Practice Exam: NSE 4 - FortiOS 7.6 Administrator (ex-FCP FortiGate 7.6 Administrator)

Question bank: 100 · timed mock exam: 100 min

Official exam page on the vendor's site (opens in a new tab) Official prep course (opens in a new tab)

Compare: 156-215.82 vs Fortinet NSE 4 – FortiOS 7.6 Administrator

  • Content inspection 32 questions
  • Firewall policies and authentication 24 questions
  • Deployment and system configuration 22 questions
  • VPNs 14 questions
  • Routing 8 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for NSE 4 - FortiOS 7.6 Administrator (ex-FCP FortiGate 7.6 Administrator) with InfraPrep

The 100 questions cover 5 domains: Content inspection, Firewall policies and authentication, Deployment and system configuration, VPNs, Routing. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 100 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Deployment and system configuration

A branch FortiGate was reset to factory defaults before being shipped back to a remote site. The on-site technician connects to the GUI and signs in with the default admin account. What should the technician expect at this first login?

  1. The previous admin password is restored from the last configuration backup
  2. The login is refused until a password is first set from the console port
  3. The admin account signs in with the serial number printed on the unit label
  4. The technician is prompted to configure a password for the admin account
Show the answer and the explanation

Correct answer: D

The default admin account has no password, and adding one is mandatory. FortiOS prompts for it at the first login with that account, after a factory reset, and after a new image installation.

Source: official documentation

Question 2 Firewall policies and authentication

Hosts on the LAN already reach an application server in the DMZ through an accept policy from LAN to DMZ. The application server must now also open its own connections to a monitoring agent on a LAN host. What must the administrator add?

  1. A second policy from DMZ to LAN, because each initiating direction needs a policy
  2. A NAT setting on the existing policy so that the DMZ server can reach the LAN
  3. A reverse-path check on the existing policy so that it accepts both directions
  4. Nothing, because reply traffic of the existing policy already covers new sessions
Show the answer and the explanation

Correct answer: A

When sessions can be initiated from both directions, each direction requires its own policy. What matters is which side initiates the communication.

Source: official documentation

Question 3 Content inspection

After enabling deep inspection, the administrator deploys the Fortinet_CA_SSL certificate to all browsers. Most HTTPS sites now load without warnings, but a few still trigger untrusted certificate warnings. A helpdesk technician suggests also importing Fortinet_CA_Untrusted into the browsers. What is the correct assessment?

  1. The warnings mean deep inspection failed and the traffic was sent without inspection
  2. The warnings show that Fortinet_CA_SSL was imported into the wrong certificate store
  3. The warnings come from Fortinet_CA_Untrusted, which must never be imported into browsers
  4. Importing Fortinet_CA_Untrusted is the documented step to stop the remaining warnings
Show the answer and the explanation

Correct answer: C

If warnings about untrusted certificates remain after Fortinet_CA_SSL is imported, they are due to Fortinet_CA_Untrusted, and the documentation states that this certificate must never be imported into the browser.

Source: official documentation

Question 4 Routing

An administrator configures a static default route through wan1 with the default distance of 10. Later, wan2 is connected to a cable modem with its interface in DHCP mode and "retrieve default gateway from server" left enabled. Internet traffic now leaves through wan2. Why?

  1. Routes learned over DHCP win because they are more specific than static routes
  2. The static route was disabled automatically when a second default gateway appeared
  3. The DHCP default route is added with a distance of 5, which beats the distance of 10
  4. The FortiGate balances the default routes with ECMP, regardless of their distance
Show the answer and the explanation

Correct answer: C

A default route learned through DHCP is added to the routing table with a distance of 5 by default, which takes precedence over a default static route with a distance of 10.

Source: official documentation

Question 5 VPNs

The headquarters FortiGate and a branch FortiGate each have two internet-facing interfaces. The administrator builds a fully redundant route-based VPN between them manually, covering every combination of local and remote interface. How many distinct end-to-end paths does this design provide?

  1. Four, one for each local and remote interface combination
  2. Three, two active paths plus one standby path
  3. Two, one for each pair of primary and secondary interfaces
  4. Eight, because each path needs one tunnel per direction
Show the answer and the explanation

Correct answer: A

A FortiGate with two internet interfaces can support redundant VPNs to the same remote peer, and four distinct paths are possible for VPN traffic from end to end.

Source: official documentation

Question 6 Deployment and system configuration

An administrator reviews the traffic logs on a newly deployed FortiGate. Forward traffic is logged, but no log entries appear for traffic destined to the FortiGate itself. Why are these entries missing on a default configuration?

  1. Local traffic logging is disabled by default because of the high log volume
  2. Local traffic can be logged on FortiAnalyzer but not on the local disk
  3. Local traffic is recorded once a web filter profile is applied
  4. Local traffic is written to memory and is cleared at each reboot
Show the answer and the explanation

Correct answer: A

Local traffic logging is disabled by default due to the high volume of logs generated. It can be enabled globally or per local-in policy.

Source: official documentation

Question 7 Firewall policies and authentication

A junior administrator creates a new firewall policy and leaves the inspection mode unchanged. Which inspection mode does the policy use, and what does Fortinet recommend?

  1. Flow-based, which is the default, but proxy-based is recommended for web traffic
  2. Flow-based, which is the default and is recommended unless proxy-only features are needed
  3. Proxy-based, which is the default, while flow-based is recommended for small models
  4. Proxy-based, which is the default and is recommended for security profiles in general
Show the answer and the explanation

Correct answer: B

Flow-based inspection is selected by default on new firewall policies, and it is the recommended inspection mode unless proxy-specific features are required.

Source: official documentation

Question 8 Content inspection

A proxy-based policy uses the built-in certificate-inspection profile. A partner web portal runs HTTPS on TCP 8443, and the web filter does not act on it as expected. The administrator tries to add port 8443 to the built-in profile but cannot save the change. What should the administrator do?

  1. Clone the profile or create a new one, add 8443 to HTTPS, and apply it to the policy
  2. Enable HTTPS on port 8443 in the web filter profile instead of the SSL profile
  3. Unlock the built-in profile from the CLI with the override setting, then add 8443
  4. Switch the policy to the deep-inspection profile, which inspects non-standard ports by default
Show the answer and the explanation

Correct answer: A

The built-in certificate-inspection profile is read-only and only listens on port 443. To make changes, a new certificate inspection profile must be created (or the default cloned) and the non-standard port added to the HTTPS field.

Source: official documentation

Question 9 Routing

A branch has two SD-WAN members: wan1 is a fixed-price fiber link, and wan2 is a costly link billed by volume. With no explicit SD-WAN rules, management wants traffic to use wan1 until it reaches a set bandwidth threshold and only then overflow to wan2. Which load balancing algorithm of the implicit rule should the administrator select?

  1. Sessions (weight-based), with a weight of 100 for wan1 and 0 for wan2
  2. Volume (measured-volume-based), with a volume ratio favoring wan1 over wan2
  3. Source IP (source-ip-based), because it is the default and keeps each host on one link
  4. Spillover (usage-based), with ingress and egress thresholds set on wan1
Show the answer and the explanation

Correct answer: D

With spillover, an interface is used until its traffic bandwidth exceeds the ingress and egress thresholds set for it; additional traffic is then sent through the next SD-WAN member.

Source: official documentation

Question 10 VPNs

A FortiGate has a route-based tunnel named main_vpn on port1 toward a peer with a static IP address. The administrator adds a tunnel named backup_vpn on port2 to the same peer, and it must come up only while main_vpn is out of service. How should backup_vpn be configured in the CLI?

  1. Set the same distance on both static routes so that ECMP moves traffic to backup_vpn
  2. Set monitor to main_vpn on backup_vpn, with dead peer detection enabled on both tunnels
  3. Disable dead peer detection on main_vpn so that backup_vpn detects the failure faster
  4. Set the backup_vpn interface type to dialup so that it waits for main_vpn to go down
Show the answer and the explanation

Correct answer: B

The monitor option creates a backup VPN for the specified phase 1 configuration. This backup feature works on interfaces with static addresses that have dead peer detection enabled.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.