NSE4_FGT_AD-7.6 Questions and Answers
Question # 1
Which three statements about SD-WAN performance SLAs are true? (Choose three.)
A.
They rely on session loss and jitter.
B.
They monitor the state of the FortiGate device.
C.
All the SLA targets can be configured.
D.
They are applied in a SD-WAN rule lowest cost strategy.
E.
They can be measured actively or passively.
Answer:
C, D, E
Explanation:
In FortiOS 7.6, SD-WAN Performance SLAs are used to measure link quality and influence SD-WAN rule decisions. The following three statements are true.
C. All the SLA targets can be configured.
True
SD-WAN Performance SLAs allow administrators to configure:
Latency
Jitter
Packet loss
Mean Opinion Score (MOS) (for voice)
Threshold values for these metrics are fully configurable per SLA.
This is explicitly documented in the SD-WAN Performance SLA configuration section.
D. They are applied in an SD-WAN rule lowest cost strategy.
True
Performance SLAs are commonly used with the Lowest Cost (SLA-based) strategy.
In this strategy:
FortiGate selects the lowest-cost link that meets the SLA requirements.
If a link violates the SLA, it is excluded from selection.
E. They can be measured actively or passively.
True
FortiOS supports:
Active probing (synthetic probes such as ping/HTTP)
Passive measurement (based on real traffic statistics)
Administrators can choose how SLAs are measured depending on the deployment and requirements.
Why the other options are incorrect
A. They rely on session loss and jitter.
Incorrect
SLAs measure packet loss, latency, and jitter.
Session loss is not an SLA metric in FortiOS.
B. They monitor the state of the FortiGate device.
Incorrect
Performance SLAs monitor link quality, not FortiGate system health or device state.
Question # 2
FortiGate is operating in NAT mode and has two physical interfaces connected to the LAN and DMZ networks respectively. Which two statements about the requirements of connected physical interfaces on FortiGate are true? (Choose two.)
A.
Both interfaces must have DHCP enabled and interfaces set to LAN and DMZ roles assigned.
B.
Both interfaces must have the interface role assigned.
C.
Both interfaces must have directly connected routes on the routing table.
D.
Both interfaces must have IP addresses assigned.
Answer:
C, D
Explanation:
In FortiOS 7.6, when a FortiGate is operating in NAT mode, physical interfaces that participate in traffic forwarding (such as LAN and DMZ) must meet certain fundamental requirements.
Correct statements
D. Both interfaces must have IP addresses assigned.
Correct
In NAT mode, FortiGate operates as a Layer-3 device.
Every interface that forwards traffic must have an IP address.
Without an IP address:
The interface cannot participate in routing
Firewall policies cannot be applied correctly
This is a mandatory requirement.
C. Both interfaces must have directly connected routes on the routing table.
Correct
When an IP address is assigned to an interface, FortiGate automatically installs a connected route for that subnet in the routing table.
These connected routes are required so FortiGate:
Knows how to reach the locally attached networks
Can forward traffic between LAN and DMZ
While administrators do not manually create these routes, their presence is required for correct operation.
Why the other options are incorrect
A. Both interfaces must have DHCP enabled and roles assigned.
Incorrect
DHCP is optional; interfaces can use static IPs.
Interface roles (LAN, DMZ, WAN) are administrative/GUI aids, not functional requirements.
B. Both interfaces must have the interface role assigned.
Incorrect
Interface roles affect GUI grouping and some default behavior.
They are not required for NAT mode operation or traffic forwarding.
Question # 3
Refer to the exhibit.
As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit What could be the possible reason of the diagnose output shown in the exhibit?
A.
There is a no firewall policy configured with an IPS security profile.
B.
Administrator entered the command diagnose test application ipsmonitor 5.
C.
FortiGate entered into IPS fail open state.
D.
Administrator entered the command diagnose test application ipsmonitor 99.
Answer:
A
Explanation:
The exhibit shows the output of the following command:
diagnose test application ipsmonitor 1
pid = 2044, engine count = 0 (+1)
0 - pid:2074:2074 cfg:1 master:0 run:1
How to interpret this output (FortiOS 7.6 – IPS internals)
ipsmonitor displays the status of IPS engines running on the FortiGate.
engine count = 0 means:
No IPS scanning engines are currently active
IPS is not processing any traffic
In FortiOS, IPS engines are started on demand.
Critical documented behavior
IPS processes are only spawned when at least one firewall policy is configured with an IPS profile and traffic matches that policy.
If no firewall policy references an IPS profile, the IPS engine:
Does not start
Shows engine count = 0
Appears “not working,†even though the IPS profile exists
This is exactly what the diagnose output indicates.
Why option A is correct
A. There is no firewall policy configured with an IPS security profile.
Creating an IPS profile alone is not sufficient
IPS must be applied to an active firewall policy
Traffic must match that policy for the IPS engine to run
Otherwise, ipsmonitor will show engine count = 0
This matches FortiOS 7.6 IPS operational behavior.
Why the other options are incorrect
B. Administrator entered the command diagnose test application ipsmonitor 5.
Incorrect.
The exhibit clearly shows ipsmonitor 1
Using a different argument would not explain engine count = 0
C. FortiGate entered into IPS fail open state.
Incorrect.
In fail-open, IPS engines may be bypassed, but they still initialize
engine count = 0 specifically indicates IPS is not in use at all
D. Administrator entered the command diagnose test application ipsmonitor 99.
Incorrect.
The command argument affects debug level, not engine creation
Again, the exhibit shows ipsmonitor 1
