View Full Fortinet NSE4_FGT_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 261

Which FortiGate feature can help prevent a single high-volume application from consuming excessive available bandwidth?

1. Traffic Shaping
2. Web Filter
3. LDAP
4. Static Route

Correct Answer: 1

Explanation

Traffic Shaping allows administrators to control how much bandwidth specific traffic can consume. It can be applied to firewall policies or configured for particular traffic classes to prevent high-volume applications from overwhelming available network capacity. This is useful when administrators need to maintain predictable performance for business-critical services while limiting less important traffic. Web Filter controls website access, LDAP provides directory-based authentication, and static routes determine forwarding paths. Therefore, Traffic Shaping is the appropriate FortiGate feature when bandwidth consumption needs to be controlled for particular applications or traffic flows.

Question 262

Which FortiGate feature is used to define a specific IP address or network that can be referenced in a firewall policy?

1. Service object
2. Address object
3. User group
4. Traffic shaper

Correct Answer: 2

Explanation

An address object represents an IP address, subnet, range, or other supported network destination that can be referenced in FortiGate policies. Administrators can create reusable address objects for internal networks, servers, clients, or external destinations and then select them as policy sources or destinations. Service objects define protocols and ports, user groups organize authenticated identities, and traffic shapers control bandwidth. Address objects simplify policy management because the same network definition can be reused across multiple policies. Therefore, Address object is the correct choice for defining a specific IP address or network.

Question 263

Which FortiGate feature can identify applications and apply different actions based on application categories?

1. DHCP Server
2. Static Route
3. Application Control
4. IP Pool

Correct Answer: 3

Explanation

Application Control identifies applications using FortiGate application signatures and allows administrators to define actions for individual applications or application categories. A profile can be applied to a firewall policy so that matching traffic receives the configured treatment. This is useful when administrators need application-aware control instead of relying only on IP addresses and ports. DHCP Server provides network configuration, Static Route controls forwarding, and IP Pool provides addresses for NAT. Therefore, Application Control is the appropriate FortiGate feature for identifying applications and applying category-based actions.

Question 264

Which FortiGate component can store logs locally on the appliance for later review?

1. FortiGuard
2. FortiAnalyzer
3. Syslog Server
4. Local Disk

Correct Answer: 4

Explanation

The Local Disk option allows supported FortiGate models to store logs directly on the appliance. Local logging can be useful for reviewing traffic, event, and security information without immediately sending every log to an external system. FortiAnalyzer provides centralized log storage and analysis, while a Syslog Server is an external logging destination. FortiGuard provides security intelligence and related services. Therefore, Local Disk is the appropriate component when logs need to be stored directly on the FortiGate device, subject to the model’s storage capabilities and logging configuration.

Question 265

Which FortiGate feature can provide authentication against an external server using the RADIUS protocol?

1. RADIUS server
2. Web Filter
3. FortiView
4. Static Route

Correct Answer: 1

Explanation

A RADIUS server configuration allows FortiGate to communicate with an external RADIUS server for user authentication. FortiGate sends authentication requests to the configured server, which validates the user’s credentials and returns the authentication result. This enables centralized authentication and allows organizations to integrate FortiGate with existing identity infrastructure. Web Filter controls website access, FortiView provides traffic visibility, and static routes determine packet forwarding. Therefore, RADIUS server is the correct configuration when FortiGate needs to authenticate users through an external RADIUS service.

Question 266

Which FortiGate HA mode uses one unit as the primary device while another unit remains available to take over if the primary fails?

1. Active-active
2. Transparent
3. NAT mode
4. Active-passive

Correct Answer: 4

Explanation

In active-passive HA, one FortiGate unit normally operates as the primary device while another unit remains available as a secondary device. If the primary unit fails and the HA conditions trigger a failover, the secondary unit can take over the primary role. This design provides redundancy without requiring both units to actively process traffic in the same way. Active-active is a different HA operating model, while transparent and NAT mode describe firewall operation rather than this specific HA relationship. Therefore, Active-passive is the correct answer.

Question 267

Which FortiGate command can display information about an established IPsec VPN tunnel for troubleshooting?

1. diagnose vpn tunnel list
2. get system status
3. diagnose sys session list
4. get router info routing-table all

Correct Answer: 1

Explanation

The diagnose vpn tunnel list command provides information about IPsec VPN tunnels and is useful when troubleshooting VPN establishment and operational problems. Administrators can use the output to examine tunnel-related information and determine whether expected VPN security associations are present. get system status provides general system information, diagnose sys session list displays active sessions, and the routing-table command displays available routes. Therefore, diagnose vpn tunnel list is the appropriate diagnostic command for examining IPsec tunnel information.

Question 268

Which FortiGate feature can authenticate users against a directory service using the LDAP protocol?

1. FSSO
2. RADIUS
3. LDAP Server
4. FortiToken

Correct Answer: 3

Explanation

The LDAP Server configuration allows FortiGate to communicate with an LDAP-compatible directory service and authenticate users using directory credentials. This is commonly used with enterprise directory environments where user accounts and groups are centrally maintained. FSSO provides user identity information through supported single sign-on mechanisms, RADIUS uses a different centralized authentication protocol, and FortiToken provides token-based authentication. Therefore, LDAP Server is the correct configuration when FortiGate needs to authenticate users directly against an LDAP directory service.

Question 269

Which FortiGate feature can inspect traffic for malicious files using antivirus signatures and related detection mechanisms?

1. Application Control
2. Web Filter
3. Antivirus
4. SD-WAN

Correct Answer: 3

Explanation

The Antivirus security profile inspects supported traffic for malicious files and malware using FortiGate’s antivirus detection mechanisms and available security intelligence. When applied through a firewall policy, it can scan supported traffic and take configured actions when threats are detected. Application Control identifies applications, Web Filter controls website access, and SD-WAN manages WAN-path selection. Antivirus is therefore the appropriate security profile when the main requirement is to detect malicious files or malware in supported network traffic.

Question 270

Which FortiGate feature can determine whether an SD-WAN link satisfies configured latency, jitter, and packet-loss thresholds?

1. Performance SLA
2. Firewall policy
3. FortiView
4. User group

Correct Answer: 1

Explanation

Performance SLA evaluates the health and quality of SD-WAN paths using measurements such as latency, jitter, and packet loss. Administrators can define thresholds that determine whether a path meets the required performance conditions. SD-WAN rules can then use the SLA status when selecting an appropriate path for traffic. Firewall policies control security access, FortiView provides visibility into activity, and user groups organize authenticated identities. Therefore, Performance SLA is the correct feature for determining whether an SD-WAN link meets configured performance requirements.

Question 271

Which FortiGate feature can display current traffic activity and identify top applications or destinations through a graphical interface?

1. FortiView
2. DHCP Server
3. LDAP Server
4. IP Pool

Correct Answer: 1

Explanation

FortiView provides graphical visibility into traffic and security activity on a FortiGate device. Depending on the available data and configuration, administrators can examine top applications, sources, destinations, users, bandwidth usage, and other activity. This makes FortiView useful for quickly understanding current network behavior and identifying unusual traffic patterns. DHCP Server assigns network configuration, LDAP Server supports directory authentication, and IP Pool provides addresses for NAT. Therefore, FortiView is the correct feature for graphical monitoring of traffic activity and application usage.

Question 272

Which FortiGate feature can protect management access by requiring administrators to connect from explicitly allowed source IP addresses?

1. Service Group
2. Trusted Hosts
3. Application Control
4. Web Filter

Correct Answer: 2

Explanation

Trusted Hosts allow administrators to restrict management access for a specific administrator account to defined source IP addresses or networks. This means that valid credentials alone are not enough when the connection originates outside the configured trusted locations. Such restrictions can reduce the attack surface of administrative services exposed on reachable interfaces. Service Group combines service objects, Application Control manages application traffic, and Web Filter controls website access. Therefore, Trusted Hosts is the appropriate feature for limiting administrator access according to source IP addresses.

Question 273

Which FortiGate feature is used to create a secure connection between two networks over an untrusted IP network?

1. IPsec VPN
2. DHCP Server
3. Web Filter
4. Traffic Shaping

Correct Answer: 1

Explanation

An IPsec VPN creates an encrypted connection between networks across an untrusted network such as the public Internet. FortiGate uses IKE and IPsec security associations to authenticate peers and protect traffic between the configured networks. DHCP Server provides network configuration, Web Filter controls website access, and Traffic Shaping manages bandwidth. IPsec VPNs are commonly used for site-to-site connectivity, remote access designs, and redundant or partially meshed VPN architectures. Therefore, IPsec VPN is the correct feature for securely connecting networks over an untrusted IP network.

Question 274

Which FortiGate feature can allow an administrator to group multiple users so they can be referenced together in authentication policies?

1. Address Group
2. Service Group
3. User Group
4. Interface Zone

Correct Answer: 3

Explanation

A User Group allows multiple authenticated users or directory groups to be combined into one reusable identity-based object. Administrators can then reference the group in authentication configurations or identity-based firewall policies instead of configuring each user individually. Address Groups combine network address objects, Service Groups combine service definitions, and Interface Zones group interfaces. User groups are especially useful when different departments or user categories require different access permissions. Therefore, User Group is the appropriate feature for grouping users for authentication and policy purposes.

Question 275

Which FortiGate feature can control access to websites by using URL categories provided by FortiGuard?

1. Antivirus
2. Web Filter
3. IPS
4. Traffic Shaping

Correct Answer: 2

Explanation

Web Filter can use URL categories and available FortiGuard web-rating information to control access to websites. Administrators can configure actions such as allow, block, monitor, or warning for selected categories or destinations. This provides a way to enforce web-access policies based on content classification rather than maintaining individual entries for every website. Antivirus focuses on malware detection, IPS detects network attacks, and Traffic Shaping manages bandwidth. Therefore, Web Filter is the appropriate FortiGate security profile for controlling websites according to URL categories.

Question 276

Which FortiGate configuration allows a public IP address to forward incoming connections to an internal server?

1. Address Group
2. Service Object
3. Virtual IP
4. User Group

Correct Answer: 3

Explanation

A Virtual IP, or VIP, performs destination NAT by mapping a public IP address to an internal IP address. It is commonly used when an organization needs to publish an internal server to external users. A firewall policy is normally required to permit the corresponding inbound traffic after the VIP has been configured. Address groups organize IP objects, service objects define protocols and ports, and user groups organize authenticated users. Therefore, Virtual IP is the correct configuration for forwarding incoming connections from a public address to an internal server.

Question 277

Which FortiGate feature can help determine why traffic is matching an unexpected firewall policy?

1. Policy Lookup
2. FortiToken
3. DHCP Server
4. FortiGuard

Correct Answer: 1

Explanation

Policy Lookup helps administrators determine which firewall policy matches specified traffic conditions. This is particularly useful when traffic is being handled by an unexpected rule or when administrators need to verify the effects of policy order, source addresses, destinations, services, and interfaces. FortiToken provides token-based authentication, DHCP Server provides network configuration, and FortiGuard supplies security services and intelligence. Therefore, Policy Lookup is the appropriate troubleshooting feature for identifying the firewall policy that matches a particular traffic flow.

Question 278

Which FortiGate feature can monitor a selected interface and contribute to HA failover decisions if that interface fails?

1. Session Pickup
2. Interface Monitoring
3. Traffic Shaping
4. FortiAnalyzer

Correct Answer: 2

Explanation

Interface Monitoring allows FortiGate HA to monitor selected interfaces for operational failures. If a monitored interface goes down, the HA configuration can use that information when determining whether a failover should occur. This helps ensure that the primary unit maintains required connectivity through important network interfaces. Session Pickup synchronizes supported session information, Traffic Shaping manages bandwidth, and FortiAnalyzer provides centralized logging and analysis. Therefore, Interface Monitoring is the correct HA feature for monitoring interfaces and incorporating their status into failover behavior.

Question 279

Which FortiGate feature can provide a logical interface that can be used as a stable endpoint for routing or management purposes?

1. VLAN Interface
2. Service Group
3. Loopback Interface
4. IP Pool

Correct Answer: 3

Explanation

A Loopback Interface is a logical interface that is not directly dependent on the operational state of a particular physical interface. It can provide a stable IP endpoint for routing, management, or other network functions. VLAN interfaces are logical interfaces associated with VLAN tagging, service groups combine network services, and IP pools provide addresses primarily for NAT operations. Because a loopback interface can remain logically available while physical interfaces change state, it is useful when a stable logical address is required. Therefore, Loopback Interface is the correct answer.

Question 280

Which FortiGate feature can provide centralized analysis of logs received from FortiGate devices?

1. FortiToken
2. FortiGuard
3. FortiAnalyzer
4. FortiView

Correct Answer: 3

Explanation

FortiAnalyzer provides centralized collection, storage, analysis, and reporting of logs generated by FortiGate and other supported Fortinet devices. It can help administrators investigate traffic activity, security events, and operational information from a centralized platform. FortiToken is used for token-based authentication, FortiGuard provides security intelligence and related services, and FortiView provides local visibility on FortiGate. Therefore, FortiAnalyzer is the appropriate solution when administrators need centralized analysis of logs received from FortiGate devices.