cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 40

Question 390

A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery.
  2. Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering.
  3. Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance.
  4. Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy.

Explanation

Correct Answer

B:

Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. This directly addresses the FortiOS configuration or response required by the case. Two equal prefixes are not necessarily equally preferred if their administrative distances or priority differ; ECMP can distribute sessions rather than guaranteeing one preferred path. Verify with: Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

Incorrect Answers

A:

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This addresses SD-WAN implicit rules, failover decisions and session persistence, but not the principal task of the described flow. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

C:

Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. This addresses FortiGate static default routes and interface reachability, but not the principal task of the described flow. An installed firewall policy cannot supply a missing route; administrative distance, route status and usable next-hop reachability affect forwarding. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

D:

Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. This addresses SD-WAN interactions with firewall policies and source-specific routes, but not the principal task of the described flow. Traffic must pass both policy and routing requirements; a correctly configured SD-WAN rule cannot override a denied firewall session or fix missing NAT. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A firewall has an equal-cost pair of routes but one next-hop path is unreachable, and session steering must be validated instead of relying on configuration labels alone.

Question 391

A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups.
  2. Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress.
  3. Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events.
  4. Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state.

Explanation

Correct Answer

B:

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This distinguishes the relevant FortiGate device, session or controller evidence. Traffic must pass both policy and routing requirements; a correctly configured SD-WAN rule cannot override a denied firewall session or fix missing NAT. The corresponding action is: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

Incorrect Answers

A:

Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This diagnostic is related to FortiGate static default routes and interface reachability rather than the controlling evidence for this scenario. Examine instead: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

C:

Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. This diagnostic is related to FortiGate SD-WAN members, zones and health-check design rather than the controlling evidence for this scenario. Examine instead: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

D:

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This diagnostic is related to Static route priority, administrative distance and ECMP design rather than the controlling evidence for this scenario. Examine instead: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

Question 392

A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups.
  2. Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy.
  3. Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs.
  4. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.
  5. Measure FortiOS IPS engine and appliance resource load under representative traffic before changing signature sets or SSL inspection scope, keeping protection while isolating bottlenecks.

Explanation

Correct Answers

B:

Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. This directly addresses the FortiOS configuration or response required by the case. Signature severity alone does not guarantee relevance; a disabled or monitor-only IPS rule may log threats without blocking, and encrypted payloads need appropriate inspection. Verify with: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. This is the implementation portion of the required complementary pair. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

C:

Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. This distinguishes the relevant FortiGate device, session or controller evidence. Signature severity alone does not guarantee relevance; a disabled or monitor-only IPS rule may log threats without blocking, and encrypted payloads need appropriate inspection. The corresponding action is: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. This is the verification portion of the required complementary pair. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

Incorrect Answers

A:

An incorrectly classified approved site receives a narrow documented exception while disallowed categories continue to be blocked for the intended groups. This choice relates to FortiGuard category ratings and controlled recategorization, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

D:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

E:

Measure FortiOS IPS engine and appliance resource load under representative traffic before changing signature sets or SSL inspection scope, keeping protection while isolating bottlenecks. This choice relates to IPS process CPU demand and inspection capacity, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

Question 393

Administrators test an AV policy with a harmless standardized test artifact but traffic passes because the policy matches the wrong source zone. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  2. Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility.
  3. Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history.
  4. Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs.

Explanation

Correct Answer

D:

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This distinguishes the relevant FortiGate device, session or controller evidence. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. The corresponding action is: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Scenario: Administrators test an AV policy with a harmless standardized test artifact but traffic passes because the policy matches the wrong source zone.

Incorrect Answers

A:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This diagnostic is related to Antivirus profile scanning modes and supported protocol boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: Administrators test an AV policy with a harmless standardized test artifact but traffic passes because the policy matches the wrong source zone.

B:

Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. This diagnostic is related to Application category filters and application-specific enforcement rather than the controlling evidence for this scenario. Examine instead: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: Administrators test an AV policy with a harmless standardized test artifact but traffic passes because the policy matches the wrong source zone.

C:

Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This diagnostic is related to Application control incident logging and false positive investigation rather than the controlling evidence for this scenario. Examine instead: Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. Scenario: Administrators test an AV policy with a harmless standardized test artifact but traffic passes because the policy matches the wrong source zone.

Question 394

An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline.
  2. Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes.
  3. Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs.
  4. Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs.

Explanation

Correct Answer

D:

Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This distinguishes the relevant FortiGate device, session or controller evidence. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The corresponding action is: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

Incorrect Answers

A:

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

B:

Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes. This diagnostic is related to DNS filtering versus web filtering visibility boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

C:

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This diagnostic is related to FortiGate deep-inspection CA trust and certificate deployment rather than the controlling evidence for this scenario. Examine instead: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: An internal API requires a client certificate for mutual TLS, but deep inspection substitutes an intermediate identity and application authentication fails after the TCP connection succeeds.

Question 395

The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups.
  2. Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded.
  3. Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance.
  4. Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure.
  5. Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress.

Explanation

Correct Answers

A:

Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This distinguishes the relevant FortiGate device, session or controller evidence. An installed firewall policy cannot supply a missing route; administrative distance, route status and usable next-hop reachability affect forwarding. The corresponding action is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. This is the verification portion of the required complementary pair. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

C:

Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. This directly addresses the FortiOS configuration or response required by the case. An installed firewall policy cannot supply a missing route; administrative distance, route status and usable next-hop reachability affect forwarding. Verify with: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This is the implementation portion of the required complementary pair. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

Incorrect Answers

B:

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This choice relates to SD-WAN implicit rules, failover decisions and session persistence, not the complementary implementation-and-evidence pair for the case. Implement: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Check: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

D:

Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. This choice relates to Link monitoring and static route failover triggers, not the complementary implementation-and-evidence pair for the case. Implement: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Check: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

E:

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This choice relates to SD-WAN interactions with firewall policies and source-specific routes, not the complementary implementation-and-evidence pair for the case. Implement: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Check: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

Question 396

A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests.
  2. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  3. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  4. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.

Explanation

Correct Answer

B:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This distinguishes the relevant FortiGate device, session or controller evidence. An antivirus profile can only scan content visible in its inspection path and within supported protocol or size limits; a scanner configured but unattached is ineffective. The corresponding action is: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

Incorrect Answers

A:

Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This diagnostic is related to Oversized transfer handling and antivirus inspection limits rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

C:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

D:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

Question 397

Two FortiGates show a green IPsec tunnel but branch users cannot reach head-office servers because no static route targets the tunnel interface. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route.
  2. Traffic between the intended protected subnet pairs installs valid child security associations and rekeys without repeated interruptions.
  3. Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT.
  4. Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic.

Explanation

Correct Answer

C:

Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. This is the operational validation outcome rather than merely an enabled setting. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. Scenario: Two FortiGates show a green IPsec tunnel but branch users cannot reach head-office servers because no static route targets the tunnel interface.

Incorrect Answers

A:

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This result would test FortiGate static default routes and interface reachability but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: Two FortiGates show a green IPsec tunnel but branch users cannot reach head-office servers because no static route targets the tunnel interface.

B:

Traffic between the intended protected subnet pairs installs valid child security associations and rekeys without repeated interruptions. This result would test Phase 2 selectors, PFS and encryption lifecycle but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: Two FortiGates show a green IPsec tunnel but branch users cannot reach head-office servers because no static route targets the tunnel interface.

D:

Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. This result would test Implicit denial, policy logging and rule hit interpretation but does not demonstrate the desired FortiGate outcome here. Verify instead: Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. Scenario: Two FortiGates show a green IPsec tunnel but branch users cannot reach head-office servers because no static route targets the tunnel interface.

Question 398

The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies.
  2. Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open.
  3. Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible.
  4. Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures.

Explanation

Correct Answer

C:

Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. This directly addresses the FortiOS configuration or response required by the case. A single application signature hit may be insufficient to prove a user deliberately launched that program; classification and encrypted traffic can be imperfect. Verify with: Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

Incorrect Answers

A:

Choose certificate-only or supported deep SSL/SSH inspection according to required visibility and data-handling policy, assigning the correct profile to matching firewall policies. This addresses FortiGate certificate inspection versus full SSL/SSH inspection, but not the principal task of the described flow. Certificate-only inspection cannot read encrypted HTTP payloads; full SSL inspection introduces endpoint trust, protocol compatibility and privacy considerations. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

B:

Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. This addresses Oversized transfer handling and antivirus inspection limits, but not the principal task of the described flow. An allowed oversize bypass can create a malware scanning gap even though the AV profile is enabled for smaller files; archive depth changes effective inspection capability. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

D:

Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. This addresses Application category filters and application-specific enforcement, but not the principal task of the described flow. Blocking an entire application category can affect unrelated products; an application signature policy may need specific exceptions and protocol inspection support. The better fit is: Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. Scenario: The same business SaaS is categorized differently after an update, but the change-control record contains no policy or signature version information.

Question 399

A static URL exception is placed above an existing category restriction and users can visit unrelated pages through the excepted domain. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes.
  2. Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs.
  3. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  4. Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs.

Explanation

Correct Answer

D:

Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. This distinguishes the relevant FortiGate device, session or controller evidence. A URL allow or exempt entry can take precedence over broader classification checks; HTTPS inspection depth determines whether path-level matching is feasible. The corresponding action is: Define targeted FortiGate static URL allow, block or monitor entries with explicit ordering and pattern semantics, avoiding wildcard rules that unintentionally override category controls. Scenario: A static URL exception is placed above an existing category restriction and users can visit unrelated pages through the excepted domain.

Incorrect Answers

A:

Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes. This diagnostic is related to DNS filtering versus web filtering visibility boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. Scenario: A static URL exception is placed above an existing category restriction and users can visit unrelated pages through the excepted domain.

B:

Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This diagnostic is related to TLS and mutual-certificate handshake fault isolation rather than the controlling evidence for this scenario. Examine instead: Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. Scenario: A static URL exception is placed above an existing category restriction and users can visit unrelated pages through the excepted domain.

C:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This diagnostic is related to Antivirus profile scanning modes and supported protocol boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. Scenario: A static URL exception is placed above an existing category restriction and users can visit unrelated pages through the excepted domain.

Question 400

An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility.
  2. Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results.
  3. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  4. Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics.

Explanation

Correct Answer

B:

Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. This distinguishes the relevant FortiGate device, session or controller evidence. Two configured tunnels do not guarantee failover if their routes or peer liveness are incorrect; DPD detects peer unavailability but is not a substitute for end-to-end application validation. The corresponding action is: Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

Incorrect Answers

A:

Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. This diagnostic is related to Application category filters and application-specific enforcement rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

C:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

D:

Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. This diagnostic is related to Certificate-based IPsec authentication and safe tunnel rekey rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests