NSE4_FGT_AD-7.6 Sample Practice Exam Questions 2026 Updated Verified [Q47-Q62]

Rate this post

NSE4_FGT_AD-7.6 Sample Practice Exam Questions 2026 Updated Verified

Exam Study Guide Free Practice Test LAST UPDATED NSE4_FGT_AD-7.6

Fortinet NSE4_FGT_AD-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Content Inspection: This domain addresses inspecting encrypted traffic using certificates, understanding inspection modes and web filtering, configuring application control, deploying antivirus scanning modes, and implementing IPS for threat protection.
Topic 2	Deployment and System Configuration: This domain covers initial FortiGate setup, logging configuration and troubleshooting, FGCP HA cluster configuration, resource and connectivity diagnostics, FortiGate cloud deployments (CNF and VM), and FortiSASE administration with user onboarding.
Topic 3	Routing: This domain covers configuring static routes for packet forwarding and implementing SD-WAN to load balance traffic across multiple WAN links.
Topic 4	Firewall Policies and Authentication: This domain focuses on creating firewall policies, configuring SNAT and DNAT for address translation, implementing various authentication methods, and deploying FSSO for user identification.
Topic 5	VPN: This domain focuses on implementing meshed or partially redundant IPsec VPN topologies for secure connections.

QUESTION 47
Refer to the exhibit.

The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit For which two reasons are these web categories exempted? (Choose two.)

The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.

The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.

These websites are in an allowlist of reputable domain names maintained by FortiGuard.

The FortiGate temporary certificate denies the browser’s access to websites that use HTTP Strict Transport Security.

“You may need to exempt traffic from SSL inspection if it is causing problems with traffic, or for legal reasons.”
“Performing SSL inspection on a site that is enabled with HTTP Strict Transport Security (HSTS), for example, can cause problems with traffic. Remember, the only way for FortiGate to inspect encrypted traffic is to intercept the certificate coming from the server and generate a temporary one. After FortiGate presents the temporary SSL certificate, browsers that use HSTS refuse to proceed.”
“Laws protecting privacy might be another reason to bypass SSL inspection. For example, in some countries, it is illegal to inspect SSL bank-related traffic. Configuring an exemption for sites is simpler than setting up firewall policies for each individual bank. You can exempt sites based on their web category, such as Finance and Banking…”
“The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories-Finance and Banking, and Health and Wellness-and some FQDN addresses…” Technical Deep Dive:
The correct answers are B and D.
B is correct because the study guide explicitly says SSL inspection may be bypassed for legal reasons, especially where privacy laws restrict inspection of sensitive categories such as Finance and Banking. The same privacy rationale also explains why Health and Wellness is commonly exempted.
D is correct because some sites break under deep inspection due to HSTS. FortiGate must generate and present a temporary certificate during full SSL inspection, and browsers enforcing HSTS can reject that interception flow. That is why some sites are exempted from deep inspection.
Why the others are wrong:
A is not stated in the guide.
C refers to the separate Reputable websites option, which is a FortiGuard-maintained allowlist feature, not the reason the predefined categories shown in the exhibit are excluded.
From an operational standpoint, this is a classic balance between security visibility and application/legal compatibility. Deep inspection gives FortiGate payload visibility, but it can interfere with pinned-certificate/HSTS behavior and can violate privacy policy for regulated content.

QUESTION 48
Which two statements describe characteristics of automation stitches? (Choose two.)

Actions involve only devices included in the Security Fabric.

An automation stitch can have multiple triggers.

Multiple actions can run in parallel.

Triggers can involve external connectors.

QUESTION 49
Refer to the exhibit. What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?

FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.

FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.

FortiGate will close the connection if the SNI does not match the CN or SAN fields.

FortiGate will close the connection if the SNI does not match the CN and SAN fields

QUESTION 50
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)

YouTube search is allowed based on the Google Application and Filter override settings.

YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.

Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.

Facebook access is blocked based on the category filter settings.

QUESTION 51
Refer to the exhibit.

A partial cloud topology is shown.
You deployed a FortiGate Cloud-Native Firewall (CNF) in AWS for FortiGate CNF policy enforcement for EC2 instance traffic. Which path does the EC2 traffic take from the EC2 instance to the internet?

EC2 instance # GWLBe # FortiGate CNF # GWLBe # IGW # internet

EC2 instance # Internet Gateway (IGW) # Gateway Load Balancer (GWLB) # FortiGate CNF # internet

EC2 instance # FortiGate CNF # GWLB # GWLBe # IGW # internet

EC2 instance # GWLB endpoint (GWLBe) # FortiGate CNF # IGW # internet

QUESTION 52
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.

The WAN (port2) interface has the IP address 100.65.0.101/24. The LAN (port4) interface has the IP address 10.0.11.254/24. Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)

100.65.0.101

100.65.0.49

100.65.0.99

100.65.0.149

QUESTION 53
What are two features of collector agent advanced mode? (Choose two.)

Advanced mode supports nested or inherited groups.

In advanced mode, security profiles can be applied only to user groups, not individual users.

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode uses the Windows convention – NetBios: DomainUsername.

QUESTION 54
Refer to the exhibits. An administrator has observed the performance status outputs on an HA cluster for 55 seconds.

Which FortiGate is the primary?

HQ-NGFW-2 with the parameter memory-failover-threshold setting

HQ-NGFW-2 with the parameter priority setting

HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting

HQ-NGFW-1 with the parameter override setting

QUESTION 55
Refer to the exhibit. The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit.
For which two reasons are these web categories exempted? (Choose two.)

The FortiGate temporary certificate denies the browser’s access to websites that use HTTP Strict Transport Security.

These websites are in an allowlist of reputable domain names maintained by FortiGuard.

The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.

The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.

QUESTION 56
You have configured the FortiGate device for FSSO. A user is successful in log-in to windows, but their access to the internet is denied.
What should the administrator check first?

Whether the user is assigned to the correct AD group.

The FortiGate firewall policy settings for SSL decryption.

The FortiGate FSSO active users list for user’s IP address.

The windows event viewer for failed login attempts.

QUESTION 57
Refer to the exhibits, which show the firewall policy and an antivirus profile configuration.

Why is the user unable to receive a block replacement message when downloading an infected file for the first time?

Flow-based inspection is used, which resets the last packet to the user.

The option to send files to FortiSandbox for inspection is enabled.

The firewall policy performs a full content inspection on the file.

The intrusion prevention security profile must be enabled when using flow-based inspection mode.

QUESTION 58
Refer to the exhibit showing a debug flow output.

Which two conclusions can you make from the debug flow output? (Choose two answers)

The default gateway is configured on port2.

The RPF check fails.

The debug flow is for UDP traffic.

The matching firewall policy denies the traffic.

QUESTION 59
Refer to the exhibits.

A diagram of a FortiGate device connected to the network VIP object and firewall policy configurations are shown.
The WAN (port2) interface has the IP address
100.65.0.101/24.
The LAN (port4) interface has the IP address
10.0.11.254/24.
If the host 100.65.1.111 sends a TCP SYN packet on port 443 to 100.65.0.200. what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

10.0.11.254, 100.65.0.200. and 443, respectively

10.0.11.254, 10.0.15.50, and 4443. respectively

100.65.1. ill, 10.0.11.50, and 4443. respectively

100.65.1.111, 10.0.11.50. and 443. respectively

QUESTION 60
An administrator wanted to configure an IPS sensor to block traffic that triggers a signature set number of times during a specific time period. How can the administrator achieve the objective?

Use IPS group signatures, set rate-mode 60.

Use IPS packet logging option with periodical filteroption.

Use IPS filter, rate-mode periodicaloption.

Use IPS signatures, rate-mode periodicaloption.

QUESTION 61
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)

Move up Google in the Application and Filter Overrides section to set its priority to 1.

Set the action for Google in the Application and Filter Overrides section to Allow.

Add *Google*.com to the URL category in the security profile.

Change the Inspection mode to Flow-based.

Set SSL inspection to deep-content inspection.

QUESTION 62
An administrator wants to form an HA cluster using the FGCP protocol.
Which two requirements must the administrator ensure both members fulfill? (Choose two.)

They must have the same hard drive configuration.

They must have the same number of configured VDOMs.

They must have the heartbeat interfaces in the same subnet

They must have the same HA group ID.