Fortinet Updated NSE4_FGT_AD-7.6 Exam Questions and Answers by michal

According to the FortiOS 7.6 Security Fabric documentation and Study Guide, several conditions must be met for a downstream FortiGate to successfully join a Security Fabric.

First, the Upstream FortiGate IP/FQDN configured on the downstream device must point to the IP address of the interface on the upstream device that is listening for fabric connections. In the provided logical topology, the Fabric Root (HQ-NGFW-1) uses port4 with the IP 10.0.11.254 to connect to the internal segmentation firewalls (ISFWs). Since HQ-ISFW-2 is in the same subnet as HQ-ISFW, it is physically and logically connected to the network segment serviced by port4. Therefore, the current configuration of 10.0.13.254 (which is port6, likely the WAN side) is incorrect, and it must be set to 10.0.11.254 (Statement A).

Second, once the downstream device successfully reaches the upstream device, it enters a Pending state. For security purposes, FortiOS does not allow devices to join the fabric automatically; the administrator of the upstream device (in this case, HQ-ISFW or the root) must manually authorize the new device (Statement C) in the Fabric Management console. Until this authorization is granted, the status will remain " Pending " and no fabric data will be synchronized. Statements B and D are incorrect as SAML settings do not block the initial fabric join, and the management IP should be the local device ' s IP, not the upstream ' s IP.

Based on the FortiOS 7.6 Administrator Guide regarding Fortinet Single Sign-On (FSSO) polling modes, the agentless polling mode has specific technical characteristics:

SMB Protocol Usage (Statement B is True):

In agentless polling mode, the FortiGate unit itself acts as the collector.

It establishes direct connections to the Windows Domain Controllers (DCs) using the SMB (Server Message Block) protocol, typically over TCP port 445, to read the Windows Security Event logs.

This allows FortiGate to parse login event IDs (such as 4768 and 4769) to identify users and their corresponding IP addresses without needing an external collector agent installed on a server.

Workstation Check Support (Statement C is True):

One of the primary limitations of the agentless polling mode compared to the agent-based mode is the lack of workstation verification.

In agentless mode, FortiGate does not perform " workstation checks " or " dead entry checks " . This means it cannot proactively verify if a user is still logged into a specific workstation after the initial logon event is recorded, which can lead to stale entries if a user logs off without a corresponding event being captured.

Why other options are incorrect:

Option A: In agentless mode, FortiGate (the FSSO daemon) performs the collection itself; it does not use the AD server as a " collector agent " in the functional sense of FSSO architecture.

Option D: While FortiGate uses LDAP to retrieve group membership information once a user is identified, it does not " direct " a collector agent to a remote LDAP server, as there is no external collector agent involved in this specific mode.

The study guide text surfaced from the PDF did not return a matching paragraph for fabric-object-unification, but the exhibit itself shows these critical details:

On HQ-NGFW-1 , set configuration-sync default and set fabric-object-unification local

On HQ-ISFW , set configuration-sync default

The new address object on HQ-NGFW-1 has Fabric global object enabled

Those exhibit settings indicate that the object is intended to be a fabric-wide object, but the root FortiGate is currently configured with fabric-object-unification local , which prevents that object from being unified across the fabric.

Technical Deep Dive:

The correct answer is C .

Here is the key logic:

The address object was created on the root FortiGate with Fabric global object enabled .

Normal configuration sync is already set to default , so this is not a generic sync-disabled problem.

The root device is specifically configured with set fabric-object-unification local .

That setting keeps fabric objects local to the device rather than unifying them across downstream fabric members.

Therefore, to make the object propagate as a shared Security Fabric object, the administrator must change the root setting to:

config system csf

set fabric-object-unification default

end

Why the other options are wrong:

A is wrong because the downstream device already has configuration-sync default, and changing it to local would make synchronization more restrictive, not less.

B is wrong because saml-configuration-sync is unrelated to firewall address object synchronization.

D is wrong because downstream-access controls downstream management access behavior, not fabric object propagation.

Operationally, this feature matters when you want shared address objects, services, and policy-referenced objects to remain consistent across the Security Fabric. It reduces duplicate object administration and helps keep policy logic normalized across root and downstream FortiGate devices.