When configuring firewall policies which of the following is true regarding the policy ID? (Choose two.)
Answer(s): B,C
According to the FortiOS 7.6 Administration Guide, the firewall policy ID is a unique numerical identifier assigned to each policy for internal database tracking and management purposes. It is important to distinguish the policy ID from the policy sequence. While the FortiGate processes traffic based on a top-down approach (the sequence), the policy ID itself does not determine the order of execution (Statement A is incorrect).In FortiOS, once a policy is committed to the configuration, the policy ID cannot be modified (Statement B). If an administrator needs to change a policy ID, they must either delete and recreate the policy or use the clone command in the CLI to copy the settings to a new ID.Furthermore, the CLI provides a specific shortcut for policy creation: you can create a policy with ID 0 (Statement C). When the command edit 0 is used within the config firewall policy context, the FortiOS kernel automatically assigns the next available integer as the policy ID. This is a standard practice for efficient configuration via the command line. Statement D is incorrect because, while every policy must have an ID, the GUI automatically generates this value without requiring the user to manually provide or even see it during the initial creation process.
Refer to the exhibits.The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.The WAN (port2) interface has the IP address100.65.0.101/24.The LAN (port4) interface has the IP address10.0.11.254/24.Which IP address will be used to source NAT (SNAT) the traffic, if the user on HQ-PC-1 (10.0.11.50) pings the IP address of BR-FGT (100.65.1.111)?
Answer(s): D
From the exhibits, there are three relevant firewall policies from LAN (port4) to WAN (port2), each using a different IP pool for source NAT:TCP trafficService: ALL_TCPDestination: BR1-FGTIP Pool: SNAT-Pool →100.65.0.49PING trafficService: PINGDestination: allIP Pool: SNAT-Remote1 →100.65.0.99IGMP trafficService: IGMPDestination: allIP Pool: SNAT-Remote →100.65.0.149The user on HQ-PC-1 (10.0.11.50) is pinging BR1-FGT (100.65.1.111). In FortiOS, policy matching is based on (among other fields) source, destination, and service, and the first matching policy in top-down order is applied.Because the traffic is ICMP echo (ping), it matches the policy named PING traffic (service PING, destination all). That policy explicitly uses Use Dynamic IP Pool with SNAT-Remote1, which is configured with external IP 100.65.0.99.Therefore, the source NAT IP used for this ping is 100.65.0.99.
An administrator manages a FortiGate model that supports NTurboHow does NTurbo acceleration enhance antivirus performance?
Answer(s): A
According to the FortiOS 7.6 Administration Guide and Fortinet hardware acceleration (NTurbo) documentation, the correct answer is A.What NTurbo Is (FortiOS 7.6 – Verified)NTurbo is a hardware-based acceleration feature available on specific FortiGate models. It is designed to improve antivirus and IPS performance when operating in flow-based inspection mode.NTurbo works by creating a fast, optimized data path between:FortiGate ingress interfaceIPS/AV engineFortiGate egress interfaceThis minimizes CPU involvement and reduces packet traversal overhead.Why Option A Is CorrectA . For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.This is exactly how NTurbo works, as documented:NTurbo applies to flow-based inspection onlyIt accelerates IPS and antivirus scanningIt creates a dedicated fast path that bypasses unnecessary processing stepsThis significantly improves throughput and lowers latencyThis description matches Fortinet’s official explanation of NTurbo.Why the Other Options Are IncorrectB . NTurbo creates two inspection sessionsIncorrect. NTurbo does not duplicate sessions; it optimizes the packet path.C . NTurbo offloads traffic to the content processor (proxy-based)Incorrect. NTurbo does not apply to proxy-based inspection and does not offload to content processors.D: NTurbo buffers the whole file and then sends it to the antivirus engineIncorrect. Buffering entire files is a proxy-based behavior, not NTurbo.
Refer to the exhibit.As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit What could be the possible reason of the diagnose output shown in the exhibit?
The exhibit shows the output of the following command:diagnose test application ipsmonitor 1pid = 2044, engine count = 0 (+1)0 - pid:2074:2074 cfg:1 master:0 run:1How to interpret this output (FortiOS 7.6 – IPS internals)ipsmonitor displays the status of IPS engines running on the FortiGate.engine count = 0 means:No IPS scanning engines are currently activeIPS is not processing any trafficIn FortiOS, IPS engines are started on demand.Critical documented behaviorIPS processes are only spawned when at least one firewall policy is configured with an IPS profile and traffic matches that policy.If no firewall policy references an IPS profile, the IPS engine:Does not startShows engine count = 0Appears “not working,” even though the IPS profile existsThis is exactly what the diagnose output indicates.Why option A is correctA . There is no firewall policy configured with an IPS security profile.Creating an IPS profile alone is not sufficientIPS must be applied to an active firewall policyTraffic must match that policy for the IPS engine to runOtherwise, ipsmonitor will show engine count = 0This matches FortiOS 7.6 IPS operational behavior.Why the other options are incorrectB . Administrator entered the command diagnose test application ipsmonitor 5.Incorrect.The exhibit clearly shows ipsmonitor 1Using a different argument would not explain engine count = 0C . FortiGate entered into IPS fail open state.Incorrect.In fail-open, IPS engines may be bypassed, but they still initialize engine count = 0 specifically indicates IPS is not in use at allD . Administrator entered the command diagnose test application ipsmonitor 99.Incorrect.The command argument affects debug level, not engine creationAgain, the exhibit shows ipsmonitor 1
Refer to the exhibit.Which two ways can you view the log messages shown in the exhibit? (Choose two.)
Answer(s): C,D
The exhibit shows a FortiGate UTM application control log with fields such as:type="utm"subtype="app-ctrl"action="block"policyid=1appid=30220appcat="Video/Audio"service="HTTP"apprisk="elevated"This is a forward traffic security log, generated by Application Control applied to a firewall policy.Why the correct answers are C and DC . By filtering by policy universally unique identifier (UUID) and application name in the log entryCorrect.FortiOS logs can be viewed and filtered in:Log & Report →Forward TrafficAdministrators can filter logs using fields such as:Policy ID / Policy UUIDApplication name (app)Application ID (appid)The log entry clearly includes application-related fields, making filtering by policy and application a valid and documented way to view these logs.D . In the Forward Traffic sectionCorrect.The log is a UTM Application Control log for traffic passing through a firewall policy.Such logs are displayed under:Log & Report →Forward TrafficThis is the standard and correct location to view application control, web filter, IPS, and other security profile logs related to user traffic.Why the other options are incorrectA . By right clicking the implicit deny policyIncorrect.Implicit deny policies do not generate UTM forward traffic logs like the one shown.Application control logs are generated only by explicit firewall policies with security profiles enabled.B . Using the FortiGate CLI command diagnose log testIncorrect.diagnose log test is used to test log connectivity and log settings, not to view historical log entries.It does not display traffic or UTM logs.
Refer to the exhibit.The administrator configured SD-WAN rules and set the FortiGate traffic log page to display SD-WAN-specific columns: SD-WAN Quality and SD-WAN Rule NameFortiGate allows the traffic according to policy ID 1 placed at the top. This is the policy that allows SD-WAN traffic. Despite these settings, the traffic logs do not show the name of the SD-WAN rule used to steer those traffic flowsWhat could be the reason?
In FortiOS 7.6, SD-WAN steering decisions are recorded in traffic logs only when traffic matches an explicit SD-WAN rule (SD-WAN service rule). When no configured SD-WAN rule matches a session, FortiGate uses the implicit (default) SD-WAN rule/behavior to select a member (often resulting in load-balancing or default selection based on the configured SD-WAN algorithm).In the exhibit, traffic is permitted by firewall policy ID 1, and the Destination Interface alternates between port1 and port2, but SD-WAN Rule Name remains empty. This is consistent with the sessions being forwarded by the implicit SD-WAN rule, which does not populate a named rule in the log columns.Why the other options are not correct:A: SD-WAN rule name logging is not a “delayed display” behavior requiring refresh; it is populated per-session when an explicit rule matches.B: Application Control is not required for SD-WAN rule name to appear. Rule name logging depends on SD-WAN rule match, not on whether Application Control is enabled.C: Feature visibility affects GUI display options, but the exhibit already shows the SD-WAN columns enabled; the issue is that no explicit SD-WAN rule is being hit.
Refer to the exhibits.A diagram of a FortiGate device connected to the network VIP object and firewall policy configurations are shown.The WAN (port2) interface has the IP address100.65.0.101/24.The LAN (port4) interface has the IP address10.0.11.254/24.If the host 100.65.1.111 sends a TCP SYN packet on port 443 to 100.65.0.200. what will the source address, destination address, and destination port of the packet be at the time FortiGate forwards the packet to the destination?
Answer(s): C
From the exhibits:A VIP named VIP-WEB-SERVER is configured on WAN (port2) with:External IP: 100.65.0.200Mapped (internal) IP: 10.0.11.50Port forwarding enabled (TCP)External service port: 443Map to IPv4 port: 4443The inbound firewall policy Web_Server_Access is:From WAN (port2) to LAN (port4)Destination: VIP-WEB-SERVERService: HTTPSNAT: Disabled (meaning no source NAT is applied)What happens to the packetA host 100.65.1.111 sends TCP SYN dst-port 443 to 100.65.0.200.When FortiGate matches the VIP and forwards traffic to the internal server, FortiGate performs destination NAT (DNAT) based on the VIP:Source IP is unchanged because policy NAT is disabled:Source remains 100.65.1.111Destination IP is translated by the VIP:Destination becomes 10.0.11.50Destination port is translated by the VIP port-forward:Destination port becomes 4443Therefore, at the time FortiGate forwards the packet to the destination (internal server), it will be:Source address: 100.65.1.111Destination address: 10.0.11.50Destination port: 4443
A network administrator is reviewing firewall policies in both Interface Pair View and By Sequence View. The policies appear in a different order in each view. Why is the policy order different in these two views?
In FortiOS 7.6, firewall policies can be displayed in multiple views to help administrators understand and manage rules more effectively. The difference in ordering between Interface Pair View and By Sequence View is intentional and documented.Why the policy order is differentInterface Pair ViewGroups firewall policies based on the incoming (From) and outgoing (To) interfaces.Policies are organized under interface pairs such as:LAN →WANWAN →LANWithin each interface pair, policies may appear reordered compared to the global list.This view is designed for readability and troubleshooting, not to show execution order.By Sequence ViewDisplays firewall policies in their actual evaluation (processing) order.This is the top-down order FortiGate uses when matching traffic.It reflects the real rule sequence that determines which policy is hit first.Why option C is correctC . Interface Pair View sorts policies based on matching interfaces, while By Sequence View shows the actual processing order of rules.This statement exactly matches FortiOS behavior as documented in the FortiOS 7.6 Firewall Policy Views section of the Administrator Guide.Why the other options are incorrectA: Interface Pair View does not follow traffic logs, and By Sequence View is not based on “rule priority” grouping.B: FortiGate does not dynamically reorder policies based on traffic patterns.D: Security levels do not affect policy ordering in Interface Pair View.
Post your Comments and Discuss Fortinet NSE4_FGT_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE4_FGT_AD-7.6 content, but please register or login to continue.