cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 3

Question 20

A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable.
  2. Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded.
  3. Traffic uses the alternative route when the monitored upstream path fails, and the preferred path returns without oscillating under the configured hold-down policy.
  4. The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic.

Explanation

Correct Answer

A:

The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. This is the operational validation outcome rather than merely an enabled setting. Two equal prefixes are not necessarily equally preferred if their administrative distances or priority differ; ECMP can distribute sessions rather than guaranteeing one preferred path. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

Incorrect Answers

B:

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This result would test SD-WAN implicit rules, failover decisions and session persistence but does not demonstrate the desired FortiGate outcome here. Verify instead: The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

C:

Traffic uses the alternative route when the monitored upstream path fails, and the preferred path returns without oscillating under the configured hold-down policy. This result would test Link monitoring and static route failover triggers but does not demonstrate the desired FortiGate outcome here. Verify instead: The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

D:

The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. This result would test SD-WAN interactions with firewall policies and source-specific routes but does not demonstrate the desired FortiGate outcome here. Verify instead: The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

Question 21

An analyst believes a policy has zero traffic because its hit counter was reset after an upgrade, ignoring current session logs and the time window. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic.
  2. Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic.
  3. A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy.
  4. A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies.

Explanation

Correct Answer

B:

Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. This is the operational validation outcome rather than merely an enabled setting. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. Scenario: An analyst believes a policy has zero traffic because its hit counter was reset after an upgrade, ignoring current session logs and the time window.

Incorrect Answers

A:

The intended sessions are allowed or blocked according to policy and the required supported threat inspection actually runs on their traffic. This result would test Security profiles and flow versus proxy inspection boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: An analyst believes a policy has zero traffic because its hit counter was reset after an upgrade, ignoring current session logs and the time window.

C:

A test flow shows symmetric forward and return tuples, correct NAT mappings and stable application transactions through the intended policy. This result would test Diagnosing translated session return path and policy NAT mismatches but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: An analyst believes a policy has zero traffic because its hit counter was reset after an upgrade, ignoring current session logs and the time window.

D:

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This result would test LDAP remote user integration over trusted TLS but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: An analyst believes a policy has zero traffic because its hit counter was reset after an upgrade, ignoring current session logs and the time window.

Question 22

After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy.
  2. Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery.
  3. New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows.
  4. Examine policy route order and matches, routing table lookup, SD-WAN policy context, session source tuple, chosen egress and debug-flow output.
  5. Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history.

Explanation

Correct Answers

B:

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This directly addresses the FortiOS configuration or response required by the case. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. Verify with: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. This is the implementation portion of the required complementary pair. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

E:

Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. This distinguishes the relevant FortiGate device, session or controller evidence. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. The corresponding action is: Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This is the verification portion of the required complementary pair. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Incorrect Answers

A:

Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. This choice relates to SD-WAN interactions with firewall policies and source-specific routes, not the complementary implementation-and-evidence pair for the case. Implement: Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. Check: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

C:

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This choice relates to Routing table and reverse-path asymmetric connectivity analysis, not the complementary implementation-and-evidence pair for the case. Implement: Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. Check: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

D:

Examine policy route order and matches, routing table lookup, SD-WAN policy context, session source tuple, chosen egress and debug-flow output. This choice relates to Policy routes versus destination routing and session steering, not the complementary implementation-and-evidence pair for the case. Implement: Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. Check: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Question 23

A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies.
  2. Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes.
  3. Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics.
  4. The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked.

Explanation

Correct Answer

C:

Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. This is the operational validation outcome rather than merely an enabled setting. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Incorrect Answers

A:

Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This result would test FSSO collector agent and domain-controller event acquisition but does not demonstrate the desired FortiGate outcome here. Verify instead: Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

B:

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This result would test Address and service objects, interface zones, and policy scoping but does not demonstrate the desired FortiGate outcome here. Verify instead: Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

D:

The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked. This result would test VIP destination NAT and published server policies but does not demonstrate the desired FortiGate outcome here. Verify instead: Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Question 24

A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.
  2. Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model.
  3. Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions.
  4. Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration.
  5. Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan.

Explanation

Correct Answers

A:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The corresponding action is: Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This is the verification portion of the required complementary pair. Scenario: A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity.

D:

Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This directly addresses the FortiOS configuration or response required by the case. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. Verify with: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This is the implementation portion of the required complementary pair. Scenario: A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity.

Incorrect Answers

B:

Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model. This choice relates to FortiGate cloud-native firewall CNF service responsibility, not the complementary implementation-and-evidence pair for the case. Implement: Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. Check: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity.

C:

Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. This choice relates to FortiGate memory pressure and conserve-mode diagnosis, not the complementary implementation-and-evidence pair for the case. Implement: Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. Check: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity.

E:

Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. This choice relates to Configuration backups and controlled FortiOS firmware changes, not the complementary implementation-and-evidence pair for the case. Implement: Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. Check: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: A newly provisioned FortiGate hands out client IP addresses, but antivirus signatures remain stale because the appliance lacks reliable DNS and FortiGuard service connectivity.

Question 25

A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics.
  2. Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation.
  3. Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel.
  4. An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups.
  5. Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes.

Explanation

Correct Answers

A:

Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. This distinguishes the relevant FortiGate device, session or controller evidence. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. The corresponding action is: Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This is the verification portion of the required complementary pair. Scenario: A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source.

C:

Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This directly addresses the FortiOS configuration or response required by the case. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. Verify with: Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. This is the implementation portion of the required complementary pair. Scenario: A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source.

Incorrect Answers

B:

Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation. This choice relates to Certificate-based IPsec authentication and safe tunnel rekey, not the complementary implementation-and-evidence pair for the case. Implement: Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. Check: Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. Scenario: A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source.

D:

An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups. This choice relates to FortiGuard category ratings and controlled recategorization, not the complementary implementation-and-evidence pair for the case. Implement: Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. Check: Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. Scenario: A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source.

E:

Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. This choice relates to Phase 2 selectors, PFS and encryption lifecycle, not the complementary implementation-and-evidence pair for the case. Implement: Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. Check: Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. Scenario: A site-to-site VPN starts translating every branch source address to the WAN IP, causing the remote firewall's protected-subnet policy to reject the changed source.

Question 26

An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows.
  2. Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route.
  3. Voice or business transactions follow eligible links meeting their defined SLA while bulk traffic uses permitted alternatives without starving priority services.
  4. The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic.

Explanation

Correct Answer

B:

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This is the operational validation outcome rather than merely an enabled setting. An installed firewall policy cannot supply a missing route; administrative distance, route status and usable next-hop reachability affect forwarding. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Incorrect Answers

A:

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This result would test Routing table and reverse-path asymmetric connectivity analysis but does not demonstrate the desired FortiGate outcome here. Verify instead: Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

C:

Voice or business transactions follow eligible links meeting their defined SLA while bulk traffic uses permitted alternatives without starving priority services. This result would test SD-WAN application steering by performance SLA thresholds but does not demonstrate the desired FortiGate outcome here. Verify instead: Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

D:

The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. This result would test SD-WAN interactions with firewall policies and source-specific routes but does not demonstrate the desired FortiGate outcome here. Verify instead: Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Question 27

An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.
  2. Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums.
  3. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.
  4. Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics.

Explanation

Correct Answer

D:

Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. This distinguishes the relevant FortiGate device, session or controller evidence. A configuration backup is not a device image, and skipping an intermediate vendor-supported upgrade step can change feature behavior or render settings incompatible. The corresponding action is: Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

Incorrect Answers

A:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This diagnostic is related to Reserved HA management, monitoring and firmware upgrades rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

B:

Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums. This diagnostic is related to FGCP cluster heartbeat, synchronization and election settings rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

C:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

Question 28

A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state.
  2. Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route.
  3. Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs.
  4. Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages.

Explanation

Correct Answer

C:

Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. This distinguishes the relevant FortiGate device, session or controller evidence. A firewall policy allowing any user is an unsafe substitute for repairing a failed identity collector; authentication is a separate dependency from packet route reachability. The corresponding action is: Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

Incorrect Answers

A:

Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This diagnostic is related to FSSO collector agent and domain-controller event acquisition rather than the controlling evidence for this scenario. Examine instead: Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

B:

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This diagnostic is related to VIP destination NAT and published server policies rather than the controlling evidence for this scenario. Examine instead: Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

D:

Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This diagnostic is related to Firewall policy evaluation order, interfaces and least privilege rather than the controlling evidence for this scenario. Examine instead: Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

Question 29

A conferencing app moves from standard HTTPS to an alternative UDP port and an administrator assumes the firewall service object alone will identify the application correctly. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports.
  2. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
  3. Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating.
  4. Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies.

Explanation

Correct Answer

A:

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This directly addresses the FortiOS configuration or response required by the case. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. Verify with: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: A conferencing app moves from standard HTTPS to an alternative UDP port and an administrator assumes the firewall service object alone will identify the application correctly.

Incorrect Answers

B:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This addresses FortiGuard category ratings and controlled recategorization, but not the principal task of the described flow. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A conferencing app moves from standard HTTPS to an alternative UDP port and an administrator assumes the firewall service object alone will identify the application correctly.

C:

Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. This addresses Application control monitor versus block actions and exceptions, but not the principal task of the described flow. A monitor action records detections but is not a deny; globally blocking all unknown applications can disrupt legitimate services and requires risk-based exceptions. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A conferencing app moves from standard HTTPS to an alternative UDP port and an administrator assumes the firewall service object alone will identify the application correctly.

D:

Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies. This addresses FortiGate certificate inspection versus full SSL/SSH inspection, but not the principal task of the described flow. Certificate-only inspection cannot read encrypted HTTP payloads; full SSL inspection introduces endpoint trust, protocol compatibility and privacy considerations. The better fit is: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Scenario: A conferencing app moves from standard HTTPS to an alternative UDP port and an administrator assumes the firewall service object alone will identify the application correctly.

Question 30

A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  2. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  3. Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations.
  4. Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded.
  5. The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails.

Explanation

Correct Answers

B:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This distinguishes the relevant FortiGate device, session or controller evidence. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The corresponding action is: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This is the verification portion of the required complementary pair. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

D:

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This directly addresses the FortiOS configuration or response required by the case. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. Verify with: Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This is the implementation portion of the required complementary pair. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

Incorrect Answers

A:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This choice relates to Policy traffic log interpretation and diagnostic event filtering, not the complementary implementation-and-evidence pair for the case. Implement: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Check: Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

C:

Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. This choice relates to FortiAnalyzer registration and centralized log forwarding, not the complementary implementation-and-evidence pair for the case. Implement: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Check: Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

E:

The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails. This choice relates to Configuration backups and controlled FortiOS firmware changes, not the complementary implementation-and-evidence pair for the case. Implement: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Check: Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests