Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. This choice relates to FortiGate certificate inspection versus full SSL/SSH inspection, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

Approved business applications remain usable while signatures identify and handle prohibited applications with traceable events. This choice relates to Application control signature matching and required visibility, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A company changes a firewall from proxy-based to flow-based inspection without checking AV profile behavior and discovers different treatment of archived downloads.

Examine policy route order and matches, routing table lookup, SD-WAN policy context, session source tuple, chosen egress and debug-flow output. This diagnostic is related to Policy routes versus destination routing and session steering rather than the controlling evidence for this scenario. Examine instead: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: An engineer changes a latency rule but the old long-lived sessions remain pinned to their previous SD-WAN member, confusing validation results.

Inspect SD-WAN service status, health-check latency/loss, member availability, session selected interface, forward route, transport packet trace and logs. This diagnostic is related to SD-WAN diagnostics, route changes and link-quality evidence rather than the controlling evidence for this scenario. Examine instead: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: An engineer changes a latency rule but the old long-lived sessions remain pinned to their previous SD-WAN member, confusing validation results.

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This diagnostic is related to SD-WAN interactions with firewall policies and source-specific routes rather than the controlling evidence for this scenario. Examine instead: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: An engineer changes a latency rule but the old long-lived sessions remain pinned to their previous SD-WAN member, confusing validation results.

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This choice relates to Application control signature matching and required visibility, not the complementary implementation-and-evidence pair for the case. Implement: Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. Check: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. This choice relates to IPS signatures, logs and focused exception maintenance, not the complementary implementation-and-evidence pair for the case. Implement: Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. Check: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

Check inspection CA selection, certificate lifetime and chain, endpoint trust-store deployment, private-key controls, browser warnings and handshake logs. This choice relates to FortiGate deep-inspection CA trust and certificate deployment, not the complementary implementation-and-evidence pair for the case. Implement: Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. Check: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This choice relates to Security profiles and flow versus proxy inspection boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Check: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. This choice relates to Captive portal and explicit firewall user authentication, not the complementary implementation-and-evidence pair for the case. Implement: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Check: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. This choice relates to FSSO troubleshooting and authentication connector health, not the complementary implementation-and-evidence pair for the case. Implement: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Check: Review authenticated user monitor, auth method, group sources, user-to-IP mapping, identity timeout, traffic source IP and matching policy ID. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. This diagnostic is related to FortiGate VM in public-cloud route and interface topology rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: A network team jumps several FortiOS feature releases without checking Fortinet's upgrade-path recommendations and loses settings for a critical traffic inspection policy.

Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. This diagnostic is related to FortiGate administrator access and trusted management surfaces rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: A network team jumps several FortiOS feature releases without checking Fortinet's upgrade-path recommendations and loses settings for a critical traffic inspection policy.

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This diagnostic is related to FortiGuard connectivity, registration and internal DHCP provisioning rather than the controlling evidence for this scenario. Examine instead: Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. Scenario: A network team jumps several FortiOS feature releases without checking Fortinet's upgrade-path recommendations and loses settings for a critical traffic inspection policy.

Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. This addresses FortiGate administrator access and trusted management surfaces, but not the principal task of the described flow. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: An administrator enables policy logging only for security events, then expects ordinary accepted session records for a long-running database flow.

Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. This addresses Configuration backups and controlled FortiOS firmware changes, but not the principal task of the described flow. A configuration backup is not a device image, and skipping an intermediate vendor-supported upgrade step can change feature behavior or render settings incompatible. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: An administrator enables policy logging only for security events, then expects ordinary accepted session records for a long-running database flow.

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This addresses FortiGate local log storage and reliable export, but not the principal task of the described flow. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: An administrator enables policy logging only for security events, then expects ordinary accepted session records for a long-running database flow.

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This result would test HTTPS malware scanning with controlled exception validation but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: An incident responder sees application detection events but not a blocked action and incorrectly concludes that the firewall stopped the suspicious upload.

Approved business applications remain usable while signatures identify and handle prohibited applications with traceable events. This result would test Application control signature matching and required visibility but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: An incident responder sees application detection events but not a blocked action and incorrectly concludes that the firewall stopped the suspicious upload.

An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. This result would test Antivirus profile scanning modes and supported protocol boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: An incident responder sees application detection events but not a blocked action and incorrectly concludes that the firewall stopped the suspicious upload.

Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. This addresses FortiGate administrator access and trusted management surfaces, but not the principal task of the described flow. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. The better fit is: Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This addresses FortiGuard connectivity, registration and internal DHCP provisioning, but not the principal task of the described flow. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The better fit is: Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. This addresses Reserved HA management, monitoring and firmware upgrades, but not the principal task of the described flow. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. The better fit is: Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. Scenario: An engineer prepares to replace a hardware firewall with a different FortiGate model and assumes restoring a raw configuration will map every interface name and hardware capability automatically.

Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This result would test Captive portal and explicit firewall user authentication but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A new FortiGate accepts the FSSO collector connection but never uses its groups because the replacement firewall user group references were not migrated.

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This result would test LDAP remote user integration over trusted TLS but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A new FortiGate accepts the FSSO collector connection but never uses its groups because the replacement firewall user group references were not migrated.

Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This result would test FSSO collector agent and domain-controller event acquisition but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A new FortiGate accepts the FSSO collector connection but never uses its groups because the replacement firewall user group references were not migrated.

Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. This diagnostic is related to FortiGate IPsec Phase 1 IKE negotiation and peer identity rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. This diagnostic is related to SD-WAN IPsec overlay routing and tunnel path choice rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client. This diagnostic is related to Schedule, authenticated groups and policy-specific change control rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A head office adds a warehouse VLAN but only its local route is updated, so users there cannot access the existing FortiGate site-to-site VPN.

Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. This diagnostic is related to Route-based IPsec tunnel interface and matching security policies rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A head office adds a warehouse VLAN but only its local route is updated, so users there cannot access the existing FortiGate site-to-site VPN.

Inspect configured simple/wildcard/regex pattern type, URL filter order, exempt/action behavior, relevant hostname/path visibility and web-filter logs. This diagnostic is related to Static URL filter ordering and wildcard match behavior rather than the controlling evidence for this scenario. Examine instead: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A head office adds a warehouse VLAN but only its local route is updated, so users there cannot access the existing FortiGate site-to-site VPN.