View Full Fortinet NSE4_FGT_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 161

Which FortiGate feature allows an administrator to define a policy that blocks traffic unless it matches an explicitly permitted firewall policy?

1. Implicit deny
2. Service group
3. Address group
4. Traffic shaper

Correct Answer: 1

Explanation

The implicit deny behavior means that traffic is denied when it does not match an applicable firewall policy that permits it. FortiGate evaluates configured policies according to its policy-processing logic, and traffic that fails to match an appropriate allow policy is not automatically permitted. This provides a fundamental security boundary because administrators must explicitly define the traffic they want to allow. Service groups organize services, address groups combine address objects, and traffic shapers control bandwidth. Therefore, Implicit deny is the correct concept for blocking unmatched traffic.

Question 162

Which FortiGate feature allows an administrator to create a single policy reference containing several related network services?

1. Address group
2. Service group
3. User group
4. Interface zone

Correct Answer: 2

Explanation

A service group combines multiple service objects into one reusable logical object. For example, HTTP, HTTPS, DNS, and other required services can be grouped and then referenced by a firewall policy. This simplifies administration when the same collection of services is needed in multiple policies. Address groups combine IP address objects, user groups organize authenticated users, and interface zones group interfaces. Service groups are particularly useful for reducing repetitive policy configuration while maintaining clear service definitions. Therefore, Service group is the correct answer.

Question 163

Which FortiGate feature can identify the category and reputation of a requested website using FortiGuard information?

1. Traffic Shaping
2. Application Control
3. Web Filter
4. DHCP

Correct Answer: 3

Explanation

Web Filter can use FortiGuard web-rating information to determine the category and reputation associated with requested websites. Administrators can configure actions based on these classifications, such as allowing, blocking, monitoring, or warning users. This provides organizations with a method of controlling web access according to security and acceptable-use requirements. Traffic Shaping manages bandwidth, Application Control identifies applications, and DHCP provides network configuration. Therefore, Web Filter is the appropriate feature for using FortiGuard website categorization and reputation information.

Question 164

Which FortiGate configuration is used to translate an internal server address to a public destination address for inbound connections?

1. Virtual IP
2. IP pool
3. Service group
4. Address group

Correct Answer: 1

Explanation

A Virtual IP, or VIP, is used to perform destination NAT for inbound traffic. It can map an external IP address to an internal server address and can also be configured to forward selected external ports to specific internal ports. This allows organizations to publish required services while keeping the server on a private network. IP pools are generally used for source NAT, while service groups and address groups organize configuration objects. Therefore, Virtual IP is the correct configuration for translating an internal server address for inbound access.

Question 165

Which FortiGate feature can determine whether an administrator has entered a correct username and password for a local account?

1. Local authentication
2. Static routing
3. Web filtering
4. Traffic shaping

Correct Answer: 1

Explanation

Local authentication verifies credentials against user accounts configured directly on the FortiGate device. Administrators can create local users and assign them to appropriate user groups or authentication configurations. When authentication is requested, FortiGate validates the supplied credentials against the locally configured account information. Static routing controls packet forwarding, Web Filtering controls website access, and Traffic Shaping manages bandwidth. Therefore, Local authentication is the appropriate method when FortiGate itself stores and verifies the user credentials.

Question 166

Which FortiGate feature can use a security profile to scan supported traffic for known malware signatures?

1. IPS
2. Antivirus
3. Web Filter
4. DNS Filter

Correct Answer: 2

Explanation

The Antivirus security profile scans supported traffic and content for malware using FortiGuard updates and configured antivirus inspection settings. It can detect threats such as viruses, worms, trojans, and other supported malicious content. IPS focuses primarily on network attacks and intrusion signatures, Web Filter controls website access, and DNS Filter evaluates DNS requests. Antivirus inspection is therefore the appropriate security mechanism when the primary requirement is detecting malicious files or content. Proper antivirus configuration helps reduce the risk of malware reaching protected users or systems.

Question 167

Which FortiGate command can help administrators verify the current routing information when troubleshooting a connectivity problem?

1. diagnose vpn tunnel list
2. get system status
3. get router info routing-table all
4. diagnose sys session list

Correct Answer: 3

Explanation

The get router info routing-table all command displays the routes currently known to FortiGate and is useful when troubleshooting connectivity. Administrators can inspect destination networks, gateways, interfaces, route sources, and other routing information to determine whether FortiGate has an appropriate path toward a destination. diagnose vpn tunnel list focuses on VPN tunnels, get system status provides general device information, and diagnose sys session list displays active sessions. Therefore, the routing-table command is the correct tool for checking current routing information.

Question 168

Which FortiGate feature allows a device to authenticate users through an external directory service based on LDAP?

1. RADIUS
2. FSSO
3. Local users
4. LDAP server

Correct Answer: 4

Explanation

An LDAP server configuration allows FortiGate to communicate with an external LDAP directory for user authentication and directory lookups. This allows organizations to use existing directory accounts and centralized identity information instead of creating every account directly on FortiGate. RADIUS uses a RADIUS authentication server, FSSO provides user identity information through supported single sign-on mechanisms, and local users are stored on the FortiGate itself. Therefore, LDAP server is the correct configuration for authenticating users through an external LDAP directory.

Question 169

Which FortiGate feature can monitor network paths and provide measurements such as jitter and latency for SD-WAN decisions?

1. Performance SLA
2. Firewall policy
3. Service group
4. Address group

Correct Answer: 1

Explanation

Performance SLA monitors the quality of configured network paths using measurements such as latency, jitter, and packet loss. These measurements allow FortiGate to determine whether a path meets defined performance requirements. SD-WAN rules can use the resulting health information when selecting paths for traffic. Firewall policies control access, service groups organize services, and address groups organize IP address objects. Performance SLA is therefore the appropriate feature for measuring WAN-path quality and providing information that can influence SD-WAN path selection.

Question 170

Which FortiGate feature can restrict access to administrative services by allowing management traffic only from specified source networks?

1. Firewall schedule
2. Trusted hosts
3. Service group
4. IP pool

Correct Answer: 2

Explanation

Trusted hosts allow administrators to specify source IP addresses or networks from which an administrator account can be used for management access. This provides an additional restriction on administrative access because valid credentials alone may not be sufficient when the connection originates outside the configured trusted sources. Firewall schedules determine when policies operate, service groups combine service definitions, and IP pools provide addresses for source NAT. Therefore, Trusted hosts is the correct feature for restricting administrative access according to the originating network.

Question 171

Which FortiGate feature can inspect HTTPS certificates without decrypting the full contents of the encrypted session?

1. Certificate inspection
2. Deep inspection
3. Application Control
4. Antivirus

Correct Answer: 1

Explanation

Certificate inspection examines information contained in the SSL/TLS certificate presented by the destination without performing full content decryption of the encrypted session. This can allow FortiGate to make certain security decisions based on certificate information while avoiding the certificate-generation and full decryption requirements associated with deep inspection. Deep inspection decrypts supported encrypted traffic for content inspection, Application Control identifies applications, and Antivirus scans supported content for malware. Therefore, Certificate inspection is the correct option when certificate information needs to be evaluated without full content decryption.

Question 172

Which FortiGate feature provides encrypted communication between two VPN peers over the internet using IPsec?

1. Web Filter
2. IPsec VPN
3. DHCP
4. Traffic Shaping

Correct Answer: 2

Explanation

An IPsec VPN establishes encrypted communication between VPN peers across an untrusted network such as the internet. FortiGate uses IKE negotiation and IPsec security associations to authenticate peers and protect traffic with configured encryption and authentication parameters. This allows private networks to communicate securely without requiring a dedicated private connection. Web Filter controls website access, DHCP provides network addressing, and Traffic Shaping manages bandwidth. Therefore, IPsec VPN is the appropriate FortiGate feature for creating encrypted site-to-site or supported remote VPN connectivity.

Question 173

Which FortiGate HA feature determines which unit is preferred to become the primary unit based on configured device priority?

1. Session pickup
2. Override
3. Traffic shaping
4. Web filtering

Correct Answer: 2

Explanation

The HA override setting can influence primary-unit selection by allowing the configured unit with the appropriate HA priority to become or remain the primary device when the required conditions are met. This provides administrators with greater control over primary-unit selection in an HA cluster. Session pickup relates to preserving supported sessions during failover, while Traffic Shaping and Web Filtering are unrelated security and traffic-management features. Therefore, Override is the correct HA feature for influencing which unit is preferred as the primary device.

Question 174

Which FortiGate feature can preserve supported active sessions when an HA failover occurs?

1. Session pickup
2. Web Filter
3. DNS Filter
4. Service group

Correct Answer: 1

Explanation

Session pickup is an HA feature designed to synchronize supported session information between cluster members so that sessions can continue more smoothly after a failover. Without appropriate session synchronization, existing connections may need to be re-established when the primary unit changes. The exact sessions supported for pickup depend on FortiOS configuration and platform capabilities. Web Filter and DNS Filter are security profiles, while service groups organize service objects. Therefore, Session pickup is the correct feature for maintaining supported active sessions during HA failover.

Question 175

Which FortiGate feature can forward security and traffic logs to FortiAnalyzer for centralized analysis?

1. Traffic Shaping
2. FortiView
3. FortiAnalyzer logging
4. Local authentication

Correct Answer: 3

Explanation

FortiGate can send supported logs to FortiAnalyzer for centralized collection, analysis, reporting, and investigation. This allows administrators to examine information from FortiGate devices through a centralized platform instead of relying only on local storage. FortiView provides local graphical visibility, Traffic Shaping controls bandwidth, and local authentication handles user verification. Centralized logging is especially useful in environments with multiple FortiGate devices or significant security-event volumes. Therefore, FortiAnalyzer logging is the appropriate option for sending FortiGate logs to a centralized FortiAnalyzer system.

Question 176

Which FortiGate feature can apply a bandwidth limit to traffic generated by a specific policy?

1. Web Filter
2. Traffic Shaping
3. Antivirus
4. DNS Filter

Correct Answer: 2

Explanation

Traffic Shaping can be configured to control the bandwidth consumed by selected traffic, including traffic handled by a firewall policy. Administrators can use traffic-shaping settings to limit or prioritize network usage according to business requirements. This can help prevent noncritical traffic from consuming excessive bandwidth and affecting important applications. Web Filter controls website access, Antivirus scans supported traffic for malware, and DNS Filter controls DNS requests. Therefore, Traffic Shaping is the correct feature for applying bandwidth limits to selected policy traffic.

Question 177

Which FortiGate feature can provide a visual representation of security and traffic information for investigation?

1. FortiView
2. Static route
3. DHCP client
4. IP pool

Correct Answer: 1

Explanation

FortiView provides graphical visibility into traffic, applications, users, destinations, sources, and various security-related information. It can help administrators quickly identify traffic patterns, investigate unusual activity, and understand how network resources are being used. Static routes control packet forwarding, DHCP clients obtain network configuration from an upstream server, and IP pools provide addresses for source NAT. Therefore, FortiView is the appropriate feature for obtaining a visual representation of traffic and security information directly from FortiGate.

Question 178

Which FortiGate feature can use a public IP address to publish an internal web server to external users?

1. Address group
2. Service group
3. Virtual IP
4. Performance SLA

Correct Answer: 3

Explanation

A Virtual IP can map a public-facing IP address to an internal server address and can optionally perform port forwarding for specific services. For example, an organization can publish an internal web server through a public IP while keeping the actual server address private. A firewall policy is normally used together with the VIP to control the permitted inbound traffic. Address groups and service groups organize policy objects, while Performance SLA monitors network-path quality. Therefore, Virtual IP is the correct feature for publishing an internal web server through a public address.

Question 179

Which FortiGate feature can authenticate a user against an external authentication server using the RADIUS protocol?

1. LDAP server
2. FSSO
3. RADIUS
4. Local user

Correct Answer: 3

Explanation

RADIUS allows FortiGate to communicate with an external RADIUS authentication server when verifying user credentials. This can provide centralized authentication and allow organizations to use existing identity infrastructure. The RADIUS server processes the authentication request and returns an appropriate response to FortiGate. LDAP server configurations use LDAP-based directory communication, FSSO provides identity information through supported single sign-on mechanisms, and local users are stored directly on FortiGate. Therefore, RADIUS is the correct authentication method for an external RADIUS server.

Question 180

Which FortiGate feature can determine whether a configured WAN path is healthy enough to be used by an SD-WAN rule?

1. Firewall policy
2. Performance SLA
3. Address group
4. Service group

Correct Answer: 2

Explanation

Performance SLA measures the health and quality of SD-WAN paths using configured criteria such as latency, jitter, and packet loss. FortiGate can use these measurements to determine whether a WAN path satisfies the required service-level conditions. SD-WAN rules can then use the health status when selecting the appropriate path for matching traffic. Firewall policies control traffic access, address groups organize IP addresses, and service groups organize services. Therefore, Performance SLA is the correct feature for determining whether a WAN path meets configured SD-WAN performance requirements.