NSE 4 Tests How FortiOS Decides Each Packet — Not Where GUI Menus Are
Formerly FCP - FortiGate Administrator, NSE 4 on FortiOS 7.6 rewards reading CLI output, policy tables and HA status. Walk the evaluation order before you touch the answer options; a FortiOS 8.0 version is listed as coming soon.
Check Your Readiness →Most candidates understand Fortinet NSE 4 - FortiOS 7.6 Administrator (formerly FCP - FortiGate Administrator) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Fifty to 55 questions in 100 minutes, often built on a screenshot, CLI block or HA table. The current 7.6 objectives dropped SSL VPN and Security Fabric, so IPsec is the whole VPN domain. Most answers come from applying an ordering rule precisely.
Raise the priority on the primary unit
Enable session pickup. It is disabled by default, so the new primary had no session table and existing connections had to restart. Priority only influences which unit is elected, not session continuity.
Switch the profile back to certificate inspection
Install the FortiGate CA certificate as trusted on endpoints, typically through group policy. Reverting removes content inspection. Note that invalid server certificates are deliberately re-signed with the untrusted CA so users still see a warning.
port1, because its higher priority number is preferred
Both routes are active at equal distance, and the lower priority value wins, so port2 carries internet traffic. port1 stays installed as a standby; ECMP applies only when distance and priority both tie.
A one-to-one IP pool for clean per-host mapping
Port block allocation assigns each user a block of source ports from the pool, so one log entry covers the block. One-to-one needs a public IP per host; plain overload logs every translation.
With override disabled, FGCP compares connected monitored interfaces, then uptime, then priority, then serial number. Only with override enabled does priority jump ahead of uptime. Check the override flag in the HA table first.
FortiOS evaluates policies in displayed sequence, top down, and moved policies keep their old IDs. Unmatched traffic hits the implicit deny, which does not log by default, so dropped flows can be invisible.
Certificate inspection reads SNI and the server certificate, enough for domain-level web filtering. File scanning and full URL visibility need full (deep) SSL inspection, with the FortiGate CA trusted on every endpoint.
Longest prefix wins first, then lowest distance decides which routes are active, then lowest priority among active routes. Equal distance and priority means ECMP, balanced per session by source IP by default, not per packet.
A route-based tunnel still needs a static route sending the remote subnet into the tunnel interface and firewall policies in each direction. Phase 1 handles authentication and proposals; selectors fail only in phase 2.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
NSE 4 turns on ordering rules: HA election, policy match, route selection. Test your recall.