they belong to.

A To form an FGCP HA cluster, both FortiGates must share the same HA group ID to communicate and form a cluster. C Both units must also have an identical hard drive configuration and hardware model to ensure resource compatibility. B Heartbeat interfaces do not require subnets because they use a proprietary, non-IP layer 2 multicast protocol. D VDOM configurations do not need to match beforehand, as the primary unit automatically overwrites the secondary unit's settings.

✅ A. Same HA group ID Mandatory for FGCP cluster formation Devices with different group IDs will NOT join the same cluster ✅ D. Same number of VDOMs In HA, config must match closely Both FortiGates must have: Same VDOM mode (multi/single) Same number of VDOMs 👉 Otherwise HA sync fails

Check the Study Guide For the VDOM, it should me management only. so it means that ID and Hard Drive Config

Hardware and firmware are checked First, so if the yes you need the same HA Group ID you will not get that far. If you have a different hard drive config you are not running the same hardware, so that means you are technically running different Firmware. It technically a good trick question.

I was confused because policy 0 is a default. but I made a test, and yes, if you use CLI to create a policy with ID 0, automatically assigns the next avaiblable ID number. A y D

B is not True becase Policy is top down not based policy number

A is true: Once a firewall policy is created, its numeric policy ID is fixed and cannot be changed. The policy ID is a permanent identifier used internally for logging (policyid), referencing in scripts, FortiManager, FortiAnalyzer (along with UUID), and other operations. To "change" the ID, you must delete the policy and recreate it with a new ID. D is true: In the CLI, you can use config firewall policy followed by edit 0. Entering edit 0 tells FortiGate to automatically assign the next available unused policy ID (it does not create a policy with ID 0). This is the standard way to create a new policy via CLI when you do not want to manually specify a specific number.

So it is yet anther trick question... You can use the 0 during policy creation but you dont actually create a policy with ID 0 because it automatically changes it. Feels like all the questions are focused on tricking the people

✅ Why A is correct 👉 Underlay zone has no members It shows empty (no interfaces assigned) ✔️ So statement is true

PING goes to Snat-remote1

A. 100.65.0.99 — used by the SNAT-Remote1 IP pool for PING traffic.

Correct answers: A and C Why With dialup IPsec VPN and add-route enable, FortiGate adds the route only when: A. Phase 2 is established The tunnel must be up. If phase 2 is down, FortiGate will not install the route. C. Remote network is correct in phase 2 selectors FortiGate uses the phase 2 selector remote subnet to know what route to add. If the remote subnet is wrong or missing, the route will not appear correctly.

The two correct statements are: A. FortiGate refuses to accept configuration changes. To prevent further memory consumption, the FortiGate enters a "read-only" state for the configuration. If you try to change settings in the GUI or CLI, you will receive an error message. D. FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled. In conserve mode, the IPS engine may not have enough memory to inspect all traffic. If fail-open is enabled under config ips global, the FortiGate will bypass the IPS engine and allow traffic to pass uninspected to maintain availability. If fail-open is disabled, the traffic is dropped.

B is incorrect because the Conserver mode suspends all securtiy actions so it can do network stuff

What actions does FortiGate take to preserve memory while in conserve mode? . FortiGate does not accept configuration changes, because they might increase memory usage. . FortiGate does not run any quarantine action, including forwarding suspicious files to FortiSandbox. . You can configure the fail-open setting under config ips global to control how the IPS engine behaves when the IPS socket buffer is full.

enable fail-open mode: The default setting is disable, so sessions are dropped by IPS engine when the system enters fail-open mode.

VIP = Destination NAT only Change destination IP + port Source stays same

✅ D. None of the inspected protocols are active in this profile.

The bottom things aren’t enabled

D. None of the inspected protocols are active in this profile.

Correct answers: ✅ C and ✅ D

A.[False] FortiGate drops new sessions requiring inspection. --> set av-failopen one-shot - don't drops new sesion. --> set fail-open enable - When enabled, the IPS engine does not perform any scans and allows new packets. B.[False ]Administrators must restart FortiGate to allow new sessions. --> Continue to bypass the antivirus proxy after the FortiGate is out of conserve mode, until the failopen setting is changed or the FortiGate is restarted. C.[True] FortiGate skips quarantine actions. D.[True] Administrators cannot change the configuration.

Fortigate no Dropea las nuevas sesiones con inspección en el modo failopen, sino que las deja pasar sin inspeccionarlas hasta que se reinicie el equipo (pág. 502 del manual)

A and D is correct

Action is set to "allow" which just allows it. If you want to generate logs you need to set it to "monitor"

When there is no log, traffic means action is allowed

Correct answer: ✅ D. The ABC.Com Action is set to Allow.

Because Excessive-Bandwidth (which is set to Block) is being matched before or in parallel, and that takes effect. When traffic is blocked, and especially if blocked before full app classification, FortiGate: - Does not generate logs under the allowed application (ABC.Com). - May log under filter category if logging is enabled for blocked traffic — which may not be shown here.

Quando il Collector Agent FSSO (Fortinet Single Sign-On) lavora in modalità di polling NetAPI, non si mette a leggere i file di registro del server. Invece, interroga direttamente il Domain Controller (DC

The correct answer is B. The NetSessionEnum function is used to track user logouts. NetAPI (Page 270): Focuses on the Active Session List. It is faster and "cleaner" for identifying when a session ends, but it can occasionally miss a logon if the user logs in and immediately logs out between the agent's polling intervals (which are typically every few seconds).

In NetAPI mode, the FSSO Collector Agent polls the domain controllers using Windows NetAPI functions. NetSessionEnum doesn’t read events; it just reflects current active sessions, which implies who is logged in.

Which statement correctly describes NetAPI polling mode for the FSSO collector agent? A. The collector agent must search Windows application event logs. B. The NetSessionEnum function is used to track user logouts. C. NetAPI polling can increase bandwidth usage in large networks. D. The collector agent uses a Windows API to query DCs for user logins.

With flow-based inspection, NTurbo improves antivirus performance by establishing a dedicated fast data path that redirects traffic between the IPS engine and the FortiGate ingress/egress interfaces. This reduces CPU overhead, allowing antivirus scanning to happen at higher throughput without requiring full proxy-based buffering.

You configure IPS signature settings like: rate-mode = periodical Define: number of hits (count) time window (seconds)

Correct answer: D. Use IPS signatures, rate-mode periodical option. Explanation The requirement is: Block traffic when a signature is triggered a certain number of times within a specific time period This is exactly what rate-based blocking does in FortiGate IPS. You must configure it at the signature level Use: rate-mode: periodical Define: number of hits (threshold) time period When the threshold is exceeded → traffic is blocked Why the other options are incorrect A. Packet logging does not enforce blocking behavior B. “rate-mode 60” is not a valid configuration and not tied to time logic properly C. Filters are used to select signatures, not to apply rate-based behavior

Option D (Signatures): When you apply a rate-limit to a specific signature ID, the counter tracks only that one specific threat. • Option C (Filters): An IPS Filter is a dynamic bucket (e.g., "all High Severity signatures for Windows"). If you apply a rate-mode to a Filter, the rate-count becomes cumulative across every single signature inside that filter.

C. Use IPS filter, rate-mode periodical option. Under Security Profiles > Intrusion Prevention > IPS Sensor (or via CLI: config ips sensor): Create or edit an entry (filter) with criteria such as severity, protocol, CVE, signature ID, etc. Then configure the rate-based parameters: set rate-count <number> → e.g., 100 (how many times the signature must trigger) set rate-duration <seconds> → e.g., 60 (the time period) set rate-mode periodical → This is the key setting.

When using multiple dial-up IPsec VPNs in aggressive mode, the Peer ID setting in Phase 1 can be used to distinguish between different VPN tunnels. Each dial-up user or department can be assigned a unique Peer ID, allowing the FortiGate to match the incoming VPN request to the correct tunnel based on the Peer ID value.

[A] True A fail-open scenario is triggered when IPS raw socket buffer is full. Therefore IPS engine has no space in memory to create more sessions and needs to decide whether to drop the sessions or bypass the sessions without inspection.

IPS entered fail-open mode This happens when: 👉 System resources (especially memory) are exhausted So IPS: Stops scanning Allows traffic (or drops depending on config) To avoid crashing

This is typically a self-protection mechanism triggered by high resource usage: Buffer Exhaustion: The "raw socket buffer" used by the IPS engine is full, meaning it lacks the memory to create new sessions for inspection.

Correct answer A, A dirty flag causes packet reprocessing, not IPS fail‑open mode

Adding the subnets into a single policy wont matter if the policy is only looking for traffic coming from port 1. Answer is D

we have to enable multiple interface policy

No basta con seleccionar la red, debe seleccionar la interface

Selection multiple interfaces or Any interface is Disable by default; you need to enable "Multiple Interface Policies" under System>Feature Visibility

A and B-Web Rating override and static URL filter can fix issue rather than creating separate policy.

FortiGate Security 7.2 Study Guide (p.268-269): "If you want to make an exception, for example, rather than unblock access to a potentially unwanted category, change the website to an allowed category. You can also do the reverse. You can block a website that belongs to an allowed category." "Static URL filtering is another web filter feature. Configured URLs in the URL filter are checked against the visited websites. If a match is found, the configured action is taken. URL filtering has the same patterns as static domain filtering: simple, regular expressions, and wildcard."

A and B fit better for this question because they are both Dealing with the Web Filtering side of things. Sure its Not the best way but D is Firewall rule based and the question is around WebFlitering. All Three will get the Job done but Based of the Exhibit they want A

Enable packet logging to save a copy of the packets when they match the signature. Packet copies can be analyzed later.

The correct answer is B. FortiGate allows this low severity signature packet and creates a log.

C- Action is definitey Block and it will override the default action of signature itself. And when it matches the signature, it creates a local copy on fortigate.

The correct answer is B. FortiGate allows this low severity signature packet and creates a log. Action (Signature Specific): If you look at the bottom row for FTP.Login.Failed, the Action column shows Pass. This means the FortiGate will not block the traffic; it will allow the packet to transit while still processing the signature. Packet Logging: This is set to Enable. In the Fortinet exam context, this confirms that an IPS log entry will be generated for the event. Severity: The colored bars under the Severity column show only the first segment highlighted, indicating this is a Low severity signature.

Main issue: Option C “must see the IP address 169.254.0.2” This is the weak point in your argument. Why it’s incorrect: FGCP heartbeat does use 169.254.0.x (link-local) ✔ But: The exact IPs (.1, .2, etc.) are not guaranteed They can vary depending on: Cluster member ID Election/re-election Firmware behavior The keyword “must” makes the statement false in exam logic. Fortinet exams are very strict: If something is not deterministic → it’s incorrect

According to the FortiOS 7.6 Administrator Study Guide: 1. Statement A (TRUE): Manually setting a monitored interface to down on the primary unit simulates a link failure and triggers a failover (confirmed on page 512). 2. Statement D (TRUE): Incremental synchronization is the mechanism that keeps dynamic data like FIB entries and IPsec SAs in sync (confirmed on page 501 Why I think C is wrong The Hello is the HeartBeat so you are looking for )x8890 and not the IP address This is a tuff Question and Hope to hell they give half credit. I spent way to much time Proving to Myself C was not correct.

D: Incremental synchronization also synchronizes other dynamic configuration information, such as the DHCP server address lease database, routing table updates, IPsec SAs, MAC address tables, and so on. See an introduction to the FGCP for more information

Correct Statements: A and C A. Link failover triggers a failover if the administrator sets the interface down on the primary device. Explanation: When an interface is configured as a "monitor-interface" in the HA settings, the FortiGate tracks its status. If that interface goes down—whether due to a physical cable failure or an administrator manually setting the interface to down via the CLI or GUI—the HA priority is reduced, and a failover to the secondary unit is triggered. C. When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2. Explanation: FortiGate units in an HA cluster communicate with each other over the heartbeat link using a private, non-routable APIPA subnet: 169.254.0.x. Typically, the primary unit uses 169.254.0.1 and the secondary unit uses 169.254.0.2.

Correct is A, C and D.

We can't select LB with Best Quality We can select LB or not Manual/Lowest Cost

Correct is A and C.

i think those are correct, bcs without deep inspection can not finde the eicar

Traffic from the workstation 10.0.11.50 going to the internet matches the Internet(1) policy (LAN → WAN) which has NAT enabled and is configured to use the IP Pool. The IP pool specifies the external address 100.65.0.102. FortiGate will perform source NAT (SNAT) on the outbound traffic, translating the source IP of the workstation to 100.65.0.102.

The attribute shown in the exhibit is Fortinet-Group-Name = Training. This is a Fortinet RADIUS Vendor-Specific Attribute (VSA) used to return group membership information to FortiGate. FortiGate uses that returned value to match the authenticated user to the corresponding FortiGate user group, in this case Training. That is why A is correct: the administrator needs this so FortiGate can authenticate users and place or match them into the Training group for identity-based policy control.

C. [True] Exempt - The traffic is allowed to bypass the remaining FortiGuard web filters, web content filters, web script filters, antivirus scanning, and DLP proxy operations.

Since the question said that override is enable then: Connected Monitored ports > Priority > HA Uptime > Serial Number

Order of HA election is: Connected Monitored Port > HA Uptime > Priority > Serial Number If override is enabled, then: Connected Monitored ports > Priority > HA Uptime > Serial Number

Serial number: If all else is equal, the unit with the higher serial number wins.

By default, FortiGate prioritizes Uptime over Priority. This is designed to prevent "flapping"—where a rebooted unit with a higher priority keeps reclaiming the primary role, causing brief network interruptions. The default order is: Connected monitored ports: The unit with the most functional monitored interfaces wins. HA uptime: The unit that has been up the longest (by at least 5 minutes/300 seconds) wins. Priority: If uptimes are similar, the unit with the higher configured priority wins. Serial number: If all else is equal, the unit with the higher serial number wins.

Correct is C, D and E

A (Correct): When SD-WAN is not in use, the ECMP algorithm is set at the VDOM level using the CLI command config system settings set v4-ecmp-mode. This allows you to choose between modes like source-ip-based, weight-based, or usage-based. C (Correct): If SD-WAN is enabled, the FortiGate hides the standard v4-ecmp-mode and instead manages load balancing within the SD-WAN configuration using the load-balance-mode parameter.

A en C A (of D als overlappend): Config in system settings als SD-WAN disabled. C: load-balance-mode als SD-WAN enabled.

It matched default firewall policy ID 0, which is the implicit deny policy

References * FortiOS 7.4.1 Administration Guide - Application Control and Filtering, page 978. * FortiOS 7.4.1 Administration Guide - Application Sensor Configuration, page 982.

B. Apple FaceTime will be allowed, based on the Apple filter configuration. Technical Explanation In the Aoplication Sensor, there are two configured Application and Filter Overrides: Excessive-Bandwidth → Block (Priority 1) Apple → Monitor (Priority 2) FaceTime belongs to the Apple vendor filter, and it may also match the Excessive-Bandwidth filter when bandwidth usage is high. However, the question states that there are only a few incoming or outgoing calls, meaning FaceTime is not consuming excessive bandwidth. FortiGate Evaluation Logic Since FaceTime is using low bandwidth, it does not match the Excessive-Bandwidth filter. It does match the Apple filter, whose action is Monitor. The Monitor action means the traffic is allowed and logged.

Apple FaceTime will be blocked, based on the Excessive-Bandwidth filter configuration. Step 1 (Priority 1 Overide): The first override in the list is the Excessive-Bandwidth filter. Looking at the "Application override configuration" exhibit, we can see that FaceTime is a member of this filter, and the configured action is Block. • The Result: Because the FortiGate finds a match at Priority 1, it immediately applies the Block action and stops processing further

n this specific context (as an application filter), the filter does not measure real-time traffic volume or wait for a user to hit a certain limit. If an application is on the "Excessive-Bandwidth" list and the filter's action is set to Block, that application is blocked from the first packet.

C: Configure a lower distance on the static route for the primary tunnel, and a higher distance on the static route for the secondary tunnel. By configuring a lower administrative distance for the static route of the primary tunnel, the FortiGate will prefer this route when both tunnels are up. If the primary tunnel goes down, the higher administrative distance on the static route for the secondary tunnel will cause the FortiGate to use the secondary tunnel. A: Enable Dead Peer Detection. Dead Peer Detection (DPD) should be enabled to detect the status of the VPN tunnels. If the FortiGate detects that the primary tunnel is no longer responsive (dead), it can trigger the failover to the secondary tunnel, ensuring a faster tunnel failover.

A. In the IP pool configuration, set type to overload. Changing the IP pool to the overload type (Port Address Translation / PAT) allows multiple internal devices to share a single public IP address using different source ports. This eliminates the "one public IP per host" limitation that is blocking PC3. B. In the IP pool configuration, set endip to 100.65.0.112. Expanding the IP pool's ending IP address adds another public IP to the pool, ensuring there are enough public IP addresses to support a 1:1 NAT mapping for all three internal PCs (PC1, PC2, and PC3)

SSA is FortiSASE's solution specifically designed for controlling and securing SaaS application usage. It addresses both requirements directly: Shadow IT visibility: SSA discovers all SaaS applications being used across the organization Classifies them as sanctioned, unsanctioned, or unknown Gives administrators full visibility into which apps employees are using — even unauthorized ones Preventing sensitive file exfiltration: SSA integrates CASB (Cloud Access Security Broker) functionality Applies DLP (Data Loss Prevention) policies to SaaS traffic Can block file uploads, restrict sharing permissions, and enforce approval workflows before sensitive data leaves the organization through SaaS platforms

When you configure FortiAnalyzer on FortiGate: FortiGate sends a registration request FortiAnalyzer shows the device as unauthorized You MUST approve/authorize it on FortiAnalyzer 👉 Without authorization → connection will not establish

SIA for agentless remote users involves setting up a web browser, or a browser-based device using a proxy autoconfiguration (PAC) file to use the FortiSASE proxy service as an explicit web proxy. The web browser redirects HTTP and HTTPS traffic to the proxy, which secures user web traffic by implementing proxy security policies. All other non-web traffic bypasses FortiSASE and is forwarded to the internet directly.

traffic in protected vpc is routed to relevant GWLBe.Then traffic is forwarded to FGT CNF to enforce security policy and if traffic is not blocked, it is sent back to GWLBe it was received from and then traffic is passes out through IGW

traffic in protected vpc is routed to relevant GWLBe.Then traffic is forwarded to FGT CNF to enforce security policy and if traffic is not blocked, it is sent back to GWLBe it was received from and then traffic is passes out through IGW

The following steps outline how FortiGate CNF works with AWS: FortiGate CNF creates a network interface (a GWLB endpoint or a GWLBe in your VPC) in your protected networks. Traffic in your protected VPCs is routed to the relevant GWLBe. Traffic is forwarded to the CNF service to enforce security policies. If traffic is not blocked, it is sent back to the GWLBe it was received from. Traffic passes out through the internet gateway." — FortiOS 7.6 Administrator Study Guide, Page 527 Option C is incorrect EC2 instance → GWLB endpoint (GWLBe) → FortiGate CNF → IGW → internet INCORRECT - The return to GWLBe after inspection is missing. Traffic must return to GWLBe before passing through IGW.

B. EC2 instance -> GWLBe -> FortiGate CNF -> GWLBe -> IGW -> internet In a Gateway Load Balancer (GWLB) architecture, the traffic flow must be symmetric to maintain transparent inspection. Here is the logical breakdown of the path: The EC2 instance sends traffic to the internet. The subnet's route table intercepts this and points it to the GWLBe. The GWLBe encapsulates the packet and sends it to the FortiGate CNF (located in the service VPC) for inspection. After the FortiGate CNF inspects and allows the traffic, it must return the packet to the same GWLBe it came from. It does not hand it off directly to the Internet Gateway. The GWLBe receives the clean packet, decapsulates it, and finally forwards it to the Internet Gateway (IGW) to reach the destination.

* Set the Destination address as Webserver in the Deny policy:Setting the Destination address to "Webserver" in the Deny policy ensures that the policy specifically targets traffic attempting to reach the web server. This configuration helps to precisely control which traffic should be blocked, focusing the Deny policy on the intended destination.

The FSSO chain works like this: Windows login → DC event log → Collector Agent → FortiGate FSSO user list → policy match → access The user successfully logged in to Windows, so the chain started correctly. The very next link — and the first thing to verify on the FortiGate — is whether the login event actually made it to the FortiGate's active FSSO user list with the correct IP address: diagnose debug authd fsso list If the user/IP mapping is missing or stale, FortiGate can't match them to any identity-based policy → traffic hits the implicit deny → internet blocked. This single check immediately tells you whether the problem is upstream (collector agent, DC polling, event forwarding) or downstream (policy/group configuration).

Agree with andrpercud, the hybrid scanning using default and legacy scanning, nothing to do with proxy which invalidates A

According to the FortiOS 7.6 Study Guide and Parallel Path Processing documentation, flow-based antivirus inspection is designed to provide security with minimal impact on performance.

Why the others are incorrect A. Hybrid of scanning modes: This is inaccurate. Flow-based is a distinct architecture, not a hybrid of proxy modes. Proxy-based inspection uses a "store-and-forward" approach, whereas flow-based uses "stream-based" processing. E. If a virus is detected, the last packet is delivered: This is false. If a virus is detected, the FortiGate intentionally drops the last packet or resets the connection (TCP RST) to ensure the file is incomplete and cannot be executed/opened by the client. Delivering the last packet would allow the client to potentially reconstruct the malicious file.

A - proxy for hybrid scan

When using FortiGuard servers for DNS, FortiOS defaults to using DNS over TLS (DoT) to secure the DNS traffic. New FortiGuard DNS servers are added as primary and secondary servers.

By default, the FortiGate uses DNS over TLS (DoT, TCP port 853) to connect to the SDNS server

Page 24 of the study guide. When using Fortiguard servers for DNS, FortiOS uses DNS over TLS to secure the DNS traffic

When using FortiGuard servers for DNS, FortiOS uses DNS over TLS (DoT) by default to secure the DNS traffic. New FortiGuard DNS servers have been added as primary and secondary servers.

Why Option A is correct: The official and cleanest way to manually trigger a controlled failover when override is disabled is to reduce the primary unit's HA uptime down to zero. By executing the command diagnose sys ha reset-uptime on the current primary firewall (HQ-NGFW-1), its HA uptime resets to 0. HQ-NGFW-2 (with its 1 week of continuous uptime) immediately wins the uptime election criterion and gracefully takes over the primary role.

easiest way to test failover when override is disabled is to do ha reset uptime on primary unit

C is the recommended way to test failover

the key is "force failover" so you need modify HA uptime (guide page 452)

The command set ses-denied-traffic enable instructs FortiGate to include sessions for denied traffic in the session table. Normally, denied traffic is dropped immediately without a session entry; this setting ensures that subsequent packets in the same flow are dropped without a new policy lookup. Because a session entry is created for denied traffic, FortiGate does not have to perform a policy lookup or generate a new log for every individual packet in that blocked stream. Instead, it handles the flow as a single session, significantly decreasing the volume of redundant log messages.

AB Not C, timer is 30 seconds, not minutes. Not D, nothing in this config affects session helpers.

The set block-session-timer 30 command configures the FortiGate firewall to keep denied sessions in the session table for 30 seconds, reducing CPU processing for repeated denied traffic from the same source. This helps optimize performance by avoiding repeated evaluations of identical denied packets.

B and D

FortiGate supports two authentication methods for IPsec IKEv1: *Pre-shared key (PSK) — both peers use the same shared secret *Certificate signature — digital certificates for authentication (PKI-based) Extended Authentication (XAuth) is an extension to IKEv1 that adds an extra authentication layer after the normal IKE Phase 1. The remote peer is prompted to provide a username and password — commonly used in remote access VPN scenarios to authenticate users via LDAP, RADIUS, or local user databases.