[Full-Version] 2025 New NSE4_FGT_AD-7.6 Actual Exam Dumps, Fortinet Practice Test [Q59-Q83]

QUESTION 59
Refer to the exhibits. The exhibits show the system performance output and default configuration of high memory usage thresholds on a FortiGate device.

Based on the system performance output, what are the two possible outcomes? (Choose two.)

FortiGate has entered conserve mode.

Administrators can access FortiGate only through the console port.

Administrators can change the configuration.

FortiGate drops new sessions.

QUESTION 60
An administrator has configured the following settings:

What are the two results of this configuration? (Choose two.)

Denied users are blocked for 30 minutes.

A session for denied traffic is created.

Session helpers are disabled for denied traffic.

The number of logs generated by denied traffic is reduced.

QUESTION 61
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, and the firewall policies, VIP, and IP pool configurations on the FortiGate device.
The WAN (port2) interface has the IP address 100.65.0.101/24.
The LAN (port4) interface has the IP address 10.0.11.254/24.
The first firewall policy has NAT enabled using the IP pool. The second firewall policy is configured with a VIP as the destination address.
Which IP address will be used to source NAT (SNAT) the internet traffic coming from a workstation with the IP address 10.0.11.50?

100.65.0.101

100.65.0.200

100.65.0.102

10.0.11.254

QUESTION 62
Refer to the exhibit. What can you conclude from the log shown in the exhibit?

The IPS scan is paused by the IPS diagnostic command with bypass mode option 5.

The IPS socket buffer is full and IPS engine needs more memory to create new sessions.

The IPS session scan is paused and reevaluating the packet because of a dirty flag.

The IPS socket buffer is full and IPS engine cannot decode a packet.

QUESTION 63
Refer to the exhibit. Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

All traffic from a source IP to a destination IP is sent to the same interface.

Traffic is sent to the link with the lowest latency.

Traffic is distributed based on the number of sessions through each interface.

All traffic from a source IP is sent to the same interface

QUESTION 64
What are three key routing principles in SD-WAN? (Choose three.)

By default. SD-WAN rules are skipped if the included SD-WAN members do not have a valid route to the destination.

SD-WAN rules have precedence over any other type of routes.

Regular policy routes have precedence over SD-WAN rules.

By default. SD-WAN rules are skipped if only one route to the destination is available.

By default. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.

QUESTION 65
What are two features of collector agent advanced mode? (Choose two.)

Advanced mode supports nested or inherited groups.

In advanced mode, security profiles can be applied only to user groups, not individual users.

In advanced mode, FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.

Advanced mode uses the Windows convention – NetBios: DomainUsername.

QUESTION 66
When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalid certificate.
Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choose three.)

Allow

Trust & Allow

Allow & Warning

Block

Block & Warning

QUESTION 67
A remote user reports slow SSL VPN performance and frequent disconnections. The user is located in an area with poor internet connectivity.
What setting should the administrator adjust to improve the user’s experience?

Enable split tunneling to reduce VPN traffic.

Change the SSL VPN port to a non-standard port.

Increase the session timeout for inactive sessions.

Configure the DTLS timeout to accommodate high-latency connections.

QUESTION 68
Refer to the exhibit, which shows a partial configuration from the remote authentication server.

Why does the FortiGate administrator need this configuration?

To set up a RADIUS server Secret.

To authenticate Any FortiGate user groups.

To authenticate and match the Training OU on the RADIUS server.

To authenticate only the Training user group.

QUESTION 69
Refer to the exhibit, which shows a routing table.

An administrator wants to create a new static route so the traffic to the subnet 172.20.1.0/24 is routed through port2 only.
What are the two criteria that the administrator can use to achieve this objective? (Choose two.)

The new static route must have the distance set to 9.

The existing static route through port3 must have the distance set to 11.

The new static route must have the priority set to 3.

The new static route must have the metric set to 1.

QUESTION 70
A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode.
Which step is NOT part of the expected process?

FortiGate determines user identity based on the IP address in the FSSO list.

The DC agent sends login event data directly to FortiGate.

The user logs into the windows domain.

The collector agent forwards login event data to FortiGate.

QUESTION 71
Which two statements about equal-cost multi-path (ECMP) configuration on FortiGate are true?
(Choose two.)

If SD-WAN is disabled, you can configure the parameter v4-ecmp-mode to volume-based.

If SD-WAN is enabled, you can configure routes with unequal distance and priority values to be part of ECMP.

If SD-WAN is disabled, you configure the load balancing algorithm in config system settings.

If SD-WAN is enabled, you control the load balancing algorithm with the parameter load-balance- mode.

QUESTION 72
An administrator configures FortiGuard servers as DNS servers on FortiGate using default settings.
What is true about the DNS connection to a FortiGuard server?

It uses DNS over TLS.

It uses DNS over HTTPS.

It uses UDP 8888.

It uses UDP 53.

QUESTION 73
What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

FortiGate directs the collector agent to use a remote LDAP server.

FortiGate uses the SMB protocol to read the event viewer logs from the DCs.

FortiGate does not support workstation check.

FortiGate uses the AD server as the collector agent.

QUESTION 74
A FortiGate firewall policy is configured with active authentication, however, the user cannot authenticate when accessing a website.
Which protocol must FortiGate allow even though the user cannot authenticate?

LDAP

TACASC+

Kerberos

DNS

QUESTION 75
An administrator suspects that the Collector Agent is not forwarding login events to FortiGate.
What is the most effective troubleshooting step?

Verify if DC agent is enabled on the FortiGate.

Restart the domain controller to refresh authentication services.

Verify if FortiGate is set to use LDAP authentication instead of FSSO.

Check if TCP port 8000 is open between the collector agent and FortiGate.

QUESTION 76
Which two statements about the Security Fabric rating are true? (Choose two.)

A license is required to obtain an executive summary in the Security Rating section.

The root FortiGate provides executive summaries of all the FortiGate devices in the Security Fabric.

The Security Posture category provides PCI compliance results.

Security Rating Insights are available only in the Security Rating page.

QUESTION 77
Which two statements are true about an HA cluster? (Choose two.)

An HA cluster cannot have both in-band and out-of-band management interfaces at the same time.

Link failover triggers a failover if the administrator sets the interface down on the primary device.

When sniffing the heartbeat interface, the administrator must see the IP address 169.254.0.2.

HA incremental synchronization includes FIB entries and IPsec SAs.

QUESTION 78
When configuring a FortiGate in a multi-WAN setup, why would an administrator enable session preservation on an interface?

To allow the FortiGate to dynamically change interfaces for all active sessions when a WAN link fails

To make sure all sessions without source NAT enabled always use the primary WAN link

To improve security by forcing users to authenticate again when the WAN link changes

To ensure that existing SSL VPN connections remain on the same interface even if route changes occur

QUESTION 79
Refer to the exhibits. Based on the current HA status, an administrator updates the override and priority parameters on HQ-NGFW-1 and HQ-NGFW-2 as shown in the exhibit.

What would be the expected outcome in the HA cluster?

HQ-NGFW-1 will synchronize the override disable setting with HQ-NGFW-2.

HQ-NGFW-2 will take over as the primary because it has the override enable setting and higher priority than HQ-NGFW-1.

HQ-NGFW-1 will remain the primary because HQ-NGFW-2 has lower priority.

The HA cluster will become out of sync because the override setting must match on all HA members.

QUESTION 80
Refer to the exhibit showing a debug flow output.

Which two conclusions can you make from the debug flow output? (Choose two.)

The default gateway is configured on port2.

The RPF check fails.

The debug flow is for UDP traffic.

The matching firewall policy denies the traffic.

QUESTION 81
Which two statements describe characteristics of automation stitches? (Choose two.)

Actions involve only devices included in the Security Fabric.

An automation stitch can have multiple triggers.

Multiple actions can run in parallel.

Triggers can involve external connectors.

QUESTION 82
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?

Enabled

On Idle

Disabled

On Demand

QUESTION 83
Refer to the exhibit. Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode? (Choose two.)

Administrators cannot change the configuration.

FortiGate skips quarantine actions.

Administrators must restart FortiGate to allow new session.

FortiGate drops new sessions requiring inspection.

Leave a comment Cancel reply