NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #6 Discussion

config system accprofile
edit "NOC_access"
set admintimeout-override enable
set admintimeout 50
next
end

Pg 22 of FGT 7.6 Administrator says. The Override Idle Timeout option allows the admintimeout value, under config system accprofile, to be overridden for each access profile.

Explanation
- admintimeout is the parameter that controls how long an administrator’s GUI session can remain idle before being disconnected.
- By default, FortiGate sets this to 5 minutes. If the NOC team wants longer sessions without being logged out, the administrator must increase this value in the specific admin profile (NOC_Access).
- The other options are incorrect because:
- A. Move NOC_Access to the top of the list → Ordering of profiles does not affect timeout behavior.
- B. Increase Override Idle Timeout → This parameter applies to individual admin accounts, not profiles. The question specifies the admin profile.
- C. Assign super_admin role → This changes privileges, not session timeout.

✅ So the administrator should configure:
config system accprofile
edit NOC_Access
set admintimeout <desired value in minutes>
next
end

It seems that both answers are correct: B via the GUI and D via the CLI.

because GUI mode

D

“You can override the global administrator idle timeout on a per-profile basis by enabling Override Idle Timeout and setting a custom value.”
Override Idle Timeout
Never Timeout
Offline - 1-480 minutes

B - 200%

b

GUI

In FortiOS, you have two ways to manage GUI idle timeouts:
Global Timeout: By default, all admins follow the global timer set under config system global (usually 5 minutes).
Profile Override: To satisfy a specific request for one group (like the NOC team) without changing the timeout for every other administrator on the device, you use an Access Profile override.
By navigating to config system accprofile and editing the NOC_Access profile, you can use the set admintimeout command to define a longer duration specifically for users assigned to that profile.

B: While "Override Idle Timeout" is the name of the toggle in the GUI, the actual parameter being adjusted is the admintimeout. Furthermore, "offline value" is not standard FortiGate terminology for this setting.

FortiGate allows you to control GUI session timeout globally using admintimeout, but that affects all administrators.

If you want to adjust the timeout specifically for a certain admin profile (like NOC_access), you must use the “Override idle timeout” setting within that admin profile.

So:

Option B correctly targets the requirement: extending session time only for the NOC team without affecting others.

best one

https://community.fortinet.com/fortigate-3/technical-tip-how-to-configure-administrator-specific-idle-timeout-settings-on-fortigate-108985

https://community.fortinet.com/fortigate-3/technical-tip-how-to-configure-administrator-specific-idle-timeout-settings-on-fortigate-108985

D

nse4-fw # config user group

nse4-fw (group) # edit "hfljflhjfljh"

nse4-fw (hfljflhjfljh) # show
config user group
edit "hfljflhjfljh"
next
end

nse4-fw (hfljflhjfljh) # show
config user group
edit "hfljflhjfljh"
next
end

nse4-fw (hfljflhjfljh) # get
name : hfljflhjfljh
id : 2
group-type : firewall
authtimeout : 0
auth-concurrent-override: disable
http-digest-realm :
member :
match:


nse4-fw (hfljflhjfljh) # get
<Enter>

nse4-fw (hfljflhjfljh) #
config Configure object.
set Modify value.
unset Set to default value.
select Select multi-option values.
unselect Unselect multi-option values.
append Append values to multi-option.
clear Clear multi-option values.
get Get dynamic and system information.
show Show configuration.
next Configure next table entry.
abort End and discard last config.
end End and save last config.

nse4-fw (hfljflhjfljh) # get
<Enter>

nse4-fw (hfljflhjfljh) # edit h
command parse error before 'edit'

nse4-fw (hfljflhjfljh) # edit h
command parse error before 'edit'

nse4-fw (hfljflhjfljh) # edit h
command parse error before 'edit'

nse4-fw (hfljflhjfljh) # edit
command parse error before 'edit'

nse4-fw (hfljflhjfljh) # set
group-type Set the group to be for firewall authentication, FSSO, RSSO, SCIM, or guest users.
authtimeout Authentication timeout in minutes for this user group. 0 to use the global user setting auth-timeout.
auth-concurrent-override Enable/disable overriding the global number of concurrent authentication sessions for this user group.
http-digest-realm Realm attribute for MD5-digest authentication.
member Names of users, peers, LDAP severs, RADIUS servers, SCIM client or external idp servers to add to the user group.

nse4-fw (hfljflhjfljh) # set

Option B is correct because the question features a GUI exhibit, and FortiOS explicitly labels this profile-specific session limit in the Web UI as the "Override Idle Timeout" setting with an "Offline" duration value.

admintimeout value is a global setting. and doesn't apply here.
Offline timeout is exactly what is relevant here.

D

@admin what is the correct answer?

config system accprofile
edit "NOC_Access"
set admintimeout-override enable
set admintimeout <minutes>
next
end

https://community.fortinet.com/fortigate-3/technical-tip-how-to-configure-administrator-specific-idle-timeout-settings-on-fortigate-108985

idle timeout ==> The idle timeout is the amount of time an administrator can stay logged into the Fortigate without any activity. System -> Settings -> Idle timeout for all administrators.

However, this value can be overridden on a per-admin basis by applying a custom admin profile for the administrator to override the setting.
system > admin profiles > override idle timeout

Logic answer