Free NSE4_FGT_AD-7.6 sample questions

Correct answer: Enable `override` and configure the primary device with a higher priority.

With override disabled (the default), primary selection compares monitored interfaces, then HA uptime (differences below ha-uptime-diff-margin, default 300 s, are ignored), then priority, then serial number. A unit that rebooted has its uptime reset, so it does not reclaim the primary role. Enabling `override` makes device priority count before uptime (monitored interfaces, priority, uptime, serial). FGT-A, configured with the higher priority (default 128), therefore becomes primary again when it rejoins. Enable override on the cluster members; `override-wait-time` (default 0) can delay renegotiation to reduce flapping. session-pickup-delay only limits session sync to sessions older than 30 seconds.

Correct answer: The `fabric-object-unification` setting is set to `local` on the root FortiGate.

When the Security Fabric is enabled, global objects such as addresses, services and schedules are synchronized from the upstream FortiGate to downstream devices by default. This is controlled on the root by `config system csf` > `set fabric-object-unification {default | local}`: with default, global CMDB objects are synchronized, and with local they are not. Individual objects must also have Fabric synchronization (`fabric-object`) enabled. Because the branches are already authorized and online, the Fabric link on TCP 8013 (the default upstream-port) is working and authorization is not the problem.

Correct answer: The packet matched the implicit deny policy.

The debug message 'Denied by forward policy check (policy 0)' specifically indicates that the packet failed to match any user-defined firewall policy and hit the default implicit deny policy, which has an ID of 0. This means there is no valid firewall policy allowing traffic from 192.168.1.10 to 10.0.2.50 on port 80.

Correct answers: It displays the current active sessions in the kernel session table.; Its output can be limited to specific sessions by first defining criteria with `diagnose sys session filter`.

`diagnose sys session list` displays the sessions in the kernel session table (addresses, ports, protocol, state, policy ID, NPU offload state, and so on). You can narrow the output by first setting criteria with `diagnose sys session filter `, such as src, dst, dport or policy. The list and clear commands then act only on matching sessions. The list itself removes nothing; `diagnose sys session clear` does. Sessions are not kept across reboots.

`diagnose sys session list` displays the sessions in the kernel session table (addresses, ports, protocol, state, policy ID, NPU offload state, and so on). You can narrow the output by first setting criteria with `diagnose sys session filter `, such as src, dst, dport or policy. The list and clear commands then act only on matching sessions. The list itself removes nothing; `diagnose sys session clear` does. Sessions are not kept across reboots.

Correct answer: Create a VIP with 'External IP' 203.0.113.10 and 'Mapped IP' 192.168.1.50. Enable 'Port Forwarding', set 'External Service Port' to 8443, and 'Map to Port' to 443.

This is the correct method for Port Forwarding. The VIP object defines the translation. The External Service Port (8443) is the listening port on the WAN, and 'Map to Port' (443) is the target port on the internal server. This object must then be used as the Destination in a firewall policy.

Correct answer: The Collector Agent gathers logon events (from DC agents or by polling the Domain Controllers) and sends the user logon information to the FortiGate.

With a Collector Agent (CA), logon events are gathered either from DC agents installed on the domain controllers (DC-agent mode, DC agents send to the CA on UDP 8002) or by the CA polling the DCs. The CA then sends the user IP-to-group logon information to the FortiGate over TCP 8000. The FortiGate does not poll the DCs itself in this mode, and RADIUS/multicast are not used.