What NSE4_FGT_AD-7.6 Questions and Answers feature?

With a dialup IPsec VPN on FortiGate, when add-route is enabled, FortiGate will only install the corresponding route when it has enough negotiated information from the tunnel. In FortiOS 7.6, that means the route is tied to the Phase 2 (Quick Mode) selectors and is created dynamically when the IPsec SA is actually up.

B. The administrator must ensure phase 2 is successfully established

This is required. FortiGate does not install the add-route route just because Phase 1 exists or because the configuration is present. The route is added when the tunnel is effectively usable, which requires Phase 2 (IPsec SA) to be up. If Phase 2 is not established, there is no active SA and FortiGate will not inject the related route into the routing table.

So, if the static route is not showing, one correct explanation is that Phase 2 is not up.

C. The administrator must define the remote network correctly in the phase 2 selectors

This is also required. For dialup tunnels, FortiGate derives what route to add from the remote subnet(s) defined in the Phase 2 selector (proxy ID). If the remote network in Phase 2 is missing, incorrect, or too broad/too narrow in a way that prevents negotiation, the tunnel either won’t come up (so no route), or the route that would be installed won’t match what the administrator expects.

So, another correct explanation is that the Phase 2 remote network is not correctly defined, preventing the correct route from being created.

Why the other options are incorrect

A. Policy route instead of a static route

Add-route does not require policy routes. It is specifically a feature that injects a route (route-table entry) associated with the IPsec tunnel/SA and the Phase 2 selector networks.

D. Enable a dynamic routing protocol

Dynamic routing protocols (OSPF/BGP/RIP) are not required for add-route. Add-route is independent of dynamic routing and works by installing routes locally based on the negotiated selectors.

“Three different configurable thresholds define when FortiGate enters and exits conserve mode. If memory usage goes above the percentage of total RAM defined as the red threshold , FortiGate enters conserve mode.”

“If memory usage keeps increasing, it might exceed the extreme threshold . While memory usage is above this highest threshold, all new sessions are dropped. ”

“What actions does FortiGate take to preserve memory while in conserve mode?

• FortiGate does not accept configuration changes , because they might increase memory usage.”

“However, if the memory usage exceeds the extreme threshold, new sessions are always dropped , regardless of the FortiGate configuration.”

Technical Deep Dive:

The system performance output shows Memory: 2042076k total, 1837868k used (90%) . The configured thresholds shown are:

green = 82

red = 88

extreme = 89

Because memory usage is 90% , it is:

Above the red threshold (88%) → so FortiGate has entered conserve mode

Above the extreme threshold (89%) → so all new sessions are dropped

That makes A and D correct.

Why the others are wrong:

B is not stated anywhere in the study guide as an automatic outcome of conserve mode.

C is the opposite of what the guide says. In conserve mode, FortiGate does not accept configuration changes .

A useful verification command is:

diagnose hardware sysinfo conserve

Operationally, once a FortiGate crosses the red threshold , it starts protecting itself by limiting behavior that could increase memory usage. Once it crosses the extreme threshold , it becomes more severe and drops new sessions to keep the system from becoming unstable.

In FortiOS 7.6, SD-WAN Performance SLAs are used to measure link quality and influence SD-WAN rule decisions. The following three statements are true.

C. All the SLA targets can be configured.

True

SD-WAN Performance SLAs allow administrators to configure:

Latency

Jitter

Packet loss

Mean Opinion Score (MOS) (for voice)

Threshold values for these metrics are fully configurable per SLA.

This is explicitly documented in the SD-WAN Performance SLA configuration section.

D. They are applied in an SD-WAN rule lowest cost strategy.

True

Performance SLAs are commonly used with the Lowest Cost (SLA-based) strategy.

In this strategy:

FortiGate selects the lowest-cost link that meets the SLA requirements.

If a link violates the SLA, it is excluded from selection.

E. They can be measured actively or passively.

True

FortiOS supports:

Active probing (synthetic probes such as ping/HTTP)

Passive measurement (based on real traffic statistics)

Administrators can choose how SLAs are measured depending on the deployment and requirements.

Why the other options are incorrect

A. They rely on session loss and jitter.

Incorrect

SLAs measure packet loss, latency, and jitter.

Session loss is not an SLA metric in FortiOS.

B. They monitor the state of the FortiGate device.

Incorrect

Performance SLAs monitor link quality, not FortiGate system health or device state.