Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. This diagnostic is related to Application category filters and application-specific enforcement rather than the controlling evidence for this scenario. Examine instead: Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This diagnostic is related to FortiGuard antivirus signature freshness and incident response rather than the controlling evidence for this scenario. Examine instead: Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. This addresses FortiGate cloud-native firewall CNF service responsibility, but not the principal task of the described flow. FortiGate CNF and FortiGate VM have different deployment and management responsibilities; creating a cloud service object does not force every VPC flow through it. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This addresses IPsec multi-subnet protection and routed prefix changes, but not the principal task of the described flow. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This addresses Dialup IPsec dynamic peer identification and authentication, but not the principal task of the described flow. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint. This result would test FSSO user-to-IP identity across DHCP and shared networks but does not demonstrate the desired FortiGate outcome here. Verify instead: Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. Scenario: A collector service loses permissions to read necessary Windows logon events, leaving workstation browsing functional but identity-based policies unable to recognize users.

Access succeeds only for the intended group during its authorized time period, while expired sessions and newly unauthorized flows behave predictably. This result would test Schedule, authenticated groups and policy-specific change control but does not demonstrate the desired FortiGate outcome here. Verify instead: Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. Scenario: A collector service loses permissions to read necessary Windows logon events, leaving workstation browsing functional but identity-based policies unable to recognize users.

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This result would test FSSO group filters and AD membership reconciliation but does not demonstrate the desired FortiGate outcome here. Verify instead: Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. Scenario: A collector service loses permissions to read necessary Windows logon events, leaving workstation browsing functional but identity-based policies unable to recognize users.

Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model. This result would test FortiGate cloud-native firewall CNF service responsibility but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. This result would test FortiGate VM in public-cloud route and interface topology but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

Traffic and system events appear under the correct device identity in FortiAnalyzer with searchable timestamps and appropriate retention. This result would test FortiAnalyzer registration and centralized log forwarding but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A FortiGate-VM replacement boots successfully but its virtual license is unassigned, leaving expected security subscriptions unavailable to production policies.

Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. This addresses Policy NAT source translation and IP pool selection, but not the principal task of the described flow. NAT is address translation, not a permit decision; a working outbound policy still needs correct return routing and enough translated addresses and ports. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Trace FortiGate SNAT and DNAT changes alongside policy decision and route choice to correct sessions that translate properly outbound but fail on the reverse path. This addresses Diagnosing translated session return path and policy NAT mismatches, but not the principal task of the described flow. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This addresses FSSO collector agent and domain-controller event acquisition, but not the principal task of the described flow. FSSO identifies users from login events rather than interrogating the user at every new TCP connection; a broken collector can leave stale or missing identities. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Check RADIUS server address and UDP ports, shared secret, source IP, request logs, returned group attributes, timeout, MFA challenge capability and user policy. This diagnostic is related to RADIUS authentication and policy-bound MFA validation rather than the controlling evidence for this scenario. Examine instead: Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. Scenario: A directory team changes the service bind account password, leaving local administrator login working while LDAP-backed firewall access stops for employees.

Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. This diagnostic is related to FSSO troubleshooting and authentication connector health rather than the controlling evidence for this scenario. Examine instead: Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. Scenario: A directory team changes the service bind account password, leaving local administrator login working while LDAP-backed firewall access stops for employees.

Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. This diagnostic is related to Active versus passive FortiGate authentication evidence rather than the controlling evidence for this scenario. Examine instead: Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. Scenario: A directory team changes the service bind account password, leaving local administrator login working while LDAP-backed firewall access stops for employees.

Examine policy route order and matches, routing table lookup, SD-WAN policy context, session source tuple, chosen egress and debug-flow output. This choice relates to Policy routes versus destination routing and session steering, not the complementary implementation-and-evidence pair for the case. Implement: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Check: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

Traffic uses the alternative route when the monitored upstream path fails, and the preferred path returns without oscillating under the configured hold-down policy. This choice relates to Link monitoring and static route failover triggers, not the complementary implementation-and-evidence pair for the case. Implement: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Check: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This choice relates to SD-WAN implicit rules, failover decisions and session persistence, not the complementary implementation-and-evidence pair for the case. Implement: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Check: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

Traffic and system events appear under the correct device identity in FortiAnalyzer with searchable timestamps and appropriate retention. This result would test FortiAnalyzer registration and centralized log forwarding but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A VM scale change introduces larger traffic loads but no capacity study, and operators blame firewall signatures when the underlying cloud instance saturates its network limits.

Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. This result would test FortiGate VM in public-cloud route and interface topology but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A VM scale change introduces larger traffic loads but no capacity study, and operators blame firewall signatures when the underlying cloud instance saturates its network limits.

Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. This result would test FortiSASE PoP policy steering and remote diagnostics but does not demonstrate the desired FortiGate outcome here. Verify instead: The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. Scenario: A VM scale change introduces larger traffic loads but no capacity study, and operators blame firewall signatures when the underlying cloud instance saturates its network limits.

Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. This addresses Targeted SSL inspection exclusions and privacy controls, but not the principal task of the described flow. Broad category-level SSL exemptions can create large visibility gaps; an exception should be limited to the actual affected flow and justified by policy. The better fit is: Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. This addresses DNS filtering versus web filtering visibility boundaries, but not the principal task of the described flow. DNS filtering acts on DNS lookups, not arbitrary HTTP URL paths or already established IP connections, and encrypted DNS may bypass poorly placed resolver controls. The better fit is: Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This addresses FortiGuard category ratings and controlled recategorization, but not the principal task of the described flow. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The better fit is: Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This choice relates to Cloud FortiGate licensing and infrastructure ownership boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. This choice relates to FortiGate VM in public-cloud route and interface topology, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

The specific CPU bottleneck is identified and mitigated without blindly disabling critical security inspection or changing every firewall policy. This choice relates to CPU process health and abnormal-load troubleshooting, not the complementary implementation-and-evidence pair for the case. Implement: Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. Check: Compare FortiGate CNF onboarding, cloud account permissions, policy targets, networking integration, logging endpoints, deployment region and licensed service scope. Scenario: A company plans to patch the operating system of a managed FortiGate CNF dataplane as though it had deployed its own FortiGate virtual machine.

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This addresses Routing table and reverse-path asymmetric connectivity analysis, but not the principal task of the described flow. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The better fit is: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.

Trace FortiOS policy-based routing decisions against static routes and supported SD-WAN rules, accounting for source, ingress, destination, protocol and service matches. This addresses Policy routes versus destination routing and session steering, but not the principal task of the described flow. A policy route can alter traffic steering relative to ordinary destination-route selection; changing a default static route alone may not fix sessions matched by a higher-priority PBR rule. The better fit is: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.

Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. This addresses FortiGate SD-WAN members, zones and health-check design, but not the principal task of the described flow. SD-WAN rules do not create physical connectivity or an underlay default route, and a green interface link is not proof the measured application path is healthy. The better fit is: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.