Sourcing methodology

How these questions are written.

Applies to every bank Grindstone Prep publishes Written and maintained by Grindstone Prep Last updated 10 October 2026

Most practice-exam sellers will not tell you where their questions came from. That is usually because the answer is a braindump site. This page is the answer for every bank we publish, in enough detail that you can check it: which documents each bank is written from, what is refused outright regardless of vendor, what happens between a source page and a question in the bank, and what is checked afterwards.

1. Who writes them

Grindstone Prep is a small independent publisher run by a 20-year network and security practitioner. Questions are drafted with AI assistance, strictly from the vendor documents cited under each one, and every citation is checked against the page it points at before publication. Anything that check flags, he decides personally, and nothing goes live without his sign-off. There is no author pool and no rotating cast of contractors. If a question on this site is wrong, one person is responsible for it, and that is deliberate.

2. What the questions are written from

Two rules hold for every bank on this site, regardless of which exam it prepares you for: the vendor’s own published exam objectives decide what gets covered and in what proportion, and nothing is published without a citation you can open and read yourself. What differs by vendor is which documents are permitted as a source — set out below, one vendor at a time.

2.1 Fortinet exams (NSE 4, NSE 5, NSE 6)

Every item in a Fortinet bank is written from one or more of the following, and from nothing else. All of them are published by Fortinet and all of them are free to read. Which documents apply depends on which product the bank covers — FortiOS for NSE 4, FortiAnalyzer for NSE 5, FortiManager for NSE 6 — so they are grouped by product below.

The permitted sources for a Fortinet bank, and what each one is used for.

Source	Used for
FortiOS 7.6 — NSE 4
FortiOS 7.6.0 Administration Guide	The bulk of it: feature behavior, configuration steps, defaults, inspection modes, policy evaluation, routing behavior.
FortiOS 7.6.0 CLI Reference	Exact command syntax, parameter names, value ranges, and documented defaults where the Administration Guide does not state them.
FortiOS 7.6.0 Log Message Reference	Log field names and their meanings, for questions about reading logs.
FortiOS 7.6.0 Ports and Protocols	Which ports and protocols a given service actually uses.
FortiAnalyzer 7.6 — NSE 5
FortiAnalyzer 7.6.0 Administration Guide	The bulk of it: log data flow and normalization, FortiView and log analysis, event handlers, incidents, indicators, playbooks, ADOMs, and reports.
FortiAnalyzer 7.6.0 New Features Guide	Which behaviors are new at which point release, so a later-release feature doesn’t end up tested as if it were part of the 7.6.0 baseline.
FortiAnalyzer 7.6.0 SQL Query Documentation	How the report query layer and hcache behave, for report-building questions.
FortiAnalyzer 7.6.0 Dataset Reference	Which datasets exist for building a report, and what each one contains.
FortiAnalyzer 7.6.0 Fabric Normalization Reference	How FortiAnalyzer normalizes logs from FortiGate and other Fabric devices.
FortiAnalyzer 7.6.0 Custom Log Parsers	Importing and configuring a custom log parser, for non-Fortinet log sources.
FortiAnalyzer 7.6.0 CLI Reference	Exact command syntax for FortiAnalyzer.
FortiAnalyzer 7.4.0 Examples	Report and chart configuration walkthroughs. Used because docs.fortinet.com redirects the 7.6 edition’s Examples URL to this one — 7.4.0 is the current edition of that specific guide.
FortiManager 7.6 — NSE 6
FortiManager 7.6.0 Administration Guide	The bulk of it: ADOMs, workspace mode, device registration, policy packages and objects, FortiGuard, and the global database.
FortiManager 7.6.0 CLI Reference	Exact command syntax for FortiManager.
FortiManager 7.6.0 Best Practices	Sizing and performance guidance, for questions on deploying FortiManager at scale.
FortiManager Ports	Which ports FortiManager and its managed devices use.
FortiManager 7.6.0 Upgrade Guide	Firmware upgrade sequencing for FortiManager and the clusters it manages.
FortiGate/FortiManager Communications Protocol Guide	How the FGFM tunnel between FortiGate and FortiManager is established and recovered, for troubleshooting questions.
All three
Fortinet Community knowledge base	Fortinet-authored technical tips, where a behavior is documented there and not in the product guides.
Fortinet’s published exam description for the FortiGate 7.6 Administrator, FortiAnalyzer 7.6 Analyst, and FortiManager 7.6 Administrator exams	The list of objectives and the domain weightings for each exam. It decides what each bank covers and in what proportion. It is not a source of questions.
Hands-on verification on a FortiGate	Settling a behavior the documentation describes ambiguously, and confirming that a CLI fragment used in an exhibit is valid.

Every Fortinet bank here is written against a specific product version — FortiOS 7.6 for NSE 4, FortiAnalyzer 7.6 for NSE 5, FortiManager 7.6 for NSE 6 — and citations point at the documentation for that version specifically rather than at whatever the current release happens to be. A behavior that changed in a later release is not the behavior that version’s exam objectives describe, and a citation that has quietly drifted to a newer document is treated as a defect here.

2.2 Cisco CCNA 200-301

Every item in the CCNA bank is written from one or more of the following, and from nothing else.

The permitted sources for the CCNA bank, and what each one is used for.

Source	Used for
Cisco’s published CCNA 200-301 v1.1 exam topics (PDF)	The list of objectives and the domain weightings this bank is built and measured against. It is not a source of questions.
Cisco’s published CCNA 200-301 v2.0 exam topics (PDF)	Used only to decide which v1.1 objectives still matter: an objective that carries over into Cisco’s next exam topics gets questions here; one that does not, does not.
Cisco product documentation — Catalyst 9300 IOS XE configuration guides, the IOS XE Security and VPN guide, Cisco’s Wireless RF Reference Guide, the SD-Access and Catalyst SD-WAN design guides, the Catalyst Assurance user guide, and Cisco technical notes	The bulk of it: feature behavior, configuration syntax, defaults, and design guidance, each cited to the specific document and page.

These items are checked against Cisco’s own product documentation. They are not checked against Cisco’s training course for this exam — that course is not something you could check for yourself even if we did use it, and the whole point of this page is that you don’t have to take our word for anything.

The version matters here too. This bank is written against CCNA 200-301 version 1.1, Cisco’s current published exam topics, restricted to the objectives that also appear in version 2.0, Cisco’s next published exam topics (effective 3 February 2027). An objective that exists in 1.1 but drops out of 2.0 is not covered here, with one exception: three items on SDN architecture (objective 6.3), which is still in Cisco’s published 1.1 exam topics. Those three items are removed from the bank at the 3 February 2027 version changeover, along with everything else that is 1.1-only.

3. What is never used

Stated flatly, because it is the part people actually want to know.

• No real examination questions. Nobody here has written down an item from a live exam, bought one, or accepted one from a candidate. A certification body’s candidate agreement forbids disclosing exam content, and a product built on breaches of it puts its own customers’ certifications at risk, not only its own neck.
• No braindump sites. Not ExamTopics, not any of the “actual questions, verified answers” dump sellers, not the PDF packs that circulate on forums. Not as a source, not as a cross-check, not as inspiration for a stem. They are not opened during authoring.
• No other vendor’s practice product. No competitor question bank is bought, scraped, paraphrased, or consulted.
• No claim published on the strength of something nobody checked. Whatever a draft was written from, the claim it makes is not published until it has been read against a primary source page and that page is cited. A plausible-sounding sentence with nothing behind it is deleted, not softened.

4. How an item gets into the bank

1. Objective map first. The vendor’s own published exam objectives are broken into individual objectives, and each objective is given a target number of questions taken from the domain weighting for that exam. This is what stops a bank drifting toward whatever happens to be easiest to write about. Three shapes show up in practice: some vendors publish a band for each domain — Fortinet’s “20–25% of the exam,” which does not sum to 100%, so the single figure used for each domain inside that band is our own choice. Some publish one exact number per domain that sums to 100% — Cisco does this for CCNA 200-301 — and then there is nothing to choose; our weighting simply matches theirs. For some exams a vendor publishes no weights at all, and then the split is entirely ours, derived from the task breakdown. Which shape each bank is in, and the exact numbers, are printed on the catalog page.
2. Source read first, question written second. The relevant documentation is read before the item exists. Items are written from what the source says — not written from memory and then given a citation that looks close enough.
3. Drafting. The stem describes a situation rather than asking you to recite a sentence. The wrong options are things a competent administrator might actually believe: the adjacent setting, the previous release’s behavior, or the correct answer to a slightly different question.
4. The explanation. Every item has one. It explains the mechanism behind the right answer and says why each wrong option is wrong.
5. Citation attached. The specific page the claim comes from, not a document front page. It is printed on the question where you can see it and click it.
6. Mechanical linting. The bank is checked by tooling for the tells that make practice questions gameable: the correct answer being reliably the longest option, an explanation that gives the key away by naming an option letter, duplicated stems, missing explanations, and citations pointing at the wrong document.

5. How it is checked afterwards

Writing carefully is not the same as being right, so the bank gets a separate, adversarial pass whose job is to find defects rather than to confirm the work.

• Every item is re-read against its citation by someone treating the item as guilty. Not the title of the cited page — the body of it. Where the cited page does not actually contain the claim, that is recorded as a defect even when the keyed answer happens to be correct.
• Every cited URL is fetched. This matters more than it sounds. Fortinet’s docs.fortinet.com, for instance, addresses a page by a numeric ID and ignores the readable slug that follows it, so a citation with the right slug and the wrong ID returns a perfectly healthy page about something else — and an ordinary link checker passes it. Ours compares the heading the server actually returns against the page the citation claims to be. Cisco’s own site shows a different failure mode: some cisco.com pages return an automated-looking fetch a 403 even though the same page loads fine in a browser. Those are checked by hand against a dated, expiring record rather than skipped — an unreviewed or expired one still fails the build. Either way, nothing gets a pass just because fetching it was inconvenient.
• Defects are logged, ranked, and dispositioned one at a time — fixed, rewritten, or the item deleted. A finding is not closed by agreeing with it.
• Nothing is taken on trust during the fixing either. When a citation is replaced, the replacement is fetched and read before it is accepted, and the sentence that supports the claim is quoted into the record.

6. Where the numbers stand

Numbers you can hold us to. The NSE 4 bank is used below because it is the oldest and largest; every other bank on the site is built and checked the same way, and its own current numbers are printed on its own card on the catalog page rather than retyped here by hand, so this page cannot drift out of sync with that one.

Questions in the NSE 4 bank

192

Carrying a source citation

192 of 192

Whose citation is a public link you can open

192 of 192

Written against

FortiOS 7.6

Bank version

1.6.51, updated 2026-10-10

Every one of the 192 is a link you can open in a new tab and read for yourself, without an account and without paying anybody. That is the number we would rather be held to than any claim about quality, because it is the one you can check.

Every bank carries a version number and a date, shown both on this site and inside the product, so you can always tell whether what you are studying is what this page describes.

7. What happens when we are wrong

Documentation changes, and a question that was right in one release can be wrong in the next. Every question in the exam engine — including the ones in each exam’s own free check — carries an Object to this answer link underneath its explanation. It opens a short form with the item’s id, the exam and the bank version already filled in, so all you have to write is what you think is wrong and why. It takes no account, and it does not interrupt the exam you are sitting. You can also just write to contact@grindstoneprep.com and say which item and why, or open the form directly; all three arrive in the same place.

Either way it gets checked against the cited source. If it is wrong it is corrected or the item is retired, and the bank’s version number moves. We answer objections within a week. You will not be argued with by a support script.

This is also the honest reason the citation is printed on the question rather than kept in a spreadsheet somewhere. It is the only way you can tell whether we are right, and a claim you cannot check is worth very little from anyone selling you something.

8. What this method does not give you

Three things this page is careful not to imply.

• These are not the exam’s own questions and are not modeled on them. They are written from the same published objectives the exam is built from. Anyone selling you closer than that is selling you something they should not have.
• No outcome is promised. There is a pass-or-refund guarantee, set out on the refunds page, and it is a refund of our fee. It is not a prediction about your result, and we do not promise that you will pass.
• A vendor’s own documentation is not perfect either. Where two of a vendor’s own sources disagree, the item says so, or the item does not get written.

Read a free sample of these questions, with their explanations and their sources — free, in the browser, nothing to sign in to — or go back to the practice exams.