NSE4_FGT_AD-7.6 Dumps 2026 – New Fortinet NSE4_FGT_AD-7.6 Exam Questions [Q83-Q107]

Posted On March 11, 2026

NSE4_FGT_AD-7.6 Dumps 2026 – New Fortinet NSE4_FGT_AD-7.6 Exam Questions

Free NSE4_FGT_AD-7.6 Braindumps Download Updated on Mar 11, 2026 with 143 Questions

NEW QUESTION 83
Refer to the exhibit. The exhibit shows the FortiGuard Category Based Filter section of a corporate web filter profile.

An administrator must block access to download.com, which belongs to the Freeware and Software Downloads category. The administrator must also allow other websites in the same category.
What are two solutions for satisfying the requirement? (Choose two.)

Configure a static URL filter entry for download.com with Type and Action set to Wildcard and Block, respectively.

Configure a web override rating for download.com and select Malicious Websites as the subcategory.

Configure a separate firewall policy with action Deny and an FQDN address object for*.download.com as destination address.

Set the Freeware and Software Downloads category Action to Warning.

NEW QUESTION 84
Refer to the exhibit. Which two statements about the FortiGuard connection are true? (Choose two.)

FortiGate is using the default port for FortiGuard communication.

FortiGate identified the FortiGuard Server using DNS lookup.

The weight increases as the number of failed packets rises.

You can configure unreliable protocols to communicate with FortiGuard Server.

NEW QUESTION 85
An administrator notices that some users are unable to establish SSL VPN connections, while others can connect without any issues.
What should the administrator check first?

Ensure that the affected users are using the correct port number.

Ensure that user traffic is hitting the firewall policy.

Ensure that forced tunneling is enabled to reroute all traffic through the SSL VPN

Ensure that the HTTPS service is enabled on SSL VPN tunnel interface

NEW QUESTION 86
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo acceleration enhance antivirus performance?

For proxy-based inspection, NTurbo offloads traffic to the content processor.

For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.

For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.

For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.

NEW QUESTION 87
An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?

It uses DNS over TLS.

It uses DNS over HTTPS.

It uses UDP 8888.

It uses UDP 53.

NEW QUESTION 88
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

On Demand

Enabled

On Idle

Usabled

NEW QUESTION 89
Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re- entered the pre-shared key on both FortiGate devices to make sure they match.
Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

On HQ-FortiGate, set IKE mode to Main (ID protection).

On Remote-FortiGate, set port2 as Interface.

On HQ-FortiGate, disable Diffie-Helman group 2.

On both FortiGate devices, set Dead Peer Detection to On Demand.

NEW QUESTION 90
Refer to the exhibits.

An administrator has observed the performance status outputs on an HA cluster for 55 seconds.
Which FortiGate is the primary?

HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting

HQ-NGFW-2 with the parameter priority setting

HQ-NGFW-1 with the parameter override setting

HQ-NGFW-2 with the parameter memory-failover-threshold setting

NEW QUESTION 91
Refer to the exhibits. Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit.

What would be the expected outcome in the HA cluster?

HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.

HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.

HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.

The HA cluster will become out of sync because the override setting must match on all HA members.

NEW QUESTION 92
Refer to the exhibit.

As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit What could be the possible reason of the diagnose output shown in the exhibit?

There is a no firewall policy configured with an IPS security profile.

Administrator entered the command diagnose test application ipsmonitor 5.

FortiGate entered into IPS fail open state.

Administrator entered the command diagnose test application ipsmonitor 99.

NEW QUESTION 93
Refer to the exhibit. An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow. This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.

Why are there no logs generated under security logs for ABC.Com?

The ABC.Com Type is set as Application instead of Filter.

The ABC.Com is configured under application profile, which must be configured as a web filter profile.

The ABC.Com Action is set to Allow.

The ABC.Com is hitting the category Excessive-Bandwidth.

NEW QUESTION 94
An administrator has configured a dialup IPsec VPN on FortiGate with add-route enabled.
However, the static route is not showing in the routing table.
Which two statements about this scenario are correct? (Choose two.)

The administrator must enable a dynamic routing protocol on the dialup interface.

The administrator must use a policy route instead of a static route for add-route to work properly.

The administrator must ensure phase 2 is successfully established.

The administrator must define the remote network correctly in the phase 2 selectors.

NEW QUESTION 95
Refer to the exhibit. What would be the impact of these settings on the Server certificate SNI check configuration on FortiGate?

FortiGate will accept and use the CN in the server certificate for URL filtering if the SNI does not match the CN or SAN fields.

FortiGate will accept the connection with a warning if the SNI does not match the CN or SAN fields.

FortiGate will close the connection if the SNI does not match the CN or SAN fields.

FortiGate will close the connection if the SNI does not match the CN and SAN fields

NEW QUESTION 96
An administrator wants to form an HA cluster using the FGCP protocol.
Which two requirements must the administrator ensure both members fulfill? (Choose two.)

They must have the same HA group ID.

They must have the heartbeat interfaces in the same subnet.

They must have the same number of configured VDOMs.

They must have the same hard drive configuration.

NEW QUESTION 97
Refer to the exhibit, which contains a RADIUS server configuration.

An administrator added a configuration for a new RADIUS server. While configuring, the administrator enabled Include in every user group.
What is the impact of enabling Include in every user group in a RADIUS configuration?

This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.

This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.

This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.

This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.

NEW QUESTION 98
Refer to the exhibits.

The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)

Set the Destination address as Webserver in the Deny policy.

Disable match-vipin the Deny policy.

Set the Destination address as Deny_IP in the Allow_access policy.

Enable match-vipin the Deny policy.

NEW QUESTION 99
Refer to the exhibits.

A diagram of a FortiGate device connected to the network VIP object and firewall policy configurations are shown.
The WAN (port2) interface has the IP address
100.65.0.101/24.
The LAN (port4) interface has the IP address
10.0.11.254/24.
If the host 100.65.1.111 sends a TCP SYN packet on port 443 to 100.65.0.200. what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?

10.0.11.254, 100.65.0.200. and 443, respectively

10.0.11.254, 10.0.15.50, and 4443. respectively

100.65.1. ill, 10.0.11.50, and 4443. respectively

100.65.1.111, 10.0.11.50. and 443. respectively

NEW QUESTION 100
Refer to the exhibit.

Which two statements about the FortiGuard connection are true? (Choose two.)

The weight increases as the number of failed packets rises

You can configure unreliable protocols to communicate with FortiGuard Server.

FortiGate identified the FortiGuard Server using DNS lookup.

FortiGate is using the default port for FortiGuard communication.

NEW QUESTION 101
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo acceleration enhance antivirus performance?

For proxy-based inspection, NTurbo offloads traffic to the content processor.

For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.

For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.

For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.

NEW QUESTION 102
Refer to the exhibit, which shows an SD-WAN zone configuration on the FortiGate GUI.

Based on the exhibit, which statement is true?

The underlay zone contains port1 and port2.

The d-wan zone contains no member.

The d-wan zone cannot be deleted.

The virtual-wan-link zone contains no member.

NEW QUESTION 103
You are analyzing connectivity problems caused by intermediate devices blocking traffic in SSL VPN environment.
In which two ways can you effectively resolve the problem? (Choose two.)

You can turn off IKE fragmentation to fix large certificate negotiation problems.

You should use IPsec to solve issues with fragment drops and large certificate exchanges.

You can use SSL VPN tunnel mode to prevent problems with blocked ESP and UDP ports (500 or 4500).

You can configure a hub-and-spoke topology with SSL VPN tunnels to bypass blocked UDP ports.

NEW QUESTION 104
An administrator wanted to configure an IPS sensor to block traffic that triggers the signature set number of times during a specific time period. How can the administrator achieve the objective?

Use IPS group signatures, set rate-mode 60.

Use IPS packet logging option with periodical filter option.

Use IPS signatures, rate-mode periodical option.

Use IPS filter, rate-mode periodical option.

NEW QUESTION 105
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)

Move up Google in the Application and Filter Overrides section to set its priority to 1.

Set the action for Google in the Application and Filter Overrides section to Allow.

Add *Google*.com to the URL category in the security profile.

Change the Inspection mode to Flow-based.

Set SSL inspection to deep-content inspection.

NEW QUESTION 106
A network administrator is configuring an IPsec VPN tunnel for a sales employee travelling abroad.
Which IPsec Wizard template must the administrator apply?

Hub-and-Spoke

Site to Site

Remote Access

Dial up User

NEW QUESTION 107
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

Enabled

On Idle

Disabled

On Demand

Fortinet NSE4_FGT_AD-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	VPN: This domain focuses on implementing meshed or partially redundant IPsec VPN topologies for secure connections.
Topic 2	Content Inspection: This domain addresses inspecting encrypted traffic using certificates, understanding inspection modes and web filtering, configuring application control, deploying antivirus scanning modes, and implementing IPS for threat protection.
Topic 3	Firewall Policies and Authentication: This domain focuses on creating firewall policies, configuring SNAT and DNAT for address translation, implementing various authentication methods, and deploying FSSO for user identification.
Topic 4	Routing: This domain covers configuring static routes for packet forwarding and implementing SD-WAN to load balance traffic across multiple WAN links.
Topic 5	Deployment and System Configuration: This domain covers initial FortiGate setup, logging configuration and troubleshooting, FGCP HA cluster configuration, resource and connectivity diagnostics, FortiGate cloud deployments (CNF and VM), and FortiSASE administration with user onboarding.