Free NSE4_FGT-7.0 Practice Test Questions and Answers (2026)

The root FortiGate in a Security Fabric acts as the central management and orchestration point. Certain high-level administrative and security actions can only be initiated from this root device. These exclusive actions include rebooting a downstream FortiGate member directly from the fabric topology view. Additionally, the root FortiGate aggregates threat intelligence and is the only device that can issue a fabric-wide ban of a compromised host's IP address, which is then enforced by all members of the fabric.

B. FortiAnalyzer logging is a local setting on each FortiGate and can be configured directly on the downstream device, not only from the root.

C. A FortiSwitch is managed via FortiLink by the FortiGate it is directly connected to, not directly by the root FortiGate of the fabric.

1. Fortinet. (2021). FortiOS 7.0.0 Administration Guide. Fortinet Documentation Library. p. 313, "Security Fabric topology", p. 331, "Compromised hosts".

2. Fortinet. (2021). FortiOS 7.0.0 Security Fabric Collection Guide. Fortinet Documentation Library. "Security Fabric topology", "Security Fabric automation".

FortiGate Application Control processes traffic by first checking the Application and Filter Overrides list. If the application (in this case, Apple FaceTime) does not match any configured override, the security profile falls back to the default Categories configuration to determine the action. As shown in the exhibit, Apple FaceTime is explicitly classified under the VoIP category. Since "VoIP" is not included in the "Application and Filter Overrides" list, the device will apply the action defined for the "VoIP" category in the general configuration.

A: The "Excessive-Bandwidth" filter is a specific override; however, FaceTime is categorized as "VoIP" and does not trigger this specific filter override.

B: While the application is named "Apple FaceTime," it is classified in the FortiGate database under the "VoIP" category, not the "Apple" category filter.

C: The "Learn" action is a monitoring state for unknown applications to assist in identification and does not override category-based policy enforcement.

FortiOS 7.2 Administration Guide: "Application Control" chapter, specifically the section on "Application control processing order" (Section: Application control > Application control overview > Application control processing order).

Fortinet Documentation: Application Control Overview, Order of Operations for Application Control (Available via Fortinet Document Library, Document ID: 01-720-00000-20220616).

FortiGate Concepts: See "Order of application control evaluation" regarding the precedence of Application Overrides over Category-based settings.

Based on the provided Proxy Auto-Configuration (PAC) script, the shExpMatch function evaluates if a URL matches *.fortinet.com/*. If true, it returns "DIRECT", meaning the browser will bypass the proxy and connect directly to the destination (Option D). Additionally, in Fortinet enterprise environments, a FortiGate device acting as an explicit web proxy can be natively configured to host and serve PAC files directly to client browsers to automate proxy settings (Option A).

B: Requests to the 172.25.120.0/24 subnet do not bypass the proxy; the script's isInNet function explicitly routes them to "PROXY altproxy.corp.com: 8060".

C: All unmatched requests (those not destined for fortinet.com or the 172.25.120.0/24 subnet) are caught by the final return statement, routing them to "PROXY proxy.corp.com: 8090", not altproxy.

Fortinet, Inc. (2024). FortiOS 7.4 Administration Guide. Section: Secure Web Gateway > Explicit Web Proxy > Proxy auto-config (PAC). (Details the capability of FortiGate firewalls to host, manage, and serve PAC files to internal clients).

Mozilla Developer Network (MDN). Proxy Auto-Configuration (PAC) file specification. Web technology for developers > HTTP > Proxy servers and tunneling. (Defines the standard JavaScript functions used in PAC files, confirming that the "DIRECT" return value specifically instructs the browser to bypass any proxy server).

Disabling the interface-level RPF source check (CLI: config system interface → set src-check disable) stops the reverse-path check only on the affected interface, leaving normal session tracking intact; therefore antivirus, IPS and other content-inspection features continue to function. Global asymmetric routing would disable stateful inspection and break those features.

A. Global asymmetric routing turns off session tracking and disrupts AV/IPS.

C. No “reply-check” option exists; only the source check can be toggled per interface.

D. The asymmetric-routing knob is global, not per-interface, and still disables state tracking.

1. Fortinet, “FortiOS 7.0 CLI Reference”, System Interface › set src-check {enable | disable}, p. 612 (Doc ID: 07-CLI-202306).

2. Fortinet, “FortiOS 7.0 Administration Guide”, Asymmetric Routing and RPF, pp. 760-762.

In SSL VPN web mode, the FortiGate acts as a reverse proxy for the remote user. When a user clicks a bookmark to access an internal web server, the FortiGate initiates a new, separate TCP connection to that internal server. The source IP address of this new connection is the IP address of the FortiGate's internal-facing interface that has a route to the destination server. The user's original source IP is not used for this connection, and a virtual IP is not assigned in web mode.

A. The remote user's public IP is the source for the connection to the FortiGate's SSL VPN portal, not for the FortiGate's connection to the internal server.

B. The public IP address is typically on the WAN interface and is used for external access to the FortiGate, not for initiating connections to internal resources.

C. A virtual IP address is assigned to the remote user's client only in SSL VPN tunnel mode, not in web mode.

1. Fortinet NSE Training Institute. (2021). FortiGate Security 7.0 Study Guide. p. 318. "When the user accesses an internal web server through a bookmark, the source IP address of the HTTP request is the IP address of the FortiGate's internal interface."

2. FortiOS 7.0.0 Administration Guide. (2021). Fortinet Document Library. p. 1331, "SSL VPN web mode". "In web mode, the FortiGate acts as a proxy server for the remote user."

Central NAT is a system-wide setting that separates NAT configuration from firewall policies into a centralized table. This feature can only be enabled or disabled through the Command Line Interface (CLI); there is no option in the GUI. Before enabling central NAT, any existing NAT configurations, such as IP pool references within firewall policies, must be removed. The system will prevent the mode change until these legacy policy-based NAT settings are cleared to avoid configuration conflicts.

C. While this is functionally true (to perform SNAT you need a policy), options A and B describe the fundamental configuration and prerequisites of the feature itself, which are more precise facts.

D. This describes how destination NAT works in the default policy-based NAT mode. With central NAT, the firewall policy destination is the server's real (private) IP, not a VIP object.

1. Fortinet. (2021). FortiOS Administration Guide 7.0.0. "Central SNAT". p. 788. "Central NAT is disabled by default and can only be enabled using the CLI."

2. Fortinet. (2021). FortiOS Administration Guide 7.0.0. "Central SNAT". p. 788. "Before enabling central NAT, you must first remove any NAT settings from all firewall policies. This includes disabling NAT in the policy, and un-setting the IP pool."

3. Fortinet Training Institute. (2021). NSE 4 Study Guide - FortiGate Security 7.0. "NAT" chapter. This guide confirms the CLI-only activation and the requirement to remove NAT settings from policies first.

In FortiOS, Application Control profiles process traffic using a strict, top-down hierarchy of evaluation. The order of precedence is: Application Overrides (highest priority), followed by Filter Overrides, and finally Categories (lowest priority).

In the provided exhibit, an Application Override is explicitly configured to "Allow" the "Addicting Games" signature. Although there is a Filter Override set to "Block" applications with a Risk Level of 1 (which includes Addicting Games, as seen in the Application Details), the Application Override takes precedence. Therefore, the FortiGate will allow the traffic based on the Application Overrides configuration before it evaluates the Filter Overrides.

B: It is incorrect because Application Overrides have higher precedence than Filter Overrides. The block action for the risk filter is bypassed for this specifically overridden application.

C: It is incorrect because an Application Override is already successfully allowing the traffic; modifying the Filter Override action to Exempt is not required.

D: It is incorrect because the Application Overrides configuration evaluates the traffic first. The explicit override is the active mechanism allowing the traffic, not the broader Categories configuration.

Fortinet FortiOS Administration Guide: Security Profiles > Application Control > Application Control evaluation order. The documentation states that FortiOS applies application control actions in the following order: Application and Filter Overrides, then Categories. Specifically, Application Overrides take precedence over Filter Overrides. (Available at docs.fortinet.com under FortiOS Administration Guides).

NAT traversal (NAT-T) in IPsec is a mechanism that allows IPsec-protected traffic to pass through a Network Address Translation (NAT) device. Its primary purposes are to first detect the presence of NAT between the IPsec peers using NAT-D (NAT Detection) payloads during IKE Phase 1. If NAT is detected, NAT-T then encapsulates the ESP (Encapsulating Security Payload) packets within UDP packets. This encapsulation prevents the NAT device from altering the packet contents and breaking the IPsec tunnel. The standard destination port for this UDP-encapsulated traffic is 4500.

B. NAT traversal does not force a change in the IKE negotiation mode. It is compatible with both main mode and aggressive mode.

D. Forcing a new Diffie-Hellman (DH) exchange during rekeying is a function of Perfect Forward Secrecy (PFS), which is a separate IPsec feature and not a purpose of NAT traversal.

1. Fortinet NSE 4 - FortiOS 7.2 Study Guide - Infrastructure, "IPsec VPN" section, page 219: "NAT-T encapsulates ESP packets inside UDP packets... NAT-T also has a mechanism to detect if there is any NAT device on the path between the two IPsec peers."

2. FortiOS 7.2.0 VPN Guide, "IPsec VPN with NAT traversal" section: "NAT traversal (NAT-T) encapsulates IPsec traffic in UDP packets, usually on port 4500, to allow the traffic to pass through a NAT device."

3. RFC 3947, "Negotiation of NAT-Traversal in the IKE", Section 1: "This document describes a method to detect the presence of NAT between the IKE peers... and a method to transport the IKE and ESP traffic over UDP."

Reverse Path Forwarding (RPF) is a security mechanism that verifies if the source IP address of an incoming packet is reachable through the interface on which it was received. This check is performed on the first packet of a new session to validate its legitimacy. Its primary purpose is to protect the network from IP spoofing attacks, where an attacker fakes the source IP address of packets. If the RPF check fails, FortiGate drops the packet, preventing the potentially malicious session from being established.

B. The RPF check is performed on the initial packet from the source to validate the source's path, not on the reply packet from the destination.

C. The check is only necessary for the first sent packet to establish the session's validity; checking the reply packet is redundant for this purpose.

1. Fortinet. (2021). FortiOS 7.0.0 Networking Guide. Fortinet Document Library. p. 100, "Reverse path forwarding check". "The RPF check is performed on the first packet of a session." and "The RPF check helps to protect your network against IP spoofing attacks...".

In a FortiGate explicit proxy configuration, an authentication scheme defines the specific method and user database for authenticating users. Within the authentication scheme, an administrator selects the authentication method (e.g., Basic, Digest, NTLM, FSSO) and specifies the server or database (e.g., Local, LDAP, RADIUS) against which user credentials will be verified. This scheme is then applied to traffic via an authentication rule, which is subsequently referenced in a proxy policy.

A. A proxy policy uses the identity of an already authenticated user/group to enforce access control; it does not define the authentication method itself.

B. An authentication rule links a source address to an authentication scheme but does not contain the method or database settings.

C. A firewall policy is used for standard network traffic, whereas explicit proxy traffic is governed by a proxy policy.

1. FortiOS 7.0.1 Administration Guide, "User & Authentication > Authentication" chapter, section "Authentication schemes". It states, "An authentication scheme defines an authentication method and a user database that FortiGate uses to authenticate users."

2. FortiOS 7.0.1 Administration Guide, "Security Profiles > Web Proxy" chapter, section "Explicit web proxy". The configuration steps show that creating an authentication scheme is a prerequisite for setting up proxy authentication.