Mar-2026 Get Totally Free Updates on NSE4_FGT_AD-7.6 Dumps PDF Questions
Prepare With Top Rated High-quality NSE4_FGT_AD-7.6 Dumps For Success in NSE4_FGT_AD-7.6 Exam
NEW QUESTION # 35
Refer to the exhibit.
A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 status is up, but phase 2 fails to come up.
Based on the phase 2 configuration shown in the exhibit, which two configuration changes will bring phase 2 up? (Choose two.)
- A. On HQ-NGFW. enable Diffie-Hellman Group 2.
- B. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.
- C. On HQ-NGFW. set Encryption to AES256.
- D. On BR1-FGT. set Seconds to 43200
Answer: B,C
Explanation:
Phase 1 being up confirms the two FortiGate devices can authenticate and build the IKE SA. Phase 2 failing indicates the IPsec (Quick Mode) SA negotiation is failing due to mismatched Phase 2 parameters.
From the exhibit, the Phase 2 mismatches that would prevent SA establishment are:
1) Phase 2 selectors must mirror each other (Proxy IDs)
HQ-NGFW Phase 2 selector shows:
Local: 10.0.11.0/24
Remote: 172.20.1.0/24
BR1-FGT Phase 2 selector shows:
Local: 172.20.1.0/24
Remote: 10.11.0.0/24 # does not match HQ's local subnet (10.0.11.0/24)
In FortiOS, Phase 2 comes up only when the peers' selectors (proxy IDs) match as opposite pairs (local on one side = remote on the other).
# Fix: A. On BR1-FGT, set Remote Address to 10.0.11.0/255.255.255.0.
2) Phase 2 proposal must match (encryption/authentication)
HQ-NGFW shows encryption AES128 (with SHA1)
BR1-FGT shows encryption AES256 (with SHA1)
For Phase 2 to establish, both peers must have at least one common proposal (same encryption and authentication settings). With one side set to AES128 and the other to AES256, there is no match.
# Fix: D. On HQ-NGFW, set Encryption to AES256.
Why the other options are not correct
B). Enable Diffie-Hellman Group 2: The exhibit's mismatch is not resolved by adding DH group 2, and DH group must match when PFS is enabled. This option does not align the peers based on what's shown.
C). Set Seconds to 43200: Phase 2 lifetime mismatches typically do not prevent Phase 2 from coming up (the negotiated lifetime can be adjusted by the peers). The hard blockers here are the selectors and proposal mismatch.
NEW QUESTION # 36
Refer to the exhibit.
The predefined deep-inspection and custom-deep-inspection profiles exclude some web categories from SSL inspection, as shown in the exhibit For which two reasons are these web categories exempted? (Choose two.)
- A. The resources utilization is optimized because these websites are in the trusted domain list on FortiGate.
- B. The FortiGate temporary certificate denies the browser's access to websites that use HTTP Strict Transport Security.
- C. These websites are in an allowlist of reputable domain names maintained by FortiGuard.
- D. The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
Answer: C,D
Explanation:
In FortiOS 7.6, the predefined deep-inspection and custom-deep-inspection SSL inspection profiles intentionally exclude certain web categories (such as Finance and Banking and Health and Wellness) and well-known domains (for example, Apple, Google, Adobe). This behavior is documented and intentional.
The two correct reasons are:
B . The legal regulation aims to prioritize user privacy and protect sensitive information for these websites.
Correct
Categories like Finance and Banking and Health and Wellness commonly handle highly sensitive personal data.
Many privacy and compliance regulations (for example, GDPR, PCI-DSS, HIPAA-like requirements) discourage or restrict SSL interception for such traffic.
To reduce legal and compliance risks, FortiOS exempts these categories from deep SSL inspection by default.
This is explicitly stated in FortiOS SSL/SSH Inspection documentation.
C . These websites are in an allowlist of reputable domain names maintained by FortiGuard.
Correct
FortiGuard maintains a reputable/trusted domain list for well-known services and platforms.
These domains are excluded from deep inspection by default to:
Prevent application breakage
Avoid certificate pinning and compatibility issues
Maintain user experience
This is why domains such as Apple, Google, Adobe, and app stores appear under SSL inspection exemptions.
Why the other options are incorrect
A . Resource utilization optimization
Incorrect.
While reduced inspection can save resources, this is not the primary documented reason for exempting these categories.
D . FortiGate temporary certificate denies access to HSTS websites
Incorrect.
Although HSTS and certificate pinning can cause issues with SSL inspection, this option describes a side effect, not the reason for exemption.
The exemption exists to avoid such problems, not because the certificate denies access.
NEW QUESTION # 37
Refer to the exhibit, which contains a RADIUS server configuration.
An administrator added a configuration for a new RADIUS server. While configuring, the administrator enabled Include in every user group.
What is the impact of enabling Include in every user group in a RADIUS configuration?
- A. This option places the RADIUS server, and all users who can authenticate against that server, into every FortiGate user group.
- B. This option places the RADIUS server, and all users who can authenticate against that server, into every RADIUS group.
- C. This option places all FortiGate users and groups required to authenticate into the RADIUS server, which, in this case, is FortiAuthenticator.
- D. This option places all users into every RADIUS user group, including groups that are used for the LDAP server on FortiGate.
Answer: A
Explanation:
The Include in every User Group optionadds the RADIUS server and all userswho can authenticate against it, to every user group created on FortiGate.
NEW QUESTION # 38
You have configured the below commands on a FortiGate.
What would be the impact of this configuration on FortiGate?
- A. FortiGate will enable strict RPF on ail its interfaces and port1 will be enable for asymmetric routing.
- B. FortiGate will enable strict RPF on all its interfaces and port1 will be exempted from RPF checks.
- C. The global configuration will take precedence and FortiGate will enable strict RPF on all interfaces.
- D. Port1 will be enabled with flexible RPF, and all other interfaces will be enabled for strict RPF
Answer: B
Explanation:
The global setting enables strict source checking (RPF) on all interfaces by default. The per- interface setting disables the source check on port1, exempting it from strict RPF enforcement.
NEW QUESTION # 39
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
You cannot access any of the Google applications, but you are able to access www.fortinet.com.
Which two actions would you take to resolve the issue? (Choose two.)
- A. Add *Google*.com to the URL category in the security profile.
- B. Set the action for Google in the Application and Filter Overrides section to Allow.
- C. Change the Inspection mode to Flow-based.
- D. Move up Google in the Application and Filter Overrides section to set its priority to 1.
- E. Set SSL inspection to deep-content inspection.
Answer: D,E
Explanation:
Move up Google in the Application and Filter Overrides section to set its priority to 1.
The "Excessive-Bandwidth" filter has a higher priority (1) and is configured to Block. Because Google applications generate significant bandwidth, they match this rule first and get blocked.
Moving the "Google" filter to priority 1 ensures that the monitor action for Google is applied before the block rule.
Set SSL inspection to deep-content inspection.
Google applications use HTTPS encryption, so the FortiGate cannot identify or control them unless SSL traffic is decrypted. Changing from certificate-inspection (which only inspects certificates) to deep-inspection allows FortiGate to fully analyze encrypted application traffic and properly apply the Application Control rules.
NEW QUESTION # 40
Refer to the exhibit.
As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit What could be the possible reason of the diagnose output shown in the exhibit?
- A. Administrator entered the command diagnose test application ipsmonitor 99.
- B. Administrator entered the command diagnose test application ipsmonitor 5.
- C. FortiGate entered into IPS fail open state.
- D. There is a no firewall policy configured with an IPS security profile.
Answer: D
Explanation:
The exhibit shows the output of the following command:
diagnose test application ipsmonitor 1
pid = 2044, engine count = 0 (+1)
0 - pid:2074:2074 cfg:1 master:0 run:1
How to interpret this output (FortiOS 7.6 - IPS internals)
ipsmonitor displays the status of IPS engines running on the FortiGate.
engine count = 0 means:
No IPS scanning engines are currently active
IPS is not processing any traffic
In FortiOS, IPS engines are started on demand.
Critical documented behavior
IPS processes are only spawned when at least one firewall policy is configured with an IPS profile and traffic matches that policy.
If no firewall policy references an IPS profile, the IPS engine:
Does not start
Shows engine count = 0
Appears "not working," even though the IPS profile exists
This is exactly what the diagnose output indicates.
Why option A is correct
A). There is no firewall policy configured with an IPS security profile.
Creating an IPS profile alone is not sufficient
IPS must be applied to an active firewall policy
Traffic must match that policy for the IPS engine to run
Otherwise, ipsmonitor will show engine count = 0
This matches FortiOS 7.6 IPS operational behavior.
Why the other options are incorrect
B). Administrator entered the command diagnose test application ipsmonitor 5.
Incorrect.
The exhibit clearly shows ipsmonitor 1
Using a different argument would not explain engine count = 0
C). FortiGate entered into IPS fail open state.
Incorrect.
In fail-open, IPS engines may be bypassed, but they still initialize
engine count = 0 specifically indicates IPS is not in use at all
D). Administrator entered the command diagnose test application ipsmonitor 99.
Incorrect.
The command argument affects debug level, not engine creation
Again, the exhibit shows ipsmonitor 1
NEW QUESTION # 41
Refer to the exhibit. As an administrator you have created an IPS profile, but it is not performing as expected. While testing you got the output as shown in the exhibit.
What could be the possible reason of the diagnose output shown in the exhibit?
- A. Administrator entered the command diagnose test application ipsmonitor 99.
- B. Administrator entered the command diagnose test application ipsmonitor 5.
- C. FortiGate entered into IPS fail open state.
- D. There is a no firewall policy configured with an IPS security profile.
Answer: D
Explanation:
The output shows the IPS engine count as 0, indicating no active IPS engines are running. This typically means no firewall policy is referencing the IPS security profile, so the IPS profile is not being applied or triggered.
NEW QUESTION # 42
An administrator wants to form an HA cluster using the FGCP protocol.
Which two requirements must the administrator ensure both members fulfill? (Choose two.)
- A. They must have the heartbeat interfaces in the same subnet.
- B. They must have the same HA group ID.
- C. They must have the same hard drive configuration.
- D. They must have the same number of configured VDOMs.
Answer: B,D
Explanation:
They must have the same HA group ID → Both FortiGate units must use the same HA group ID to join the same FGCP cluster.
They must have the same number of configured VDOMs → VDOM configurations must match across cluster members to ensure configuration and state synchronization.
NEW QUESTION # 43
Which three strategies are valid SD-WAN rule strategies for member selection? (Choose three answers)
- A. Best Quality with load balancing
- B. Lowest Cost (SLA) without load balancing
- C. Manual with load balancing
- D. Lowest Cost (SLA) with load balancing
- E. Lowest Quality (SLA) with load balancing
Answer: B,C,D
Explanation:
According to the FortiOS 7.6 Administrator Study Guide and official documentation, SD-WAN rules (services) determine the path selection for traffic matching specific criteria. Version 7.6 provides specific flexibility regarding how these strategies handle multiple member interfaces.
First, Manual with load balancing (Statement B) is a valid configuration. In the Manual strategy, the administrator orders interfaces by preference, but by enabling the Load balancing toggle, the FortiGate can distribute traffic across all members that are up.
Second, the Lowest Cost (SLA) strategy has been enhanced to support two modes. When the load balancing option is disabled, it acts as Lowest Cost (SLA) without load balancing (Statement A), selecting the single lowest-cost link that meets the SLA. Alternatively, by enabling the toggle, it functions as Lowest Cost (SLA) with load balancing (Statement D), where the FortiGate distributes traffic across all interfaces that satisfy the SLA target, regardless of their individual costs.
Statements C and E are incorrect because "Lowest Quality" is not a recognized SD-WAN strategy, and the Best Quality strategy is specifically a priority-based selection for a single "best" link, meaning the load balancing toggle is not available in the GUI when this mode is selected.
NEW QUESTION # 44
You have created a web filter profile named restrictmedia-profile with a daily category usage quota.
When you are adding the profile to the firewall policy, the restrict_media-profile is not listed in the available web profile drop down.
What could be the reason?
- A. The firewall policy is in no-inspection mode instead of deep-inspection.
- B. The inspection mode in the firewall policy is not matching with web filter profile feature set.
- C. The naming convention used in the web filter profile is restricting it in the firewall policy.
- D. The web filter profile is already referenced in another firewall policy.
Answer: B
Explanation:
In FortiOS 7.6, web filter profiles are inspection-mode dependent. Certain advanced web filtering features-such as daily category usage quota-are only supported when the firewall policy is operating in proxy-based inspection mode.
Why the profile is not visible
The profile restrictmedia-profile includes a daily category usage quota.
Daily quotas are a proxy-based web filtering feature.
If the firewall policy is configured with:
Inspection mode: Flow-based
Then FortiGate will not display proxy-only web filter profiles in the Web Filter drop-down list.
FortiGate automatically filters the available profiles based on feature compatibility with the policy's inspection mode.
This behavior is explicitly documented in the FortiOS 7.6 Web Filtering and Inspection Mode Compatibility sections.
Why the other options are incorrect
A . Already referenced in another firewall policy
Web filter profiles can be reused across multiple policies. This does not hide them.
B . Firewall policy is in no-inspection mode instead of deep-inspection SSL inspection depth affects HTTPS visibility, not whether a web filter profile appears in the drop-down list.
C). Naming convention restriction
FortiOS does not restrict profile selection based on naming conventions.
NEW QUESTION # 45
Refer to the exhibits.
An administrator wants to add HQ-ISFW-2 in the Security Fabric. HQ-ISFW-2 is in the same subnet as HQ- ISFW. After configuring the Security Fabric settings on HQ-ISFW-2, the status stays Pending. What can be the two possible reasons? (Choose two answers)
- A. Upstream FortiGate IP must be set to 10.0.11.254.
- B. SAML Single Sign-On must be set to Manual.
- C. Management IP must be set to 10.0.13.254.
- D. HQ-ISFW-2 must be authorized on HQ-ISFW.
Answer: A,D
Explanation:
According to the FortiOS 7.6 Security Fabric documentation and Study Guide, several conditions must be met for a downstream FortiGate to successfully join a Security Fabric.
First, the Upstream FortiGate IP/FQDN configured on the downstream device must point to the IP address of the interface on the upstream device that is listening for fabric connections. In the provided logical topology, the Fabric Root (HQ-NGFW-1) uses port4 with the IP 10.0.11.254 to connect to the internal segmentation firewalls (ISFWs). Since HQ-ISFW-2 is in the same subnet as HQ-ISFW, it is physically and logically connected to the network segment serviced by port4. Therefore, the current configuration of
10.0.13.254 (which is port6, likely the WAN side) is incorrect, and it must be set to 10.0.11.254 (Statement A).
Second, once the downstream device successfully reaches the upstream device, it enters a Pending state. For security purposes, FortiOS does not allow devices to join the fabric automatically; the administrator of the upstream device (in this case, HQ-ISFW or the root) must manually authorize the new device (Statement C) in the Fabric Management console. Until this authorization is granted, the status will remain "Pending" and no fabric data will be synchronized. Statements B and D are incorrect as SAML settings do not block the initial fabric join, and the management IP should be the local device's IP, not the upstream's IP.
NEW QUESTION # 46
You have configured an application control profile, set peer-to-peer traffic to Block under the Categories tab, and applied it to the firewall policy. However, your peer-to-peer traffic on known ports is passing through the FortiGate without being blocked. What FortiGate settings should you check to resolve this issue?
- A. Replacement Messages for UDP-based Applications
- B. Network Protocol Enforcement
- C. FortiGuard category ratings
- D. Application and Filter Overrides
Answer: B
Explanation:
Network Protocol Enforcement settings control how FortiGate inspects and enforces protocols on traffic, including peer-to-peer applications on known ports. If not properly enabled, peer-to-peer traffic may bypass blocking despite the application control profile.
NEW QUESTION # 47
Refer to the exhibit.
Which two statements about the FortiGuard connection are true? (Choose two.)
- A. The weight increases as the number of failed packets rises
- B. You can configure unreliable protocols to communicate with FortiGuard Server.
- C. FortiGate is using the default port for FortiGuard communication.
- D. FortiGate identified the FortiGuard Server using DNS lookup.
Answer: A,C
Explanation:
Based on the diagnose debug rating output provided in the exhibit and the standard behavior of the FortiGuard connection mechanism in FortiOS 7.6:
Weight Calculation (Statement A is True):
In FortiOS, the rating server selection process uses a weight-based system.
According to official documentation, the weight increases with failed packets (lost responses) and decreases with successful packets.
This mechanism ensures that servers with poor reliability are penalized by having higher weights, effectively pushing them to the bottom of the preference list.
Default Port Communication (Statement D is True):
The exhibit explicitly shows the communication is using HTTPS on port 8888.
In FortiOS 7.6 (and legacy versions like 6.2/6.4), FortiGuard filtering supports specific protocols and ports:
HTTPS on ports 443, 53, and 8888, where 8888 is considered a default port for FortiGuard queries.
Ports 53 and 8888 are standard for both UDP and TCP/HTTPS FortiGuard communications to avoid common firewall blocks on standard web ports.
Why other options are incorrect:
Statement B (Unreliable protocols): While you can configure UDP (which is unreliable), the exhibit specifically shows HTTPS is being used, which is a reliable (TCP-based) protocol.
Statement C (DNS lookup): In the "Flags" column of the server list, a server found via DNS lookup would be marked with the "D" flag. The exhibit shows the flag as "I" (indicating the last INIT request was sent to this server) and a numeric "2," but the "D" flag is absent. Additionally, the IP 10.0.1.241 is a private address, suggesting it is a manually configured FortiManager or local override server rather than a public server found via global DNS lookup.
NEW QUESTION # 48
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo acceleration enhance antivirus performance?
- A. For proxy-based inspection, NTurbo offloads traffic to the content processor.
- B. For proxy-based inspection, NTurbo buffers the whole file and then sends it to the antivirus engine.
- C. For flow-based inspection, NTurbo establishes a dedicated data path to redirect traffic between the IPS engine and FortiGate ingress and egress interfaces.
- D. For flow-based inspection, NTurbo creates two inspection sessions on the FortiGate device.
Answer: C
Explanation:
NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface.
NEW QUESTION # 49
An administrator wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
- A. Enabled
- B. Usabled
- C. On Demand
- D. On Idle
Answer: C
NEW QUESTION # 50
Refer to the exhibits. The exhibits show a diagram of a FortiGate device connected to the network, as well as the IP pool configuration and firewall policy objects.
The WAN (port1) interface has the IP address 10.200.1.1/24. The LAN (port3) interface has the IPaddress 10.0.1.254/24.
Which IP address will be used to source NAT (SNAT) the traffic, if the user on Local-Client (10.0.1.10) pings the IP address of Remote-FortiGate (10.200.3.1)?
- A. 10.200.1.1
- B. 10.200.1.99
- C. 10.200.1.49
- D. 10.200.1.149
Answer: B
Explanation:
All_TCP doesn't include ICMP. So you would match rule ID 2, in which uses IP Poop remote 1.
NEW QUESTION # 51
Refer to the exhibits, which show the system performance output and the default configuration of high memory usage thresholds in a FortiGate.
Based on the system performance output, what can be the two possible outcomes? (Choose two.)
- A. Administrators cannot change the configuration.
- B. FortiGate will start sending all files to FortiSandbox for inspection.
- C. Administrators can access FortiGate only through the console port.
- D. FortiGate has entered conserve mode.
Answer: A,D
Explanation:
FortiGate has entered conserve mode.
The system performance output shows memory usage at 90%, which exceeds the red threshold (88%) configured under memory-use-threshold-red. When this happens, FortiGate automatically enters conserve mode to preserve system stability by stopping or limiting memory-intensive processes.
Administrators cannot change the configuration.
In conserve mode, FortiGate restricts configuration changes and disables some non-essential services until memory usage drops below the green threshold (82%), ensuring that available memory is reserved for critical operations.
NEW QUESTION # 52
Refer to the exhibits. An administrator configured the Web Filter Profile to block access to all social networking sites except Facebook. However, when users try to access Facebook.com, they are redirected to a FortiGuard web filtering block page.
Based on the exhibits, which configuration change must the administrator make to allow Facebook while blocking all other social networking sites?
- A. Set the Action as Exempt for www.facebook.com in the Static URL Filter.
- B. Change the Feature set of Web Filter Profile as Proxy-based.
- C. Change the type as Simple in the Static URL Filter section.
- D. Set the Social Networking action as warning in the FortiGuard Category Based Filter.
Answer: A
Explanation:
The FortiGuard category filter is blocking Social Networking, which includes Facebook. Although a static URL filter entry for www.facebook.com exists, its action is set to Monitor, so it does not override the category block. To allow Facebook while blocking other social networking sites, the action for www.facebook.com in the Static URL Filter must be set to Exempt. This explicitly bypasses category filtering for that URL.
NEW QUESTION # 53
Refer to the exhibits.
The exhibits show a diagram of a FortiGate device connected to the network, and the firewall configuration.
An administrator created a Deny policy with default settings to deny Webserver access for Remote-User2.
The policy should work such that Remote-User1 must be able to access the Webserver while preventing Remote-User2 from accessing the Webserver.
Which two configuration changes can the administrator make to the policy to deny Webserver access for Remote-User2? (Choose two.)
- A. Enable match-vipin the Deny policy.
- B. Disable match-vipin the Deny policy.
- C. Set the Destination address as Deny_IP in the Allow_access policy.
- D. Set the Destination address as Webserver in the Deny policy.
Answer: A,D
Explanation:
In this scenario, the FortiGate uses a Virtual IP (VIP) to map the external IP 203.0.113.22 to the internal web server 10.0.1.10. When using VIPs, firewall policies must be configured carefully to match the translated destination address.
The external users (Remote-User1 and Remote-User2) connect to 203.0.113.22, which is the VIP for the web server.
By default, firewall policies match pre-NAT addresses (the original destination before VIP translation).
To make the deny policy recognize traffic destined for the VIP-mapped address, the match-vip option must be enabled.
The destination in the Deny policy should explicitly be the Webserver (the VIP object), so FortiGate correctly identifies the target.
NEW QUESTION # 54
An administrator manages a FortiGate model that supports NTurbo.
How does NTurbo enhance performance for flow-based inspection?
- A. NTurbo offloads traffic to the content processor.
- B. NTurbo creates a special data path to redirect traffic between the IPS engine its ingress and egress interfaces.
- C. NTurbo buffers the whole file and then sends it to the antivirus engine.
- D. NTurbo creates two inspection sessions on the FortiGate device.
Answer: B
Explanation:
NTurbo creates a special data path to redirect traffic from the ingress interface to the IPS engine, and from the IPS engine to the egress interface.
NEW QUESTION # 55
FortiGate is integrated with FortiAnalyzer and FortiManager.
When creating a firewall policy, which attribute must an administrator include to enhance functionality and enable log recording on FortiAnalyzer and FortiManager?
- A. Policy ID
- B. Sequence ID
- C. Log ID
- D. Universally Unique Identifier
Answer: D
Explanation:
In FortiOS 7.6, when FortiGate is integrated with FortiAnalyzer and FortiManager, firewall policies rely on a Universally Unique Identifier (UUID) to ensure proper policy tracking, synchronization, and log correlation across devices.
Why the UUID is required
Every firewall policy in FortiOS has a UUID.
FortiManager uses the UUID to:
Track policies across managed FortiGate devices
Maintain policy consistency during installs and revisions
FortiAnalyzer uses the UUID to:
Correlate logs accurately to the correct firewall policy
Preserve log association even if policy order or policy ID changes
Without a UUID:
Policy-to-log mapping can break
FortiManager cannot reliably manage or synchronize policies
FortiAnalyzer log analysis becomes inconsistent
This is explicitly documented in Fortinet administration and logging architecture references.
Why the other options are incorrect
B . Policy ID
Policy ID can change when policies are moved and is not reliable for long-term correlation across FortiManager and FortiAnalyzer.
C . Sequence ID
Sequence ID reflects GUI ordering only and has no role in log correlation.
D . Log ID
Log ID is generated per log event, not per firewall policy.
NEW QUESTION # 56
Refer to the exhibits. You have implemented the application sensor and the corresponding firewall policy as shown in the exhibits.
Which two factors can you observe from these configurations? (Choose two.)
- A. YouTube search is allowed based on the Google Application and Filter override settings.
- B. Facebook access is allowed but you cannot play Facebook videos based on Video/Audio category filter settings.
- C. YouTube access is blocked based on Excessive-Bandwidth Application and Filter override settings.
- D. Facebook access is blocked based on the category filter settings.
Answer: A,B
Explanation:
Facebook belongs to the Social Media application category, which is set to Block in the application sensor. Therefore, any Facebook application traffic is blocked by category.
YouTube Search may fall under Google services or General Interest depending on how traffic is parsed (especially with SSL deep inspection).
The Google application override is set to Monitor, which means traffic is allowed, just logged.
The Video/Audio category (which includes YouTube video playback) is blocked, but this does not block YouTube Search, which is just browsing and searching on the site, is not blocked by the Video/Audio category unless the actual video stream starts.
NEW QUESTION # 57
......
Get 100% Success with Latest Fortinet NSE 4 NSE4_FGT_AD-7.6 Exam Dumps: https://examcertify.passleader.top/Fortinet/NSE4_FGT_AD-7.6-exam-braindumps.html