NSE 4 study guide · 2026

The 5 NSE 4 domains, explained

5 domains and 18 official objectives. Content Inspection carries the most weight at 25-30%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
50-55 multiple-choice questions
Time
100 minutes
Passing score
Not published (pass/fail; score report in the Pearson VUE account)
Outline
Fortinet NSE 4 - FortiOS 7.6 Administrator exam page on training.fortinet.com, FortiOS 7.6.0 objectives (current as of October 2026; FortiOS 8.0 version listed as Coming Soon)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 20-25%
  2. 2 20-25%
  3. 3 25-30%
  4. 4 10-15%
  5. 5 10-15%
  1. 1 Deployment and System Configuration
  2. 2 Firewall Policies and Authentication
  3. 3 Content Inspection
  4. 4 Routing
  5. 5 VPNs

All 5 domains

18 official objectives 52–68 hrs suggested study

  1. Domain 01 20-25%

    Deployment and System Configuration

    Worth 20-25% of the FortiOS 7.6 Administrator exam, this domain covers first-time FortiGate setup, log settings, FGCP high availability, resource and connectivity troubleshooting, FortiGate in the public cloud and FortiSASE onboarding.

    Inside this domain

    • Perform initial configuration
    • Configure log settings and diagnose problems using the logs
    • Configure FortiGate Clustering Protocol (FGCP) high-availability (HA) cluster
    • Diagnose resource and connectivity problems
    • and 2 more objectives

    Watch for Priority wins

    Objectives
    6
    Questions est.
    ~12
    Study time est.
    14–18 hrs
  2. Domain 02 20-25%

    Firewall Policies and Authentication

    Worth 20-25% of the exam, this domain tests how FortiGate matches traffic to firewall policies, how it applies source and destination NAT, and how it identifies users through active authentication and FSSO.

    Inside this domain

    • Configure firewall policies
    • Configure source network address translation (SNAT) and destination network address translation (DNAT) options in firewall policies
    • Configure different methods of firewall authentication
    • Explain how to deploy and configure Fortinet Single Sign-On (FSSO)

    Watch for Lowest ID first

    Objectives
    4
    Questions est.
    ~12
    Study time est.
    10–14 hrs
  3. Domain 03 25-30%

    Content Inspection

    The heaviest NSE 4 domain at 25-30%, covering how FortiGate inspects encrypted traffic, chooses flow or proxy inspection, and applies web filtering, application control, antivirus and IPS profiles to matched sessions.

    Inside this domain

    • Explain and inspect encrypted traffic using certificates
    • Identify FortiGate inspection modes and configure web filtering
    • Configure application control to monitor and control network applications
    • Configure antivirus scanning modes to neutralize malware threats
    • and 1 more objectives

    Watch for Certificate inspection scans content

    Objectives
    5
    Questions est.
    ~14
    Study time est.
    14–18 hrs
  4. Domain 04 10-15%

    Routing

    Worth 10-15% of the exam, this domain covers static routing on FortiGate, how the routing table chooses between routes, and how SD-WAN steers and balances traffic across multiple WAN links.

    Inside this domain

    • Configure and route packets using static routes
    • Configure SD-WAN to load balance traffic between multiple WAN links effectively

    Watch for Priority beats distance

    Objectives
    2
    Questions est.
    ~7
    Study time est.
    8–10 hrs
  5. Domain 05 10-15%

    VPNs

    Worth 10-15% of the exam, this domain focuses on IPsec: core concepts, building tunnels with the wizard, redundant and meshed designs between FortiGate devices, and reading logs to fix tunnels that will not come up.

    Inside this domain

    • Implement a meshed or partially redundant IPsec VPN

    Watch for Up means working

    Objectives
    1
    Questions est.
    ~7
    Study time est.
    6–8 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 52–68 hrs of study.

  1. 3 Content Inspection 25-30% · 14–18 hrs
  2. 1 Deployment and System Configuration 20-25% · 14–18 hrs
  3. 2 Firewall Policies and Authentication 20-25% · 10–14 hrs
  4. 4 Routing 10-15% · 8–10 hrs
  5. 5 VPNs 10-15% · 6–8 hrs

Try one

Practice questionDomain 3: Content Inspection

After an administrator enables full SSL inspection on the outbound internet policy, users on company laptops see browser certificate warnings for every HTTPS site. Server certificates are valid and FortiGuard is reachable. What is the most likely fix?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Priority wins

    Clue The table shows override disabled and a large uptime difference.

  • Domain 2

    Lowest ID first

    Clue The table shows IDs out of numerical order.

  • Domain 3

    Certificate inspection scans content

    Clue The scenario needs file or full URL visibility in HTTPS.

  • Domain 4

    Priority beats distance

    Clue The routes show different distances and priorities.

  • Domain 5

    Up means working

    Clue Users cannot reach remote subnets despite an up tunnel.

Other Cybersecurity certifications

Study guides for exams that overlap with NSE 4.

Practise what you read

NSE 4 domains: common questions

How many domains are in the NSE 4 exam?

NSE 4 has 5 domains with 18 official objectives between them: Deployment and System Configuration, Firewall Policies and Authentication, Content Inspection, Routing and VPNs.

Which NSE 4 domain carries the most weight?

Content Inspection is the heaviest at 25-30%, followed by Deployment and System Configuration (20-25%). The lightest is VPNs (10-15%). Weights come from Fortinet's official outline.

What is the NSE 4 exam format?

Questions: 50-55 multiple-choice questions. Time allowed: 100 minutes. Passing score: Not published (pass/fail; score report in the Pearson VUE account).

How long should I study for NSE 4?

Our planning estimate is 52–68 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Content Inspection, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Fortinet NSE 4 - FortiOS 7.6 Administrator exam page on training.fortinet.com, FortiOS 7.6.0 objectives (current as of October 2026; FortiOS 8.0 version listed as Coming Soon), published by Fortinet. It was last reviewed in October 2026.

Domain names, weights and objectives come from Fortinet's official outline (Fortinet NSE 4 - FortiOS 7.6 Administrator exam page on training.fortinet.com, FortiOS 7.6.0 objectives (current as of October 2026; FortiOS 8.0 version listed as Coming Soon)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.