A new administrator is configuring FSSO authentication on FortiGate using DC Agent Mode. Which step is not part of the expected process?
Answer(s): A
Which statement correctly describes NetAPI polling mode for the FSSO collector agent?
Answer(s): B
NetAPI: Polls temporary sessions created on the DC when a user logs on or logs off and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged form RAM, before the agent has a chance to poll and notify FG.
Refer to the exhibits.An administrator has observed the performance status outputs on an HA cluster for 55 seconds.Which FortiGate is the primary?
Answer(s): D
From the HA configuration shown for HQ-NGFW-1:set memory-based-failover enable set memory-failover-threshold 70set memory-failover-monitor-period 50set memory-failover-sample-rate 10set memory-failover-flip-timeout 60set override disable set priority 200From the performance status outputs:HQ-NGFW-1 memory used is 90% (well above the configured threshold of 70%)HQ-NGFW-2 memory used is about 48.7% (well below the threshold)What happens in FortiOS 7.6 with memory-based failoverWhen memory-based failover is enabled, FortiGate monitors memory utilization. If the unit’s memory usage stays above the configured memory-failover-threshold for the configured memory-failover-monitor-period, the cluster triggers a failover away from the unit under memory pressure.Threshold = 70%HQ-NGFW-1 is at 90%, so it violates the threshold.Monitor period = 50 seconds.The administrator observed for 55 seconds, which is longer than 50 seconds, so the condition is met for long enough to trigger failover.The memory-failover-flip-timeout 60 is used to prevent rapid back-and-forth role changes (flapping) after a failover decision; it does not prevent the initial failover from occurring once the threshold breach persists for the monitor period.
Refer to the exhibit.A partial cloud topology is shown.You deployed a FortiGate Cloud-Native Firewall (CNF) in AWS.During the deployment, which components must the FortiGate CNF create to handle traffic from the EC2 instance?
In the FortiGate Cloud-Native Firewall (CNF) for AWS architecture, traffic from workloads (such as an EC2 instance) in the customer VPC is redirected to the security service (FortiGate CNF) using AWS Gateway Load Balancer (GWLB) technology.The key AWS component that must exist inside the customer VPC to steer workload traffic to the GWLB is the:Gateway Load Balancer Endpoint (GWLBe)This endpoint is what the customer VPC routes point to (for example, default route or subnet route entries), enabling transparent insertion of the FortiGate CNF inspection path for EC2 traffic.Why the other options are not correct:A: CNF does not “create the customer VPC” (that is customer-owned), and “GWLBe” is the only relevant created item here, not the whole VPC.C: Customer VPC is not created by CNF, and GWLB is typically part of the CNF service side; the question specifically asks what must be created to handle traffic from the EC2 instance (that requires GWLBe in the customer VPC).D: CNF does not create the Internet Gateway (IGW) in the customer VPC, and IGW is not the required CNF-created component for steering traffic to FortiGate CNF.
Refer to the exhibit.An administrator has configured an Application Overrides for the ABC.Com application signature and set the Action to Allow This application control profile is then applied to a firewall policy that is scanning all outbound traffic. Logging is enabled in the firewall policy. To test the configuration, the administrator accessed the ABC.Com web site several times.Why are there no logs generated under security logs for ABC.Com?
In FortiOS 7.6 Application Control, security logs are generated primarily for actions such as Block or Monitor, not for Allow actions.What is happening in the exhibitAn Application Override is configured for ABC.ComType: ApplicationAction: AllowThe application control profile is applied to a firewall policyLogging is enabled on the firewall policyTraffic to ABC.Com is successfully allowedHowever, no security logs appear for ABC.Com.Why no logs are generatedIn FortiOS 7.6:Application Control logs are written to Security Logs when:An application is BlockedAn application is MonitoredWhen an application action is set to Allow:The traffic is permitted silentlyNo application control security log is generatedEven if policy logging is enabledThis is expected and documented behavior.To generate logs for allowed applications, the action must be set to Monitor, not Allow.Why the other options are incorrectA . ABC.Com is hitting the category Excessive-BandwidthIncorrect. ABC.Com has a higher-priority explicit override (priority 1), so it is not evaluated against the Excessive-Bandwidth filter.B . The ABC.Com Type is set as Application instead of FilterIncorrect. Application-type overrides are valid and commonly used; this does not suppress logging.C . The ABC.Com must be configured as a web filter profileIncorrect. This traffic is being evaluated by Application Control, not Web Filter.
Refer to the exhibits.The system performance output and default configuration of high memory usage thresholds on a FortiGate device are shown.Based on the system performance output, what are the two possible outcomes? (Choose two.)
Answer(s): B,D
From the exhibits:System performance outputMemory used: 90%Free memory: ~5%Default memory thresholds (FortiOS 7.6)memory-use-threshold-green 82%memory-use-threshold-red 88%memory-use-threshold-extreme 89%Because memory usage (90%) exceeds the extreme threshold (89%), the FortiGate enters conserve mode.Effects of conserve mode (FortiOS 7.6 – verified)B . FortiGate has entered conserve mode.CorrectWhen memory usage exceeds the red/extreme threshold, FortiGate automatically enters conserve mode.This is exactly the condition shown in the system performance output.D . Administrators can change the configuration.CorrectEven in conserve mode:Administrators can still log in (GUI, SSH, console)Configuration changes are allowedFortiGate does not lock configuration access during conserve mode.This behavior is explicitly documented in the FortiOS 7.6 Conserve Mode section.Why the other options are incorrectA . Administrators can access FortiGate only through the console port.IncorrectNetwork access (GUI/SSH) is still available in conserve mode unless otherwise restricted.Console-only access is not a conserve-mode requirement.C . FortiGate drops new sessions.Incorrect (as a general statement)FortiGate may drop or bypass new inspection-required sessions depending on fail-open/fail-close settings.It does not universally drop all new sessions, so this statement is not always true.
Which two components are part of the secure internet access (SIA) agent-based mode on FortiSASE? (Choose two.)
Answer(s): A,C
In FortiSASE Secure Internet Access (SIA) agent-based mode, traffic steering and security enforcement rely on components integrated with the FortiClient agent.Components used in SIA agent-based modeA . FortiSASE Firewall-as-a-Service (FWaaS)Correct.FWaaS is a core security component of FortiSASE.It enforces firewall policies, security inspection, and access control for agent-based users.All user traffic tunneled by the agent is inspected by FWaaS.C . VPN policiesCorrect.In agent-based mode, the FortiClient establishes a secure tunnel to FortiSASE.VPN policies define:AuthenticationAccess controlTraffic steeringThese policies are fundamental to agent-based connectivity.Why the other options are incorrectB . Proxy auto-configuration (PAC) filePAC files are used in agentless or proxy-based modes, not agent-based SIA.D . FortiExtenderFortiExtender is a WAN extension device and is unrelated to FortiSASE SIA agent-based architecture.
Refer to the exhibits.You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.Which two factors can you observe from these configurations? (Choose two.)
Answer(s): A,B
From the exhibits:The Application Control sensor has these key settings:Application and Filter OverridesPriority 1: Excessive-Bandwidth (Type: Filter) with Action BlockPriority 2: Google (Type: Filter) with Action MonitorCategory actions shown include Social Media set to Block (this category includes Facebook).The firewall policy is using:Flow-based inspectionApplication control enabled (profile: default)Deep inspection enabled (helps identify applications inside HTTPS)Logging enabledFortiOS applies Application Control as follows (top-down within the Application Control profile):Overrides are evaluated by priority (highest priority first).The first matching override determines the action (block/monitor/allow) for that traffic.Category-based actions apply to applications that fall into those categories unless an override matches first.Why A is correctA . YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.The profile explicitly blocks the Excessive-Bandwidth behavior filter at the highest override priority.When YouTube traffic is detected as matching the Excessive-Bandwidth behavior, FortiGate will apply the Block action due to the override.Because this is a priority override, it is enforced before lower-priority entries.Why B is correctB . Facebook access is blocked based on the category filter settings.The Application Sensor shows Social Media configured with a Block action.Facebook is categorized under Social Media, so it will be blocked when matched by Application Control.Why C is not correctC . Facebook access is allowed but you cannot play Facebook videos...Since the Social Media category is set to Block, Facebook would be blocked at the category level (not merely video playback).Why D is not correctD YouTube search is allowed based on the Google override...The Google override action is Monitor, not Allow.“Monitor” logs/detects but does not override a block condition to “allow” traffic.Also, YouTube traffic is not guaranteed to be treated as “Google” in a way that would permit it, and any matching block condition (such as Excessive-Bandwidth) would still take precedence.
Post your Comments and Discuss Fortinet NSE4_FGT_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE4_FGT_AD-7.6 content, but please register or login to continue.