cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 41

Question 400

An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility.
  2. Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results.
  3. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  4. Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics.

Explanation

Correct Answer

B:

Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. This distinguishes the relevant FortiGate device, session or controller evidence. Two configured tunnels do not guarantee failover if their routes or peer liveness are incorrect; DPD detects peer unavailability but is not a substitute for end-to-end application validation. The corresponding action is: Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

Incorrect Answers

A:

Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. This diagnostic is related to Application category filters and application-specific enforcement rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

C:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

D:

Check VPN certificate subject/SAN, CA trust chain, CRL availability, peer ID matching, validity dates, IKE authentication events and SA rekey statistics. This diagnostic is related to Certificate-based IPsec authentication and safe tunnel rekey rather than the controlling evidence for this scenario. Examine instead: Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. Scenario: An operations team expects every active TCP session to migrate without disruption between independent IPsec tunnels even though the application has no reconnection logic.

Question 401

After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces.
  2. An impaired member is correctly classified and a tested policy change restores traffic without hiding intermittent loss or creating new path asymmetry.
  3. Trace FortiOS policy-based routing decisions against static routes and supported SD-WAN rules, accounting for source, ingress, destination, protocol and service matches.
  4. Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate.
  5. Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events.

Explanation

Correct Answers

A:

Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. This distinguishes the relevant FortiGate device, session or controller evidence. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The corresponding action is: Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This is the verification portion of the required complementary pair. Scenario: After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies.

D:

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This directly addresses the FortiOS configuration or response required by the case. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. Verify with: Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. This is the implementation portion of the required complementary pair. Scenario: After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies.

Incorrect Answers

B:

An impaired member is correctly classified and a tested policy change restores traffic without hiding intermittent loss or creating new path asymmetry. This choice relates to SD-WAN diagnostics, route changes and link-quality evidence, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. Check: Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. Scenario: After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies.

C:

Trace FortiOS policy-based routing decisions against static routes and supported SD-WAN rules, accounting for source, ingress, destination, protocol and service matches. This choice relates to Policy routes versus destination routing and session steering, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. Check: Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. Scenario: After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies.

E:

Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. This choice relates to FortiGate SD-WAN members, zones and health-check design, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. Check: Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. Scenario: After two offices adopt overlapping RFC1918 prefixes, FortiGate routes select the wrong destination branch and administrators try to fix it by widening source policies.

Question 402

An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests.
  2. Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes.
  3. Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups.
  4. Outgoing clients appear upstream with expected translated identities, and return packets reenter a valid tracked session with no address overlap or pool exhaustion.
  5. Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic.

Explanation

Correct Answers

B:

Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This directly addresses the FortiOS configuration or response required by the case. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. Verify with: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. This is the implementation portion of the required complementary pair. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

E:

Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. This distinguishes the relevant FortiGate device, session or controller evidence. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. The corresponding action is: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This is the verification portion of the required complementary pair. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

Incorrect Answers

A:

Configure redundant FortiGate site-to-site IPsec tunnels with supported peer monitoring, link health and deterministic routing preferences, then exercise failover under controlled tests. This choice relates to Redundant tunnels, dead peer detection and controlled failover, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

C:

Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This choice relates to FortiGate static default routes and interface reachability, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

D:

Outgoing clients appear upstream with expected translated identities, and return packets reenter a valid tracked session with no address overlap or pool exhaustion. This choice relates to Policy NAT source translation and IP pool selection, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

Question 403

FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources.
  2. Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges.
  3. A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies.
  4. A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules.

Explanation

Correct Answer

D:

A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. This is the operational validation outcome rather than merely an enabled setting. A firewall policy allowing any user is an unsafe substitute for repairing a failed identity collector; authentication is a separate dependency from packet route reachability. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

Incorrect Answers

A:

Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This result would test Captive portal and explicit firewall user authentication but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

B:

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This result would test FSSO group filters and AD membership reconciliation but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

C:

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This result would test LDAP remote user integration over trusted TLS but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

Question 404

After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions.
  2. Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration.
  3. Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan.
  4. Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations.

Explanation

Correct Answer

D:

Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. This directly addresses the FortiOS configuration or response required by the case. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. Verify with: Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

Incorrect Answers

A:

Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. This addresses Policy traffic log interpretation and diagnostic event filtering, but not the principal task of the described flow. A UTM blocked-threat record and a firewall implicit-deny event are not interchangeable; absence of a traffic log may mean logging is disabled rather than that no packet arrived. The better fit is: Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

B:

Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This addresses FortiGuard connectivity, registration and internal DHCP provisioning, but not the principal task of the described flow. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The better fit is: Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

C:

Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. This addresses Configuration backups and controlled FortiOS firmware changes, but not the principal task of the described flow. A configuration backup is not a device image, and skipping an intermediate vendor-supported upgrade step can change feature behavior or render settings incompatible. The better fit is: Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. Scenario: After migration to a new management VLAN, authorized engineers lose the FortiGate GUI but ordinary web browsing through the firewall still works, suggesting a management access rather than transit policy issue.

Question 405

An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs.
  2. Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs.
  3. Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results.
  4. Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline.

Explanation

Correct Answer

A:

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This distinguishes the relevant FortiGate device, session or controller evidence. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. The corresponding action is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Incorrect Answers

B:

Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. This diagnostic is related to IPsec NAT traversal with upstream address translation rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

C:

Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. This diagnostic is related to Redundant tunnels, dead peer detection and controlled failover rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

D:

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Question 406

An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets.
  2. Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs.
  3. Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps.
  4. Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID.

Explanation

Correct Answer

D:

Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. This distinguishes the relevant FortiGate device, session or controller evidence. Passive identification relies on external identity events and IP mappings, whereas active authentication prompts or challenges a user; neither is interchangeable with plain destination IP matching. The corresponding action is: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Incorrect Answers

A:

Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets. This diagnostic is related to Diagnosing translated session return path and policy NAT mismatches rather than the controlling evidence for this scenario. Examine instead: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

B:

Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This diagnostic is related to FSSO user-to-IP identity across DHCP and shared networks rather than the controlling evidence for this scenario. Examine instead: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

C:

Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. This diagnostic is related to Captive portal and explicit firewall user authentication rather than the controlling evidence for this scenario. Examine instead: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Question 407

A FortiGate shows IKE negotiation successful but ESP outbound counters remain zero because the LAN-to-VPN policy points at the wrong tunnel interface. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic.
  2. Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability.
  3. Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it.
  4. A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked.

Explanation

Correct Answer

A:

The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. This is the operational validation outcome rather than merely an enabled setting. An IKE SA in established state does not prove any user payload crossed the tunnel, and generic ping failure can arise from routes or firewall rules after both phases succeed. Scenario: A FortiGate shows IKE negotiation successful but ESP outbound counters remain zero because the LAN-to-VPN policy points at the wrong tunnel interface.

Incorrect Answers

B:

Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. This result would test Certificate-based IPsec authentication and safe tunnel rekey but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A FortiGate shows IKE negotiation successful but ESP outbound counters remain zero because the LAN-to-VPN policy points at the wrong tunnel interface.

C:

Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. This result would test IPsec multi-subnet protection and routed prefix changes but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A FortiGate shows IKE negotiation successful but ESP outbound counters remain zero because the LAN-to-VPN policy points at the wrong tunnel interface.

D:

A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. This result would test Application control incident logging and false positive investigation but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A FortiGate shows IKE negotiation successful but ESP outbound counters remain zero because the LAN-to-VPN policy points at the wrong tunnel interface.

Question 408

A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs.
  2. Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes.
  3. Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses.
  4. Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets.
  5. Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy.

Explanation

Correct Answers

A:

Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This distinguishes the relevant FortiGate device, session or controller evidence. An IP-to-username mapping can become stale after DHCP reassignment, and many users sharing one public NAT address cannot always be distinguished by IP alone. The corresponding action is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. This is the verification portion of the required complementary pair. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

C:

Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. This directly addresses the FortiOS configuration or response required by the case. An IP-to-username mapping can become stale after DHCP reassignment, and many users sharing one public NAT address cannot always be distinguished by IP alone. Verify with: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This is the implementation portion of the required complementary pair. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Incorrect Answers

B:

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This choice relates to Address and service objects, interface zones, and policy scoping, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

D:

Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets. This choice relates to Diagnosing translated session return path and policy NAT mismatches, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

E:

Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. This choice relates to FSSO troubleshooting and authentication connector health, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Question 409

An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history.
  2. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  3. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  4. Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs.

Explanation

Correct Answer

D:

Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. This distinguishes the relevant FortiGate device, session or controller evidence. Flow-based and proxy-based features may expose different controls and troubleshooting evidence; a web filter profile cannot enforce unseen encrypted URL paths. The corresponding action is: Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

Incorrect Answers

A:

Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This diagnostic is related to Application control incident logging and false positive investigation rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

B:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

C:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This diagnostic is related to Antivirus profile scanning modes and supported protocol boundaries rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

Question 410

An operator disables LDAPS certificate verification after rotating the directory server certificate, risking credentials rather than correcting CA trust. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime.
  2. Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode.
  3. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  4. Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication.

Explanation

Correct Answer

D:

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This directly addresses the FortiOS configuration or response required by the case. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. Verify with: Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. Scenario: An operator disables LDAPS certificate verification after rotating the directory server certificate, risking credentials rather than correcting CA trust.

Incorrect Answers

A:

Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. This addresses Captive portal and explicit firewall user authentication, but not the principal task of the described flow. A captive portal requires appropriate traffic interception, browser/TLS behavior and a valid identity mapping; it is not activated merely by naming a user group in a firewall address object. The better fit is: Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. Scenario: An operator disables LDAPS certificate verification after rotating the directory server certificate, risking credentials rather than correcting CA trust.

B:

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This addresses Security profiles and flow versus proxy inspection boundaries, but not the principal task of the described flow. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. The better fit is: Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. Scenario: An operator disables LDAPS certificate verification after rotating the directory server certificate, risking credentials rather than correcting CA trust.

C:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This addresses Firewall policy evaluation order, interfaces and least privilege, but not the principal task of the described flow. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The better fit is: Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. Scenario: An operator disables LDAPS certificate verification after rotating the directory server certificate, risking credentials rather than correcting CA trust.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests