Which three statements about SD-WAN performance SLAs are true? (Choose three.)
Answer(s): C,D,E
In FortiOS 7.6, SD-WAN Performance SLAs are used to measure link quality and influence SD-WAN rule decisions. The following three statements are true.C . All the SLA targets can be configured.TrueSD-WAN Performance SLAs allow administrators to configure:LatencyJitterPacket lossMean Opinion Score (MOS) (for voice)Threshold values for these metrics are fully configurable per SLA.This is explicitly documented in the SD-WAN Performance SLA configuration section.D . They are applied in an SD-WAN rule lowest cost strategy.TruePerformance SLAs are commonly used with the Lowest Cost (SLA-based) strategy.In this strategy:FortiGate selects the lowest-cost link that meets the SLA requirements.If a link violates the SLA, it is excluded from selection.E . They can be measured actively or passively.TrueFortiOS supports:Active probing (synthetic probes such as ping/HTTP)Passive measurement (based on real traffic statistics)Administrators can choose how SLAs are measured depending on the deployment and requirements.Why the other options are incorrectA . They rely on session loss and jitter.IncorrectSLAs measure packet loss, latency, and jitter.Session loss is not an SLA metric in FortiOS.B . They monitor the state of the FortiGate device.IncorrectPerformance SLAs monitor link quality, not FortiGate system health or device state.
Refer to the exhibit.The NOC team connects to the FortiGate GUI with the NOC_Access admin profile. They request that their GUI sessions do not disconnect too early during inactivity. What must the administrator configure to answer this specific request from the NOC team?
Answer(s): B
In FortiOS 7.6, GUI session inactivity timeout behavior for administrators is controlled by admin profiles, not by general access permissions or profile ordering.How GUI idle timeout works in FortiOS 7.6FortiGate has a global admin timeout (admintimeout), butAdmin profiles can override this value using the Override idle timeout setting.When Override idle timeout is enabled in an admin profile, the timeout value defined inside that profile takes precedence over the global setting.The exhibit shows that the NOC team logs in using the NOC_Access admin profile. Therefore, to prevent their GUI sessions from disconnecting too quickly during inactivity, the timeout must be adjusted within that specific admin profile.Why option B is correctB . Increase the value of the Override Idle Timeout parameter in the NOC_Access admin profile.This directly controls how long GUI sessions remain active when users assigned to NOC_Access are idle.It affects only the NOC team, which matches the requirement precisely.This is the recommended and documented approach in FortiOS 7.6.Why the other options are incorrectA . Increase admintimeout under config system accprofileIncorrect. admintimeout is a global admin setting, not configured under accprofile, and it would affect all administrators, not just NOC users.C . Move NOC_Access to the top of the listIncorrect. Admin profile order has no impact on session timeout behavior.D . Assign super_admin roleIncorrect and insecure. Super_admin does not control idle timeout and would unnecessarily grant full privileges.
The FortiGate device HQ-NGFW-1 with the IP address 10.0.13.254 sends logs to the FortiAnalyzer device with the IP address 10.0.13.125. The administrator wants to verify that reliable logging is enabled on HQ-NGFW-1.Which exhibit helps with the verification?A)B)C)D)
Refer to the exhibit.The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit For which two reasons are these web categories exempted? (Choose two.)
Answer(s): B,D
“You may need to exempt traffic from SSL inspection if it is causing problems with traffic, or for legal reasons.”“Performing SSL inspection on a site that is enabled with HTTP Strict Transport Security (HSTS), for example, can cause problems with traffic. Remember, the only way for FortiGate to inspect encrypted traffic is to intercept the certificate coming from the server and generate a temporary one. After FortiGate presents the temporary SSL certificate, browsers that use HSTS refuse to proceed.”“Laws protecting privacy might be another reason to bypass SSL inspection. For example, in some countries, it is illegal to inspect SSL bank-related traffic. Configuring an exemption for sites is simpler than setting up firewall policies for each individual bank. You can exempt sites based on their web category, such as Finance and Banking...”“The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories—Finance and Banking, and Health and Wellness—and some FQDN addresses...”Technical Deep Dive: The correct answers are B and D.B is correct because the study guide explicitly says SSL inspection may be bypassed for legal reasons, especially where privacy laws restrict inspection of sensitive categories such as Finance and Banking. The same privacy rationale also explains why Health and Wellness is commonly exempted.D is correct because some sites break under deep inspection due to HSTS. FortiGate must generate and present a temporary certificate during full SSL inspection, and browsers enforcing HSTS can reject that interception flow. That is why some sites are exempted from deep inspection.Why the others are wrong:A is not stated in the guide.C refers to the separate Reputable websites option, which is a FortiGuard-maintained allowlist feature, not the reason the predefined categories shown in the exhibit are excluded.From an operational standpoint, this is a classic balance between security visibility and application/legal compatibility. Deep inspection gives FortiGate payload visibility, but it can interfere with pinned-certificate/HSTS behavior and can violate privacy policy for regulated content.
Refer to the exhibit.Why is the Antivirus scan switch grayed out when you are creating a new antivirus profile for FTP?
In FortiOS 7.6, the Antivirus scan master switch in an antivirus profile becomes available only after at least one supported protocol is enabled for inspection.What the exhibit showsA new antivirus profile named FTP_AV_ProfileFeature set: Flow-basedAntivirus scan switch is grayed outAll Inspected Protocols (HTTP, SMTP, POP3, IMAP, FTP, CIFS) are currently disabledWhy the Antivirus scan switch is grayed outIn FortiOS antivirus profiles:The Antivirus scan toggle is a dependent controlIt cannot be enabled unless at least one inspected protocol is selectedThis prevents enabling AV scanning when there is no traffic type to scanThis behavior is documented in the FortiOS 7.6 Antivirus Profile configuration section.Once you enable a protocol (for example, FTP), the Antivirus scan switch becomes active and configurable.Why option B is correctB . None of the inspected protocols are active in this profile.All protocol toggles are OFFTherefore, FortiGate disables (grays out) the Antivirus scan optionThis is expected and correct behaviorWhy the other options are incorrectA . Antivirus scan is disabled under Feature visibilityIncorrect. Feature Visibility controls whether Antivirus appears in the GUI, not whether the scan switch is enabled inside a profile.C . Feature set must be Proxy-basedIncorrect. Antivirus scanning is supported in both flow-based and proxy-based modes.D . Less than 2 GB RAM does not support Antivirus scanIncorrect. Memory size affects performance and offloading, not basic AV scan availability.
FortiGate is integrated with FortiAnalyzer and FortiManager.When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?
Answer(s): A
In FortiOS 7.6, when FortiGate is integrated with FortiAnalyzer and FortiManager, firewall policies rely on a Universally Unique Identifier (UUID) to ensure proper policy tracking, synchronization, and log correlation across devices.Why the UUID is requiredEvery firewall policy in FortiOS has a UUID.FortiManager uses the UUID to:Track policies across managed FortiGate devicesMaintain policy consistency during installs and revisionsFortiAnalyzer uses the UUID to:Correlate logs accurately to the correct firewall policyPreserve log association even if policy order or policy ID changesWithout a UUID:Policy-to-log mapping can breakFortiManager cannot reliably manage or synchronize policiesFortiAnalyzer log analysis becomes inconsistentThis is explicitly documented in Fortinet administration and logging architecture references.Why the other options are incorrectB . Policy IDPolicy ID can change when policies are moved and is not reliable for long-term correlation across FortiManager and FortiAnalyzer.C . Sequence IDSequence ID reflects GUI ordering only and has no role in log correlation.D . Log IDLog ID is generated per log event, not per firewall policy.
How does FortiExtender connect to FortiSASE in a site-based, remote internet access method?
In FortiSASE site-based (remote internet access) deployments, FortiExtender is used to onboard branch or remote sites without a local FortiGate.According to FortiSASE and FortiExtender architecture documentation:FortiExtender integrates with FortiSASE using a secure VXLAN-over-IPsec tunnelThis tunnel:Extends the site network to FortiSASETransparently forwards traffic for inspectionPreserves network segmentation and routing contextThis design is similar to cloud-based LAN extension and is not proxy-basedWhy the other options are incorrectB: FortiClient is used for agent-based user access, not FortiExtenderC: Secure Web Gateway (SWG) is a service, not a transport mechanismD: PAC files and explicit proxies are used in agentless / proxy-based access, not site-based FortiExtender deployments
What are two features of collector agent advanced mode? (Choose two.)
"Also, advanced mode supports nested or inherited groups; that is, users can be members of subgroups that belong to monitored parent groups." "In advanced mode, you can configure FortiGate as an LDAP client and configure the group filters on FortiGate. You can also configure group filters on the collector agent."Collector Agent Advanced Mode provides deeper integration between FortiGate, LDAP, and Active Directory, compared to standard mode.Key features of Collector Agent Advanced ModeB . FortiGate can be configured as an LDAP client and group filters can be configured on FortiGate.CorrectIn advanced mode:FortiGate directly queries LDAP/ADUser group filters are configured on FortiGate, not only on the Collector AgentThis allows more flexible and scalable user/group-based policiesD . Advanced mode supports nested or inherited groups.CorrectAdvanced mode supports:Nested AD groupsInherited group membershipsThis is one of the primary reasons advanced mode is used in complex AD environmentsWhy the other options are incorrectA . Security profiles only to user groupsIncorrect.Security profiles can be applied to users or groups, depending on policy configuration.C . Uses NetBIOS Domain\Username formatIncorrect.NetBIOS naming is associated with standard modeAdvanced mode typically uses LDAP DN-based identification
Post your Comments and Discuss Fortinet NSE4_FGT_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE4_FGT_AD-7.6 content, but please register or login to continue.