What the real exam feels like, and how to pace it

I treated this exam like a FortiGate troubleshooting session, not a memorization quiz, and that was the right approach. Expect a standard multiple-choice format rather than hands-on labs, but many questions are built like mini TAC cases: you get a routing table snippet, policy extract, phase1/phase2 VPN settings, HA status, or CLI output, and you have to infer what FortiGate will actually do. The hard part is that Fortinet often gives you two answers that are both technically true in general networking, but only one matches FortiOS 6.4 behavior.

For timing, assume roughly one minute to a minute and a half per question. With 119 practice questions on Truekia, that number is a decent signal of the exam’s breadth: there are enough topics covered that you cannot afford to spend four minutes trying to mentally simulate a full packet walk on every item. My rule was:

Fast-pass definition questions in under 30 seconds if they are clean recall on HA roles, inspection mode behavior, NGFW policy mode, security profiles, or SD-WAN rule logic.
Spend time on output-based questions that include routing tables, diag debug flow, IPsec negotiation details, or policy/NAT interactions, because those are where Fortinet hides the trap.
If a question includes CLI output, look for the one field that matters instead of reading every line. Fortinet likes to bury the deciding clue in route priority, policy order, interface role, or tunnel selector details.

A very Fortinet-specific pacing tip: if you get a question that forces you to compare proxy-based vs flow-based inspection, NAT mode vs transparent mode, or policy-based vs route-based IPsec, stop and answer from the perspective of how FortiOS 6.4 implements it, not how you remember firewalls in general. Those questions burn time because people overthink them.

Put most of your study hours into policy, routing, VPN, and security profiles

The exam is broad, but it is not evenly broad. The center of gravity is still classic FortiGate administration: firewall policies, routing behavior, NAT, authentication, security profiles, IPsec VPN, SSL VPN, and HA. If you are short on time, those are the domains that pay off the most. GUI familiarity helps, but the exam expects you to understand decision order more than button locations.

Here is where I would put the hours for this specific exam:

Firewall policy logic: top-down matching, source/destination interface interpretation, service matching, schedule, identity-based policy behavior, and what happens when central NAT or NGFW policy mode changes the design.
Static and dynamic routing: route lookup, administrative distance vs priority, ECMP basics, policy routes, and SD-WAN interaction with routing decisions.
IPsec VPN and SSL VPN: phase1/phase2 settings, selectors, proposal mismatches, route-based tunnel behavior, tunnel interface policies, and split tunneling details.
Security profiles: especially AV, web filtering, application control, SSL/SSH inspection, and where profile behavior changes depending on flow/proxy mode.
HA: session pickup, failover triggers, heartbeat interfaces, FGCP election behavior, monitored interfaces, and what settings do or do not sync.
Authentication and user groups: LDAP/RADIUS integration basics, FSSO concepts, captive portal, and where authentication is enforced in policy flow.

What I would not overinvest in for this exam: obscure FortiManager workflows, deep FortiAnalyzer reporting details, or niche advanced cloud integrations. They can appear at the edge, but this is still a FortiOS 6.4 administrator exam, not an ecosystem architecture exam.

Firewall policy questions: the exam loves packet-flow traps

If there is one area where people lose easy points, it is policy behavior. Fortinet writes policy questions in a way that punishes anyone who learned only by clicking through the GUI. You need to know the order in which FortiGate makes decisions.

The most common trap is assuming the exam only wants the matching policy. Often it wants the combination of route, policy, NAT, and profile behavior. A packet is not allowed just because a policy exists; the FortiGate also needs a valid route and the correct interface context.

Specific things to drill:

Top-down policy order still matters constantly. If two policies could match, the one higher in the list wins.
Incoming and outgoing interfaces are part of the match. Questions often include a route that sends traffic somewhere unexpected, making the obvious policy wrong because the egress interface differs.
Implicit deny is obvious, but the trick is when a policy exists and traffic still fails because there is no route, wrong service, wrong schedule, or identity condition not met.
Central NAT vs policy NAT can change how you interpret a question. If central NAT is enabled, don’t assume SNAT is configured on the policy itself.
NGFW profile-based vs policy-based mode matters. In policy-based NGFW mode, application and category logic can be embedded differently than in profile-based mode.
Flow-based vs proxy-based inspection affects feature behavior and troubleshooting interpretation. If the question is about full content buffering, replacement messages, or explicit proxy-like behavior, think proxy-based.

A pattern I saw repeatedly in practice material: Fortinet will show a policy set and ask why traffic to the internet is not working. Candidates jump to policy order, but the real answer is usually one of these:

no default route
wrong outgoing interface because of a more specific route
service object mismatch
source NAT disabled or central SNAT missing
SSL inspection/profile blocking after policy match

When you see a policy question, mentally run this sequence:

Is there a route to the destination?
Which egress interface will be chosen?
Which policy matches that interface pair and source/destination/service?
Is NAT required and actually configured in the correct place?
Could a security profile or inspection mode alter the outcome?

That sequence is much more useful on this exam than generic advice about reading carefully.

Routing and SD-WAN: know what FortiGate prefers, not what routers prefer

Routing questions on NSE4_FGT-6.4 are not CCNP-style deep routing theory. They are FortiGate operational routing questions: which route wins, how policy routes interact with the routing table, what SD-WAN does to path selection, and how to read FortiGate outputs without getting distracted.

The exam absolutely expects you to distinguish:

Administrative distance vs priority
Static route choice vs policy route override
Destination-based routing vs SD-WAN rule selection
ECMP behavior vs simple best-route selection

The usual gotcha is this: people remember that lower administrative distance wins, then miss that among equal routes, priority can decide the preferred path. Fortinet likes to give two static routes to the same prefix and ask which one is used. If the distances are the same, look at priority. If ECMP is relevant, the wording usually gives it away.

For SD-WAN, do not study it as a marketing feature. Study the mechanics:

member interfaces and health checks
SLA targets and what happens when a member fails SLA
rule modes such as manual, load balancing, or best quality logic
how SD-WAN service rules interact with the regular routing table

A classic Fortinet question pattern is: traffic is not using the expected WAN link even though both links are up. The answer is usually not “routing is broken.” It is one of these:

the SD-WAN rule does not match the application/destination/service
the health check marks a member degraded or dead
a more specific route or policy route bypasses the intended SD-WAN decision
the default route points elsewhere and the SD-WAN service is not actually controlling that traffic class

If you get CLI or routing-table output, train yourself to scan for:

destination prefix length
distance
priority
interface
gateway
whether the route is static, connected, dynamic, or blackhole

Fortinet also likes reverse path forwarding style logic in troubleshooting scenarios. If a packet arrives on an interface that does not make sense relative to the return path or policy design, expect asymmetry or session issues to be part of the answer.

IPsec and SSL VPN: this is where Fortinet hides the mean questions

VPN is one of the most exam-heavy and mistake-prone areas in fortinet-nse4_fgt-64. The questions are rarely just “what is phase 1?” They are usually mismatch diagnosis or tunnel-behavior interpretation.

For IPsec, focus on route-based tunnels because that is where FortiGate administration lives in the real world and on the exam. Know exactly how these pieces fit:

Phase 1: authentication, IKE version, proposals, DH group, peer type, interface binding, dead peer detection, NAT-T, mode-config where relevant
Phase 2: selectors, proposals, PFS, replay, key lifetime
Policies and routes: a tunnel can be up and still pass no traffic if routes or policies are wrong
Interface-based tunnel logic: traffic uses the tunnel interface, so policy and routing must point there

The biggest trap: candidates think “phase 1 is up, so VPN works.” Fortinet loves questions where the tunnel is established but traffic fails because:

phase 2 selectors do not match the actual subnets
no static route exists toward the remote subnet via the tunnel interface
a firewall policy to or from the tunnel interface is missing
NAT is enabled when it should not be
proposals or PFS settings mismatch and only some traffic patterns fail

If a question gives you a negotiation failure scenario, sort it like this:

No tunnel establishment at all: think phase 1 mismatch, peer/authentication problem, IKE version mismatch, proposal/DH issue, pre-shared key/certificate issue, or reachability.
Tunnel up but no traffic: think phase 2 selectors, routes, policies, NAT, or asymmetric return path.
Intermittent drops: think DPD, rekey, unstable underlay, SLA/SD-WAN interaction, or overlapping selectors.

For SSL VPN, the exam tends to test configuration dependencies more than cryptography. Drill these:

portal mapping to user/group
split tunnel vs full tunnel behavior
authentication source and group membership
IP pool assignment
policies from SSL VPN interface to internal destinations
DNS and routing considerations for remote users

The trap in SSL VPN questions is usually that authentication succeeds but access still fails because the portal, address pool, or firewall policy is wrong. Fortinet likes to separate login success from authorization success.

HA, auth, and inspection mode: easy-looking topics with hidden edges

HA questions on this exam look simple until the answer choices get very close. You need to know not just what HA is, but what FortiGate actually synchronizes and what causes failover.

On HA/FGCP, spend time on:

active-passive behavior and session pickup implications
heartbeat interfaces and why dedicated links matter
monitored interfaces and how link failure affects role changes
device priority and override/preemption behavior
what configuration is synchronized and what is not
virtual MAC and how failover affects upstream devices

The gotcha: people assume every difference between cluster members is bad. Fortinet will present settings that are intentionally unique per unit, such as some management-related values, and ask whether sync is broken. Learn the exceptions instead of memorizing “everything syncs.” Also know that session pickup is not a magic bullet for every protocol and every failover condition.

Authentication is another topic that looks straightforward but gets tested through policy flow. Know where LDAP, RADIUS, local users, FSSO, and user groups fit into firewall policy decisions. If a user can authenticate but still cannot access a resource, the issue is often group mapping or policy reference, not the auth server itself.

On SSL/SSH inspection, web filter, application control, and AV, the exam often tests feature interaction rather than standalone definitions. Example pattern: traffic matches a policy, but a website is still inaccessible. The deciding factor may be:

certificate inspection vs deep inspection capability
unsupported decryption scenario because of certificate pinning/application behavior
web category block taking precedence over what the user expected
application control identifying and blocking traffic despite service port being allowed

Fortinet-specific nuance matters here. If the question asks why a security profile is not giving the expected visibility or enforcement, ask yourself whether the chosen inspection mode supports that exact behavior in FortiOS 6.4.

The last week: what I would review again for 6.4 specifically

In the final week, I would not reread everything. I would do targeted review on the areas where Fortinet wording causes mistakes.

Use this checklist:

Rebuild from memory the packet-processing logic for a simple outbound session: route lookup, policy match, NAT, profile inspection, session creation.
Review policy routes, static routes, SD-WAN rules, and how they can point traffic in different directions.
Practice reading routing table and diagnostic output quickly. Even if the exam does not require typing commands, Fortinet expects you to interpret outputs.
Revisit IPsec mismatch scenarios: PSK/auth issues, IKE version mismatch, DH/proposal mismatch, selector mismatch, missing route, missing policy.
Review SSL VPN portal and policy dependencies. A lot of candidates know the portal names but not the access path logic.
Memorize the practical differences between proxy-based and flow-based inspection, and where each changes behavior.
Recheck HA election and failover conditions, especially monitored interfaces, heartbeat status, and session sync expectations.
Refresh central NAT, VIP, and DNAT/SNAT behavior. NAT questions are easy to miss because the policy looks correct at first glance.

If you are using the 119 Truekia practice questions, do not just score them. Categorize your misses into buckets:

policy/routing interaction
VPN negotiation vs forwarding
HA sync/failover logic
security profile/inspection mode behavior
authentication and group mapping

That categorization matters because on this exam, repeated misses usually come from misunderstanding one FortiOS behavior pattern, not from random weak memory.

Exam-day interface habits that help on Fortinet questions

Because the exam is multiple-choice and scenario-heavy, your exam-day technique should be built around extracting the decisive clue from Fortinet-style wording.

My approach for this exam was very specific:

If a question contains a diagram or config fragment, identify whether it is testing control plane or data plane. Control plane means routing, tunnel establishment, HA election. Data plane means policy, NAT, inspection, forwarding.
If a question mentions traffic is allowed by policy but still failing, stop looking at policy order and check routing, NAT, or security profiles.
If a VPN question says the tunnel is up, stop troubleshooting phase 1 first. Move immediately to phase 2, routes, and policies.
If an HA question asks which unit becomes primary, check priority, override, and monitored interface status before assuming the currently active node stays active.
If an SD-WAN question says links are healthy but path choice is wrong, inspect service rule matching before route metrics.

One final Fortinet-specific warning: answer according to FortiOS 6.4, not the newest release you may use at work. Small differences in GUI labels, defaults, and feature behavior can make an otherwise reasonable answer wrong. This matters most in SD-WAN behavior, NGFW policy mode interpretation, SSL inspection options, and some VPN defaults.

That is the real shape of fortinet-nse4_fgt-64: not impossible, but very unforgiving if your knowledge is generic firewall knowledge instead of FortiGate 6.4 operational knowledge.