Fortinet FCP_FGT_AD-7.6 Practice Test 19
Question 180
A web server runs a vulnerable service but its FortiGate inbound rule lacks the IPS profile, so the vulnerability scan produces no corresponding IPS events. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?
- Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
- Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures.
- Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides.
- Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy.
Explanation
Correct Answer
D:Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. This directly addresses the FortiOS configuration or response required by the case. Signature severity alone does not guarantee relevance; a disabled or monitor-only IPS rule may log threats without blocking, and encrypted payloads need appropriate inspection. Verify with: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A web server runs a vulnerable service but its FortiGate inbound rule lacks the IPS profile, so the vulnerability scan produces no corresponding IPS events.
Incorrect Answers
A:Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Scenario: A web server runs a vulnerable service but its FortiGate inbound rule lacks the IPS profile, so the vulnerability scan produces no corresponding IPS events.
B:Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. This addresses Application category filters and application-specific enforcement, but not the principal task of the described flow. Blocking an entire application category can affect unrelated products; an application signature policy may need specific exceptions and protocol inspection support. The better fit is: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Scenario: A web server runs a vulnerable service but its FortiGate inbound rule lacks the IPS profile, so the vulnerability scan produces no corresponding IPS events.
C:Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides. This addresses IPS signatures, logs and focused exception maintenance, but not the principal task of the described flow. An IPS exemption by broad source subnet or application category may remove protection beyond one false positive; signature updates can change what matches. The better fit is: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Scenario: A web server runs a vulnerable service but its FortiGate inbound rule lacks the IPS profile, so the vulnerability scan produces no corresponding IPS events.
Question 181
A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.
- Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required.
- Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets.
- Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access.
- Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs.
- Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered.
Explanation
Correct Answers
A:Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This directly addresses the FortiOS configuration or response required by the case. Hairpin NAT can require specific policy and routing considerations; a public VIP that works from the internet is not proof an inside client using the same name will work. Verify with: Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This is the implementation portion of the required complementary pair. Scenario: A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing.
B:Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This distinguishes the relevant FortiGate device, session or controller evidence. Hairpin NAT can require specific policy and routing considerations; a public VIP that works from the internet is not proof an inside client using the same name will work. The corresponding action is: Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This is the verification portion of the required complementary pair. Scenario: A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing.
Incorrect Answers
C:Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access. This choice relates to Active versus passive FortiGate authentication evidence, not the complementary implementation-and-evidence pair for the case. Implement: Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. Check: Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. Scenario: A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing.
D:Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This choice relates to FSSO user-to-IP identity across DHCP and shared networks, not the complementary implementation-and-evidence pair for the case. Implement: Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. Check: Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. Scenario: A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing.
E:Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. This choice relates to Policy NAT source translation and IP pool selection, not the complementary implementation-and-evidence pair for the case. Implement: Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. Check: Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. Scenario: A team creates a broad source NAT rule to fix a hairpin problem and unintentionally rewrites unrelated internal application source addresses used for auditing.
Question 182
Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.
- Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route.
- Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints.
- Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic.
- Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state.
- Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered.
Explanation
Correct Answers
A:Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. This distinguishes the relevant FortiGate device, session or controller evidence. NAT is address translation, not a permit decision; a working outbound policy still needs correct return routing and enough translated addresses and ports. The corresponding action is: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. This is the verification portion of the required complementary pair. Scenario: Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports.
E:Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. This directly addresses the FortiOS configuration or response required by the case. NAT is address translation, not a permit decision; a working outbound policy still needs correct return routing and enough translated addresses and ports. Verify with: Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. This is the implementation portion of the required complementary pair. Scenario: Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports.
Incorrect Answers
B:Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This choice relates to VIP destination NAT and published server policies, not the complementary implementation-and-evidence pair for the case. Implement: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Check: Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. Scenario: Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports.
C:Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. This choice relates to Implicit denial, policy logging and rule hit interpretation, not the complementary implementation-and-evidence pair for the case. Implement: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Check: Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. Scenario: Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports.
D:Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Check: Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. Scenario: Many clients share a limited outgoing NAT address and a burst of short-lived connections exhausts the available source ports.
Question 183
A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?
- The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic.
- The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic.
- The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection.
- Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links.
Explanation
Correct Answer
D:Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. This is the operational validation outcome rather than merely an enabled setting. An SD-WAN member rule may select a physical underlay without providing the encrypted overlay route; policy, tunnel health and overlay steering are distinct dependencies. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.
Incorrect Answers
A:The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic. This result would test Security profiles and flow versus proxy inspection boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.
B:The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. This result would test IKE and IPsec debug evidence for Phase 1 versus child-SA failures but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.
C:The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection. This result would test HTTPS web filtering hostname limitations and logging but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A team adds a VPN tunnel interface into an SD-WAN zone but forgets that the corresponding LAN-to-VPN firewall policy must reference the intended zone.
Question 184
After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration. Which diagnostic evidence should the FortiGate administrator check FIRST?
- Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details.
- Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output.
- Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps.
- Check RADIUS server address and UDP ports, shared secret, source IP, request logs, returned group attributes, timeout, MFA challenge capability and user policy.
Explanation
Correct Answer
C:Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. This distinguishes the relevant FortiGate device, session or controller evidence. A captive portal requires appropriate traffic interception, browser/TLS behavior and a valid identity mapping; it is not activated merely by naming a user group in a firewall address object. The corresponding action is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
Incorrect Answers
A:Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This diagnostic is related to Implicit denial, policy logging and rule hit interpretation rather than the controlling evidence for this scenario. Examine instead: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
B:Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. This diagnostic is related to LDAP remote user integration over trusted TLS rather than the controlling evidence for this scenario. Examine instead: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
D:Check RADIUS server address and UDP ports, shared secret, source IP, request logs, returned group attributes, timeout, MFA challenge capability and user policy. This diagnostic is related to RADIUS authentication and policy-bound MFA validation rather than the controlling evidence for this scenario. Examine instead: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
Question 185
After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?
- Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies.
- Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access.
- Authorized users receive the intended group or MFA result and unauthorized or unavailable-server attempts fail according to explicit policy.
- Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources.
Explanation
Correct Answer
D:Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This is the operational validation outcome rather than merely an enabled setting. A captive portal requires appropriate traffic interception, browser/TLS behavior and a valid identity mapping; it is not activated merely by naming a user group in a firewall address object. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
Incorrect Answers
A:Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This result would test FSSO collector agent and domain-controller event acquisition but does not demonstrate the desired FortiGate outcome here. Verify instead: Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
B:Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access. This result would test Active versus passive FortiGate authentication evidence but does not demonstrate the desired FortiGate outcome here. Verify instead: Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
C:Authorized users receive the intended group or MFA result and unauthorized or unavailable-server attempts fail according to explicit policy. This result would test RADIUS authentication and policy-bound MFA validation but does not demonstrate the desired FortiGate outcome here. Verify instead: Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.
Question 186
An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?
- The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked.
- A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected.
- The tunnel negotiates and maintains encrypted traffic across the approved NAT boundary without untracked port remapping or blocked IKE packets.
- Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links.
Explanation
Correct Answer
B:A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected. This is the operational validation outcome rather than merely an enabled setting. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.
Incorrect Answers
A:The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked. This result would test VIP destination NAT and published server policies but does not demonstrate the desired FortiGate outcome here. Verify instead: A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.
C:The tunnel negotiates and maintains encrypted traffic across the approved NAT boundary without untracked port remapping or blocked IKE packets. This result would test IPsec NAT traversal with upstream address translation but does not demonstrate the desired FortiGate outcome here. Verify instead: A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.
D:Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. This result would test SD-WAN IPsec overlay routing and tunnel path choice but does not demonstrate the desired FortiGate outcome here. Verify instead: A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.
Question 187
A DNAT mapping successfully sends SYN packets to the server, but its response leaves through a second FortiGate that has no state for the translated flow. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?
- Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services.
- Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably.
- Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes.
- A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy.
Explanation
Correct Answer
D:A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. This is the operational validation outcome rather than merely an enabled setting. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. Scenario: A DNAT mapping successfully sends SYN packets to the server, but its response leaves through a second FortiGate that has no state for the translated flow.
Incorrect Answers
A:Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This result would test NAT hairpin and internal use of public VIP names but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: A DNAT mapping successfully sends SYN packets to the server, but its response leaves through a second FortiGate that has no state for the translated flow.
B:Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. This result would test Schedule, authenticated groups and policy-specific change control but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: A DNAT mapping successfully sends SYN packets to the server, but its response leaves through a second FortiGate that has no state for the translated flow.
C:Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This result would test Address and service objects, interface zones, and policy scoping but does not demonstrate the desired FortiGate outcome here. Verify instead: A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. Scenario: A DNAT mapping successfully sends SYN packets to the server, but its response leaves through a second FortiGate that has no state for the translated flow.
Question 188
An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?
- Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate.
- Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports.
- Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
- Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating.
Explanation
Correct Answer
D:Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. This directly addresses the FortiOS configuration or response required by the case. A monitor action records detections but is not a deny; globally blocking all unknown applications can disrupt legitimate services and requires risk-based exceptions. Verify with: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.
Incorrect Answers
A:Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This addresses FortiGate deep-inspection CA trust and certificate deployment, but not the principal task of the described flow. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. The better fit is: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.
B:Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This addresses Application control signature matching and required visibility, but not the principal task of the described flow. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. The better fit is: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.
C:Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.
Question 189
During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?
- Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination.
- Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
- Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
- Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate.
Explanation
Correct Answer
D:Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This directly addresses the FortiOS configuration or response required by the case. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. Verify with: Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.
Incorrect Answers
A:Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. This addresses Targeted SSL inspection exclusions and privacy controls, but not the principal task of the described flow. Broad category-level SSL exemptions can create large visibility gaps; an exception should be limited to the actual affected flow and justified by policy. The better fit is: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.
B:Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This addresses HTTPS web filtering hostname limitations and logging, but not the principal task of the described flow. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. The better fit is: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.
C:Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This addresses FortiGuard category ratings and controlled recategorization, but not the principal task of the described flow. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The better fit is: Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. Scenario: During inspection CA rotation, some laptops trust only the retired CA and cannot establish HTTPS connections through the newly configured firewall profile.
Question 190
A compliance dashboard reports hundreds of file-sharing detections and the manager believes the traffic was blocked, although the application control rule is set to monitor only. Which diagnostic evidence should the FortiGate administrator check FIRST?
- Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log.
- Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record.
- Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history.
- Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests.
Explanation
Correct Answer
B:Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This distinguishes the relevant FortiGate device, session or controller evidence. A monitor action records detections but is not a deny; globally blocking all unknown applications can disrupt legitimate services and requires risk-based exceptions. The corresponding action is: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Scenario: A compliance dashboard reports hundreds of file-sharing detections and the manager believes the traffic was blocked, although the application control rule is set to monitor only.
Incorrect Answers
A:Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This diagnostic is related to FortiGuard category ratings and controlled recategorization rather than the controlling evidence for this scenario. Examine instead: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: A compliance dashboard reports hundreds of file-sharing detections and the manager believes the traffic was blocked, although the application control rule is set to monitor only.
C:Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This diagnostic is related to Application control incident logging and false positive investigation rather than the controlling evidence for this scenario. Examine instead: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: A compliance dashboard reports hundreds of file-sharing detections and the manager believes the traffic was blocked, although the application control rule is set to monitor only.
D:Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This diagnostic is related to Oversized transfer handling and antivirus inspection limits rather than the controlling evidence for this scenario. Examine instead: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: A compliance dashboard reports hundreds of file-sharing detections and the manager believes the traffic was blocked, although the application control rule is set to monitor only.
