cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 15

Question 140

An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The FortiGate selects an eligible healthy WAN member for appropriate sessions, with degraded paths marked accurately without losing every available route.
  2. The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy.
  3. Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded.
  4. The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable.

Explanation

Correct Answer

C:

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This is the operational validation outcome rather than merely an enabled setting. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

Incorrect Answers

A:

The FortiGate selects an eligible healthy WAN member for appropriate sessions, with degraded paths marked accurately without losing every available route. This result would test FortiGate SD-WAN members, zones and health-check design but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

B:

The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. This result would test Policy routes versus destination routing and session steering but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

D:

The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. This result would test Static route priority, administrative distance and ECMP design but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

Question 141

A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
  2. Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures.
  3. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
  4. Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports.

Explanation

Correct Answer

D:

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This directly addresses the FortiOS configuration or response required by the case. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. Verify with: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

Incorrect Answers

A:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

B:

Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. This addresses Application category filters and application-specific enforcement, but not the principal task of the described flow. Blocking an entire application category can affect unrelated products; an application signature policy may need specific exceptions and protocol inspection support. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

C:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This addresses HTTPS web filtering hostname limitations and logging, but not the principal task of the described flow. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

Question 142

A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route.
  2. Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages.
  3. Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets.
  4. Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details.

Explanation

Correct Answer

A:

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This distinguishes the relevant FortiGate device, session or controller evidence. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. The corresponding action is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Incorrect Answers

B:

Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This diagnostic is related to Firewall policy evaluation order, interfaces and least privilege rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

C:

Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This diagnostic is related to NAT hairpin and internal use of public VIP names rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

D:

Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This diagnostic is related to Implicit denial, policy logging and rule hit interpretation rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Question 143

A browser displays a FortiGate-generated certificate warning during full inspection and staff are told to ignore it instead of fixing endpoint trust distribution. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior.
  2. An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional.
  3. A controlled benign exploit simulation triggers the expected IPS action while legitimate application transactions continue under tested exclusions.
  4. Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules.

Explanation

Correct Answer

A:

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This is the operational validation outcome rather than merely an enabled setting. FortiGate cannot content-scan encrypted HTTP payload merely because a web category or trusted certificate is visible; indiscriminate TLS decryption may break pinned clients. Scenario: A browser displays a FortiGate-generated certificate warning during full inspection and staff are told to ignore it instead of fixing endpoint trust distribution.

Incorrect Answers

B:

An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. This result would test Antivirus profile scanning modes and supported protocol boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. Scenario: A browser displays a FortiGate-generated certificate warning during full inspection and staff are told to ignore it instead of fixing endpoint trust distribution.

C:

A controlled benign exploit simulation triggers the expected IPS action while legitimate application transactions continue under tested exclusions. This result would test IPS signature filters, severity and policy actions but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. Scenario: A browser displays a FortiGate-generated certificate warning during full inspection and staff are told to ignore it instead of fixing endpoint trust distribution.

D:

Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. This result would test Static URL filter ordering and wildcard match behavior but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. Scenario: A browser displays a FortiGate-generated certificate warning during full inspection and staff are told to ignore it instead of fixing endpoint trust distribution.

Question 144

The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  2. Examine session-pickup configuration, cluster synchronization, monitored-link state, active sessions, NAT state, failover timing and traffic results.
  3. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.
  4. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.

Explanation

Correct Answer

C:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This distinguishes the relevant FortiGate device, session or controller evidence. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. The corresponding action is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

Incorrect Answers

A:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This diagnostic is related to FortiGate local log storage and reliable export rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

B:

Examine session-pickup configuration, cluster synchronization, monitored-link state, active sessions, NAT state, failover timing and traffic results. This diagnostic is related to HA session-pickup and failover continuity rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

D:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

Question 145

A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path.
  2. Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy.
  3. Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope.
  4. Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM.
  5. Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence.

Explanation

Correct Answers

C:

Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate CNF and FortiGate VM have different deployment and management responsibilities; creating a cloud service object does not force every VPC flow through it. The corresponding action is: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. This is the verification portion of the required complementary pair. Scenario: A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration.

D:

Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. This directly addresses the FortiOS configuration or response required by the case. FortiGate CNF and FortiGate VM have different deployment and management responsibilities; creating a cloud service object does not force every VPC flow through it. Verify with: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. This is the implementation portion of the required complementary pair. Scenario: A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration.

Incorrect Answers

A:

Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. This choice relates to FortiGate VM in public-cloud route and interface topology, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration.

B:

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This choice relates to Cloud FortiGate licensing and infrastructure ownership boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration.

E:

Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence. This choice relates to FortiSASE endpoint onboarding and identity-bound access, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A security architect buys a cloud-native firewall subscription and assumes FortiGate CNF immediately inspects all application subnets without any account onboarding or routing integration.

Question 146

A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic.
  2. Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps.
  3. Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs.
  4. Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces.

Explanation

Correct Answer

C:

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This distinguishes the relevant FortiGate device, session or controller evidence. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. The corresponding action is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

Incorrect Answers

A:

Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. This diagnostic is related to IPsec multi-subnet protection and routed prefix changes rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

B:

Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. This diagnostic is related to FortiAnalyzer registration and centralized log forwarding rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

D:

Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. This diagnostic is related to Routing table and reverse-path asymmetric connectivity analysis rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: A retail kiosk obtains a new public IP every week and its central FortiGate VPN fails because the gateway is configured as a fixed address.

Question 147

A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.
  2. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  3. Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities.
  4. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
  5. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.

Explanation

Correct Answers

B:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This distinguishes the relevant FortiGate device, session or controller evidence. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. The corresponding action is: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This is the verification portion of the required complementary pair. Scenario: A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected.

E:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This directly addresses the FortiOS configuration or response required by the case. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. Verify with: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This is the implementation portion of the required complementary pair. Scenario: A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected.

Incorrect Answers

A:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected.

C:

Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. This choice relates to FortiGate deep-inspection CA trust and certificate deployment, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected.

D:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This choice relates to FortiGuard category ratings and controlled recategorization, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A client suppresses useful TLS hostname information and a certificate-based web profile cannot classify the requested domain as precisely as expected.

Question 148

A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility.
  2. Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs.
  3. Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope.
  4. Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history.

Explanation

Correct Answer

C:

Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. This distinguishes the relevant FortiGate device, session or controller evidence. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. The corresponding action is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

Incorrect Answers

A:

Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. This diagnostic is related to Application category filters and application-specific enforcement rather than the controlling evidence for this scenario. Examine instead: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

B:

Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. This diagnostic is related to Static URL filter ordering and wildcard match behavior rather than the controlling evidence for this scenario. Examine instead: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

D:

Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This diagnostic is related to Application control incident logging and false positive investigation rather than the controlling evidence for this scenario. Examine instead: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: A team uses stale signatures on an isolated firewall and claims it can reliably identify the latest collaboration application protocols without FortiGuard updates.

Question 149

A web-filter profile is assigned to a policy that never matches the relevant source interface, so category blocks appear ineffective even though the profile itself is enabled. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records.
  2. Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs.
  3. Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages.
  4. Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets.

Explanation

Correct Answer

A:

Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This distinguishes the relevant FortiGate device, session or controller evidence. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. The corresponding action is: Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. Scenario: A web-filter profile is assigned to a policy that never matches the relevant source interface, so category blocks appear ineffective even though the profile itself is enabled.

Incorrect Answers

B:

Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. This diagnostic is related to FSSO troubleshooting and authentication connector health rather than the controlling evidence for this scenario. Examine instead: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: A web-filter profile is assigned to a policy that never matches the relevant source interface, so category blocks appear ineffective even though the profile itself is enabled.

C:

Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This diagnostic is related to Firewall policy evaluation order, interfaces and least privilege rather than the controlling evidence for this scenario. Examine instead: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: A web-filter profile is assigned to a policy that never matches the relevant source interface, so category blocks appear ineffective even though the profile itself is enabled.

D:

Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This diagnostic is related to NAT hairpin and internal use of public VIP names rather than the controlling evidence for this scenario. Examine instead: Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. Scenario: A web-filter profile is assigned to a policy that never matches the relevant source interface, so category blocks appear ineffective even though the profile itself is enabled.

Question 150

A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope.
  2. Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy.
  3. Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry.
  4. Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics.

Explanation

Correct Answer

A:

Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate CNF and FortiGate VM have different deployment and management responsibilities; creating a cloud service object does not force every VPC flow through it. The corresponding action is: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

Incorrect Answers

B:

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This diagnostic is related to Cloud FortiGate licensing and infrastructure ownership boundaries rather than the controlling evidence for this scenario. Examine instead: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

C:

Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. This diagnostic is related to FortiGate VM in public-cloud route and interface topology rather than the controlling evidence for this scenario. Examine instead: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

D:

Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. This diagnostic is related to Configuration backups and controlled FortiOS firmware changes rather than the controlling evidence for this scenario. Examine instead: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests