[2026] NSE4_FGT_AD-7.6 Answers NSE4_FGT_AD-7.6 Free Demo Are Based On The Real Exam [Q14-Q30]

QUESTION 14
Which two statements are correct when FortiGate enters conserve mode? (Choose two.)

FortiGate continues to run critical security actions, such as quarantine.

FortiGate refuses to accept configuration changes.

FortiGate halts complete system operation and requires a reboot to regain available resources.

FortiGate continues to transmit packets without IPS inspection when the fail-open global setting in IPS is enabled.

QUESTION 15
Which two statements describe characteristics of automation stitches? (Choose two.)

Actions involve only devices included in the Security Fabric.

An automation stitch can have multiple triggers.

Multiple actions can run in parallel.

Triggers can involve external connectors.

QUESTION 16
Refer to the exhibit. An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow. This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.

Why are there no logs generated under security logs for ABC.Com?

The ABC.Com Type is set as Application instead of Filter.

The ABC.Com is configured under application profile, which must be configured as a web filter profile.

The ABC.Com Action is set to Allow.

The ABC.Com is hitting the category Excessive-Bandwidth.

QUESTION 17
A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors.
What is the reason for the certificate warning errors?

The SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is required when the SSL inspection profile is defined with a private CA certificate.

The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions.

The browser does not recognize the certificate in use as signed by a trusted CA.

With full SSL inspection it is not possible to avoid certificate warning errors at the browser level.

QUESTION 18
An administrator wanted to configure an IPS sensor to block traffic that triggers a signature set number of times during a specific time period.
How can the administrator achieve the objective?

Use IPS group signatures, set rate-mode 60.

Use IPS packet logging option with periodical filter option.

Use IPS filter, rate-mode periodical option.

QUESTION 19
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?

FortiGate determines user identity based on the IP address in the FSSO list.

The DC agent sends login event data directly to FortiGate.

The user logs into the windows domain.

The collector agent forwards login event data to FortiGate.

QUESTION 20
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

Enabled

On Idle

Disabled

On Demand

QUESTION 21
Refer to the exhibits. An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?

Change the Feature set of Web Filter Profile as Proxy-based.

Set the Action as Exempt for www.facebook.com
in the Static URL Filter.

Change the type as Simple in the Static URL Filter section.

Set the Social Networking action as warning in the FortiGuard Category Based Filter.

QUESTION 22
Refer to the exhibit. Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?

None of the inspected protocols are active in this profile.

FortiGate, with less than 2 GB RAM, does not support the Antivirus scan feature.

Antivirus scan is disabled under System -> Feature visibility.

The Feature Set for the profile is Flow-based but it must be Proxy-based.

QUESTION 23
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.

QUESTION 24
You are encountering connectivity problems caused by intermediate devices blocking IPsec traffic.
In which two ways can you effectively resolve the problem? (Choose two.)

You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).

You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

You can turn on fragmentation to fix large certificate negotiation problems.

You should use the protocol IKEv2.

QUESTION 25
A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

The selected SSL inspection profile has certificate inspection enabled.

The website is exempted from SSL inspection.

The El CAR test file exceeds the protocol options oversize limit.

The browser does not trust the FortiGate self-signed CA certificate.

QUESTION 26
Refer to the exhibit, which shows a routing table.

An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.
What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

The new static route must have the distance set to 9.

The existing static route through port3 must have the distance set to 11.

The new static route must have the priority set to 3.

The new static route must have the metric set to 1.

QUESTION 27
Which three statements explain a flow-based antivirus profile? (Choose three.)

FortiGate buffers the whole file but transmits to the client at the same time.

Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection.

If a virus is detected, the last packet is delivered to the client.

Flow-based inspection optimizes performance compared to proxy-based inspection.

The IPS engine handles the process as a standalone.

QUESTION 28
Refer to the exhibit. FortiGate has two separate firewall policies for Sales and Engineering to access the same web server with the same security profiles.
Which action must the administrator perform to consolidate the two policies into one?

Create an Aggregate interface that includes port1 and port2 to create a single firewall policy.

Select port1 and port2 subnets in a single firewall policy.

Replace port1 and port2 with the any interface in a single firewall policy.

Enable Multiple Interface Policies to select port1 and port2 in the same firewall policy.

QUESTION 29
When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

To allow the FortiGate to dynamically change interfaces for all active sessions when a WAN link fails

To make sure all sessions without source NAT enabled always use the primary WAN link

To improve security by forcing users to authenticate again when the WAN link changes

To ensure that existing SSL VPN connections remain on the same interface even if route changes occur

QUESTION 30
Refer to the exhibits. An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-
2 is in the same subnet as HQ-ISFW. After configuring the Security Fabric settings on HQ-ISFW-
2, the status stays Pending.

What can be the two possible reasons? (Choose two.)