Guide · free to read
The NSE 4 (FortiOS 7.6) exam blueprint, domain by domain.
Fortinet doesn’t make the FortiGate 7.6 Administrator blueprint hard to find — it’s on the published exam description page and in the downloadable exam description PDF. What’s harder to find is someone laying out what each domain actually asks of you and where to go read about it, instead of just reprinting the percentages. That’s what this is.
The basics
Exam code NSE4_FGT_AD-7.6. 50–55 questions, 100 minutes.
Fortinet does not publish a cut score, and anyone who tells you the exact pass mark is guessing — the widely repeated “70%” is an estimate, not a published number, and you should treat it as such.
Fortinet publishes domain weight as bands (for example, “20–25%”), not single numbers, and the bands as published don’t sum cleanly to 100% — you have to pick a value inside each band yourself if you want a study-time budget that adds up. Below is one reasonable way to do that, with the reasoning shown rather than hidden.
| Domain | Weight (this budget) | Published band |
|---|---|---|
| Content Inspection | 28% | 25–30% |
| Deployment and System Configuration | 23% | 20–25% |
| Firewall Policies and Authentication | 23% | 20–25% |
| Routing | 13% | 10–15% |
| VPNs | 13% | 10–15% |
Content Inspection is both the largest single domain and the one people most often under-budget for, because it’s really four sub-skills stacked into one bucket (SSL inspection, web filtering, application control, antivirus, IPS) rather than one topic.
1. Content Inspection — 28%, the largest domain
This is the domain to over-study, not under-study, because “28%” hides that it’s five distinct configuration surfaces:
- Certificates and encrypted-traffic inspection. Understand the difference between full SSL inspection and certificate inspection before you touch anything else here — most of the domain’s harder questions turn on which mode is active and what it can and can’t see.
- Inspection modes and web filtering. Know what flow-based and proxy-based inspection actually change about what a policy can do, not just that both exist.
- Application control.
- Antivirus scanning modes.
- IPS.
Primary source: the FortiOS 7.6.0 Administration Guide, the security-profiles chapters specifically. If you only deep-read one guide section before this exam, make it this one.
2. Deployment and System Configuration — 23%
The “day one” domain, and also where the exam’s newer material lives:
- Initial configuration — the largest share of this domain by task count.
- FGCP high-availability (HA) clusters — configuration, not just theory. Expect this to be tested as “what would you configure,” not “what is HA.”
- Log settings and diagnosing problems using the logs.
- Diagnosing resource and connectivity problems — CLI diagnostics, not GUI clicking.
- FortiGate Cloud-Native Firewall (CNF) and FortiGate VMs in the public cloud, and FortiSASE administration and user onboarding — both are comparatively new additions to this blueprint. If your study material predates 7.6, check it actually covers these two; older guides often don’t.
Primary sources: the FortiOS 7.6.0 Administration Guide for HA and logging, the FortiOS 7.6.0 CLI Reference for diagnose commands.
3. Firewall Policies and Authentication — 23%
- Firewall policy configuration — the mechanical core of the exam; expect to be tested on policy match order and object precedence, not just “what is a firewall policy.”
- SNAT and DNAT options within policies.
- Firewall authentication methods.
- Fortinet Single Sign-On (FSSO) — deployment and configuration, appearing as its own line item rather than folded into general authentication. Don’t treat it as a footnote.
Primary source: the FortiOS 7.6.0 Administration Guide, firewall policy and authentication chapters.
4. Routing — 13%
Smaller weight, but don’t skip the second half of it:
- Static routing — routing table mechanics, not just “add a route.”
- SD-WAN — load-balancing traffic across multiple WAN links. SD-WAN questions on this exam tend to test whether you understand why a rule selected the link it did, which means understanding SD-WAN rules and health checks together, not in isolation.
5. VPNs — 13%, and it’s really one big topic
Every task bullet Fortinet lists under this domain is a facet of the same objective: implementing a meshed or partially redundant IPsec VPN. That includes:
- IPsec VPN concepts (the phase 1 / phase 2 negotiation model)
- Redundant VPN between two FortiGate devices
- The IPsec VPN wizard specifically — Fortinet calls it out by name, so expect the exam to assume you’ve used it, not just configured VPN by CLI
- Reading VPN logs to diagnose a tunnel that isn’t coming up
Primary source: the FortiOS 7.6.0 Administration Guide IPsec VPN chapters, and the log message reference if you want to recognize tunnel-down log entries on sight rather than looking them up during the exam.
How to actually use this
- Pull the exam description PDF yourself and check this breakdown against it — that’s the whole point of citing a public source instead of asking you to trust a summary.
- Budget study time by the weight column above, not by how interesting a domain is. Content Inspection is the single biggest opportunity to move your score; VPNs is real but capped at 13% no matter how deep you go.
- Confirm any study material you’re using is actually written to FortiOS 7.6 and not an older version — Fortinet’s own docs site defaults to the newest point release, and features get added and merged between point releases. If a guide doesn’t mention FortiSASE or Cloud-Native Firewall at all, it likely predates this blueprint.
Tell me when these questions change
FortiOS changes, and so does this bank. Leave an address and you will get one email when the questions are updated for a new release. Nothing else is sent, and a reply saying stop removes you.
Fortinet’s own free training
Before you spend anything on this exam — with us or with anyone — sign up for Fortinet’s own training. The Fortinet Training Institute publishes free self-paced courses, and the FortiOS 7.6 Administrator course is the one written to this blueprint. An account costs nothing. The course materials that come with it, Fortinet’s own study guide included, sit behind that free login — which is why they are worth the five minutes it takes to register. The on-demand lab add-ons are the part Fortinet charges for; the courses themselves are not.
We are recommending that, not citing it: nothing on this page is drawn from the Training Institute courseware, and none of our practice questions are either. Everything above is sourced from public Fortinet documents you can open without an account, and the methodology page says so in detail. We have no relationship with Fortinet or its training program — we point you at it because it is the best free resource for this exam and it is not ours.
Every practice question we publish carries the Fortinet page it was written from, the same way this guide does. You can see fifteen of them, scored by blueprint domain, in the free readiness assessment — no account, nothing recorded. How they are written is set out on the methodology page.