Fortinet FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6)

✅ Option A (Correct)

Reasoning: For active authentication (captive portal) to function correctly for web access, clients must first resolve website domain names. The firewall policy shown only allows ALL_ICMP, HTTPS, and HTTP services. Without explicitly permitting DNS (UDP/53 and TCP/53) in the policy, clients cannot resolve external hostnames. Consequently, they cannot initiate HTTP/HTTPS connections, preventing the FortiGate from intercepting traffic to display a login prompt.

❌ Why the other choices are incorrect:

• Option B is incorrect: The 'Remote-users' group is correctly placed in the Source, specifying which users require authentication. Adding it to the Destination, which is 'all' for internet access, would be illogical and not resolve the issue.
• Option C is incorrect: The question specifically refers to an "active authentication method" and a "login prompt." FSSO (Fortinet Single Sign-On) is a passive authentication method that typically does not involve a login prompt for each web access. Therefore, FSSO configuration is irrelevant in this scenario.
• Option D is incorrect: If no matching user account existed, the user would still be presented with a login prompt (assuming the authentication realm is configured). The issue described is the *absence* of a login prompt, not a failed login attempt after a prompt.

The web filter profile is not listed because the firewall policy is in 'no-inspection' mode. This mode prevents any security profiles, including web filter profiles, from being applied or even displayed for selection. Web filtering features, especially advanced ones like daily category usage quotas, require traffic inspection (either flow-based or proxy-based). If the policy is set to 'no-inspection', security profiles are disabled for that policy. While 'deep-inspection' is required for comprehensive SSL/TLS inspection, the fundamental blocker here is the complete absence of any inspection mode.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/469440/firewall-policy

✅ Option A (Correct)Reasoning: Agentless FSSO relies solely on polling Domain Controllers for security event logs to detect user logins and logouts. It does not perform active workstation checks, as this would typically require an agent or direct endpoint interrogation. ✅ Option D (Correct)Reasoning: FortiGate in agentless FSSO mode uses protocols like SMB (Service Message Block) and WMI (Windows Management Instrumentation) to remotely access and read the security event logs from the Domain Controllers, extracting user authentication information. ❌ Why the other choices are incorrect:

• Option B is incorrect: In agentless polling, FortiGate directly performs the collection from DCs; there is no separate "collector agent" that FortiGate directs to an LDAP server for event collection.
• Option C is incorrect: The FortiGate is the entity performing the collection. The Active Directory (AD) server (specifically, Domain Controllers) is the source of the event logs, not a "collector agent" for the FortiGate.

The problem indicates an inability to access Google applications while other websites are accessible. The FortiGate firewall policy uses Proxy-based Inspection mode and certificate-inspection for SSL inspection. The application sensor has an override for 'Google' set to 'Monitor'.

• ✅ D: Set SSL inspection to deep-content inspection. Certificate inspection only checks the certificate, not the encrypted content. Many modern applications, especially Google services, require full SSL decryption (deep-content inspection) for the FortiGate to accurately identify the specific applications and apply application control rules effectively. Without decryption, the traffic often remains unidentified, leading to implicit blocks.
• ✅ E: Move up Google in the Application and Filter Overrides section to set its priority to 1. In the application sensor, 'Excessive-Bandwidth' is at Priority 1 and set to 'Block', while 'Google' is at Priority 2 and set to 'Monitor'. If Google application traffic matches the 'Excessive-Bandwidth' filter first, it will be blocked. Elevating 'Google' to Priority 1 ensures that its 'Monitor' (allow) action takes precedence over the 'Excessive-Bandwidth' block.

Why other choices are incorrect:

• ❌ A: Change the Inspection mode to Flow-based. Proxy-based inspection generally provides more granular control and is necessary for advanced features like deep SSL inspection and comprehensive application control. Changing to flow-based would reduce capabilities and is unlikely to resolve the issue.
• ❌ B: Set the action for Google in the Application and Filter Overrides section to Allow. The 'Monitor' action in application control overrides already allows traffic through while logging it. Changing it to 'Allow' would not functionally resolve a blocking issue if the underlying problem is identification (due to SSL inspection) or rule precedence.
• ❌ C: Add “Google”.com to the URL category in the security profile. The issue specifically relates to application control, which is distinct from URL filtering. While URL filtering might be applied, the configuration shown and the problem description point to an application control issue, not a URL category issue.

An Active-Passive (A-P) HA cluster determines the primary based on device priority, then uptime, then serial number. However, failover conditions can override this. HQ-NGFW-1 has memory-based-failover enable with a memory-failover-threshold of 70%. Its current memory usage is 90%, which exceeds this threshold. This condition will trigger a failover, causing HQ-NGFW-1 to relinquish primary status and HQ-NGFW-2 to become the primary. The override disable setting on HQ-NGFW-1 prevents preemption by a higher-priority device but does not prevent failover due to monitored conditions. Therefore, HQ-NGFW-2 is the primary due to HQ-NGFW-1 exceeding its memory failover threshold.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526715/ha-advanced-settings

✅ Option B (VPN policies) (Correct)The FortiClient agent, fundamental to FortiSASE's agent-based mode, establishes a secure tunnel to the FortiSASE PoP. This connectivity relies directly on VPN policies, which define how the tunnel is created and managed, ensuring traffic is routed correctly for secure internet access.✅ Option D (FortiSASE Firewall-as-a-Service (FWaaS)) (Correct)Once the agent's traffic is routed to FortiSASE via the VPN tunnel, it is processed by the cloud-native security services. FWaaS is a core component of FortiSASE, providing firewall capabilities, policy enforcement, and threat protection for all internet-bound traffic, thus delivering the "secure internet access" part of the service.❌ Why the other choices are incorrect:* Option A is incorrect: FortiExtender is a hardware device for extending network connectivity, typically via cellular or Wi-Fi, not a component of the agent-based software mode for traffic redirection or security enforcement.* Option C is incorrect: While PAC files can redirect traffic to proxies, the primary method for comprehensive secure internet access in FortiSASE's agent-based mode (using FortiClient) is typically an SSL VPN tunnel. PAC files are more common for explicit proxy deployments, which can be agentless or agent-managed, but VPN policies are central to the agent-tunneling model.

✅ Option A (Correct)
Reasoning: The remote address on BR1-FGT (10.11.0.0/255.255.255.0) must match the local address on HQ-NGFW (10.0.11.0/255.255.255.0). Changing BR1-FGT's remote address to 10.0.11.0/255.255.255.0 corrects this crucial proxy ID mismatch for Phase 2 negotiation.

✅ Option C (Correct)
Reasoning: HQ-NGFW's encryption is set to AES128, while BR1-FGT's is AES256. For Phase 2 to establish, encryption algorithms must match. Setting HQ-NGFW's encryption to AES256 resolves this mismatch, aligning it with BR1-FGT's configuration.

❌ Why the other choices are incorrect:

• Option B is incorrect: While changing the Key lifetime on BR1-FGT to 43200 seconds would resolve a mismatch with HQ-NGFW's setting, other critical mismatches (proxy ID and encryption) must also be addressed for Phase 2 to come up. This option is a valid fix for a mismatch but not one of the two primary solutions chosen in this context.
• Option D is incorrect: The Diffie-Hellman Group 5 is already enabled and matched on both HQ-NGFW and BR1-FGT. Enabling Group 2 on HQ-NGFW would either create a new mismatch or is unnecessary, as PFS settings are already correctly aligned.

The firewall policy is configured for Proxy-based inspection mode. However, the web filter profile 'default' is configured with a Flow-based feature set. FortiGate requires the security profile's feature set to match the firewall policy's inspection mode for proper application. This mismatch prevents the web filter profile's rules, including allowing 'Social Networking' and monitoring 'www.facebook.com', from being correctly applied. Consequently, traffic to www.facebook.com is blocked, likely by a fallback mechanism or miscategorization due to the profile not functioning as intended, leading to the 'Malicious Websites' block page.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523193/firewall-policy-inspection-modes

✅ Option A (Correct)

Reasoning: FortiGuard server selection prioritizes servers with lower (more negative) weight values, indicating better performance. Fortinet documentation states that the weight value increases (becomes less negative or more positive) as round trip time (RTT) increases or the number of failed packets rises. Therefore, an increase in failed packets makes the server less preferred, resulting in an increased weight.

✅ Option B (Correct)

Reasoning: The exhibit clearly shows "Port : 8888" for FortiGuard communication. TCP port 8888 is a standard default port for FortiGuard services, especially for HTTPS-based web filtering and antivirus updates, alongside TCP 443.

❌ Why the other choices are incorrect:

• Option C is incorrect: The FortiGate is communicating with a private IP address (10.0.1.241) and the output states "Default servers: Not included". This indicates a custom FortiGuard Distribution Server (FDS) setup. This IP could be statically configured, bypassing DNS lookup for its identification. The exhibit does not provide enough information to definitively conclude that DNS was used to identify this specific server.
• Option D is incorrect: The exhibit shows "Protocol : https", which is a reliable protocol (TCP-based). While DNS (UDP) is used for FortiGuard server resolution, the core FortiGuard services like web filtering and antivirus updates primarily communicate via HTTPS (TCP 8888 or 443). You cannot configure these primary services to use unreliable protocols.

The traffic from HQ-PC-1 (10.0.11.50) to BR-FGT (100.65.1.111) is a PING. Firewall policies are evaluated in order. Policy 3, named 'PING traffic', specifically matches traffic with the PING service. This policy is configured to use the 'SNAT-Remote1' IP pool for Source NAT. According to the NAT IP pool configuration, 'SNAT-Remote1' uses the external IP range 100.65.0.99 - 100.65.0.99. Therefore, 100.65.0.99 will be used as the SNAT IP.

Reference: https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/463836/ip-pools