cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 45

Question 440

A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps.
  2. Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode.
  3. Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages.
  4. Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access.
  5. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.

Explanation

Correct Answers

C:

Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The corresponding action is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This is the verification portion of the required complementary pair. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

E:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This directly addresses the FortiOS configuration or response required by the case. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. Verify with: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. This is the implementation portion of the required complementary pair. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Incorrect Answers

A:

Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. This choice relates to Captive portal and explicit firewall user authentication, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

B:

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This choice relates to Security profiles and flow versus proxy inspection boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

D:

Each approved session carries the correct user/group identity to the intended policy and stale or unattributed source addresses do not receive privileged access. This choice relates to Active versus passive FortiGate authentication evidence, not the complementary implementation-and-evidence pair for the case. Implement: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Check: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: A branch firewall permits every outbound TCP service before an administrator adds a narrow deny for unapproved remote desktop, so the deny rule never matches.

Question 441

A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges.
  2. Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic.
  3. Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint.
  4. Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes.

Explanation

Correct Answer

D:

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This is the operational validation outcome rather than merely an enabled setting. A reusable firewall object can expand privileges across multiple policies; zone membership and service port definitions matter independently of the policy name. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

Incorrect Answers

A:

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This result would test FSSO group filters and AD membership reconciliation but does not demonstrate the desired FortiGate outcome here. Verify instead: Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

B:

Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. This result would test Implicit denial, policy logging and rule hit interpretation but does not demonstrate the desired FortiGate outcome here. Verify instead: Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

C:

Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint. This result would test FSSO user-to-IP identity across DHCP and shared networks but does not demonstrate the desired FortiGate outcome here. Verify instead: Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

Question 442

During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Examine session-pickup configuration, cluster synchronization, monitored-link state, active sessions, NAT state, failover timing and traffic results.
  2. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  3. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  4. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.

Explanation

Correct Answer

D:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This distinguishes the relevant FortiGate device, session or controller evidence. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. The corresponding action is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

Incorrect Answers

A:

Examine session-pickup configuration, cluster synchronization, monitored-link state, active sessions, NAT state, failover timing and traffic results. This diagnostic is related to HA session-pickup and failover continuity rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

B:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This diagnostic is related to FortiGate local log storage and reliable export rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

C:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This diagnostic is related to Policy traffic log interpretation and diagnostic event filtering rather than the controlling evidence for this scenario. Examine instead: Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. Scenario: During an upgrade, the primary switches unexpectedly and operations cannot identify whether the cause was a monitored interface, heartbeat failure or maintenance election.

Question 443

A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references.
  2. Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets.
  3. Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs.
  4. Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets.

Explanation

Correct Answer

C:

Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This distinguishes the relevant FortiGate device, session or controller evidence. An IP-to-username mapping can become stale after DHCP reassignment, and many users sharing one public NAT address cannot always be distinguished by IP alone. The corresponding action is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Incorrect Answers

A:

Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This diagnostic is related to FSSO group filters and AD membership reconciliation rather than the controlling evidence for this scenario. Examine instead: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

B:

Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This diagnostic is related to NAT hairpin and internal use of public VIP names rather than the controlling evidence for this scenario. Examine instead: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

D:

Examine original and translated tuple in the FortiOS session table, chosen policy ID, VIP match, SD-WAN route, source interface and TCP handshake packets. This diagnostic is related to Diagnosing translated session return path and policy NAT mismatches rather than the controlling evidence for this scenario. Examine instead: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Question 444

Two VLAN interfaces are assigned overlapping DHCP pools, and users alternate between receiving incorrect gateways and losing access to their internal applications. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses.
  2. Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags.
  3. Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins.
  4. Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions.

Explanation

Correct Answer

A:

Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The corresponding action is: Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. Scenario: Two VLAN interfaces are assigned overlapping DHCP pools, and users alternate between receiving incorrect gateways and losing access to their internal applications.

Incorrect Answers

B:

Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags. This diagnostic is related to Packet capture, debug flow and physical-path investigation rather than the controlling evidence for this scenario. Examine instead: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: Two VLAN interfaces are assigned overlapping DHCP pools, and users alternate between receiving incorrect gateways and losing access to their internal applications.

C:

Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. This diagnostic is related to FortiGate administrator access and trusted management surfaces rather than the controlling evidence for this scenario. Examine instead: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: Two VLAN interfaces are assigned overlapping DHCP pools, and users alternate between receiving incorrect gateways and losing access to their internal applications.

D:

Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. This diagnostic is related to FortiGate memory pressure and conserve-mode diagnosis rather than the controlling evidence for this scenario. Examine instead: Inspect FortiGuard connectivity, DNS and time synchronization, registration status, interface DHCP server bindings, lease assignments and excluded addresses. Scenario: Two VLAN interfaces are assigned overlapping DHCP pools, and users alternate between receiving incorrect gateways and losing access to their internal applications.

Question 445

A user reports that HTTPS to a partner fails, while the only retained event is an IPS signature block and the analyst looks exclusively for firewall-deny logs. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration.
  2. Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions.
  3. Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded.
  4. Trace a permitted test flow using FortiOS interface status, routing tables, packet sniffers, session tables and narrowly scoped debug flow, then stop diagnostics safely.

Explanation

Correct Answer

B:

Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. This directly addresses the FortiOS configuration or response required by the case. A UTM blocked-threat record and a firewall implicit-deny event are not interchangeable; absence of a traffic log may mean logging is disabled rather than that no packet arrived. Verify with: Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. Scenario: A user reports that HTTPS to a partner fails, while the only retained event is an IPS signature block and the analyst looks exclusively for firewall-deny logs.

Incorrect Answers

A:

Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This addresses FortiGuard connectivity, registration and internal DHCP provisioning, but not the principal task of the described flow. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: A user reports that HTTPS to a partner fails, while the only retained event is an IPS signature block and the analyst looks exclusively for firewall-deny logs.

C:

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This addresses FortiGate local log storage and reliable export, but not the principal task of the described flow. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: A user reports that HTTPS to a partner fails, while the only retained event is an IPS signature block and the analyst looks exclusively for firewall-deny logs.

D:

Trace a permitted test flow using FortiOS interface status, routing tables, packet sniffers, session tables and narrowly scoped debug flow, then stop diagnostics safely. This addresses Packet capture, debug flow and physical-path investigation, but not the principal task of the described flow. A ping from the FortiGate control plane may use a different source and route than user traffic; overbroad live debug capture can also expose sensitive packets or strain production. The better fit is: Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. Scenario: A user reports that HTTPS to a partner fails, while the only retained event is an IPS signature block and the analyst looks exclusively for firewall-deny logs.

Question 446

An engineer moves a temporary any-any troubleshooting rule above production policy groups and unexpectedly opens multiple previously protected application ports. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Combine the correct identity groups, schedules and narrowly scoped services in a FortiGate firewall policy, and assess whether active sessions require clearing after rule changes.
  2. Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints.
  3. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  4. Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication.

Explanation

Correct Answer

C:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This directly addresses the FortiOS configuration or response required by the case. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. Verify with: Inspect ordered policy IDs, ingress and egress interfaces, address groups, services, source users, policy hit counters and session debug messages. Scenario: An engineer moves a temporary any-any troubleshooting rule above production policy groups and unexpectedly opens multiple previously protected application ports.

Incorrect Answers

A:

Combine the correct identity groups, schedules and narrowly scoped services in a FortiGate firewall policy, and assess whether active sessions require clearing after rule changes. This addresses Schedule, authenticated groups and policy-specific change control, but not the principal task of the described flow. A scheduled policy or identity filter does not retroactively terminate every established session, and a group match depends on reliable identification of the user's current IP or session. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: An engineer moves a temporary any-any troubleshooting rule above production policy groups and unexpectedly opens multiple previously protected application ports.

B:

Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This addresses VIP destination NAT and published server policies, but not the principal task of the described flow. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: An engineer moves a temporary any-any troubleshooting rule above production policy groups and unexpectedly opens multiple previously protected application ports.

D:

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. Scenario: An engineer moves a temporary any-any troubleshooting rule above production policy groups and unexpectedly opens multiple previously protected application ports.

Question 447

A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records.
  2. Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches.
  3. Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route.
  4. Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details.

Explanation

Correct Answer

B:

Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This distinguishes the relevant FortiGate device, session or controller evidence. A reusable firewall object can expand privileges across multiple policies; zone membership and service port definitions matter independently of the policy name. The corresponding action is: Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

Incorrect Answers

A:

Inspect the matched firewall policy, inspection mode, selected security profiles, SSL inspection profile, feature availability and UTM log records. This diagnostic is related to Security profiles and flow versus proxy inspection boundaries rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

C:

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This diagnostic is related to VIP destination NAT and published server policies rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

D:

Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This diagnostic is related to Implicit denial, policy logging and rule hit interpretation rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A technician updates an address group with a broad 10.0.0.0/8 range to fix one subnet and unexpectedly permits all office subnets through existing rules.

Question 448

A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible.
  2. Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination.
  3. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
  4. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.

Explanation

Correct Answer

B:

Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. This directly addresses the FortiOS configuration or response required by the case. Broad category-level SSL exemptions can create large visibility gaps; an exception should be limited to the actual affected flow and justified by policy. Verify with: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

Incorrect Answers

A:

Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. This addresses Application control incident logging and false positive investigation, but not the principal task of the described flow. A single application signature hit may be insufficient to prove a user deliberately launched that program; classification and encrypted traffic can be imperfect. The better fit is: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

C:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

D:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This addresses FortiGuard category ratings and controlled recategorization, but not the principal task of the described flow. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The better fit is: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Scenario: A mobile banking app stops connecting when deep inspection is enabled because it pins the origin certificate, and an administrator proposes exempting all HTTPS traffic.

Question 449

A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery.
  2. Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring.
  3. Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings.
  4. Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate.

Explanation

Correct Answer

C:

Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. This directly addresses the FortiOS configuration or response required by the case. SD-WAN rules do not create physical connectivity or an underlay default route, and a green interface link is not proof the measured application path is healthy. Verify with: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

Incorrect Answers

A:

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This addresses SD-WAN implicit rules, failover decisions and session persistence, but not the principal task of the described flow. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. The better fit is: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

B:

Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring. This addresses SD-WAN diagnostics, route changes and link-quality evidence, but not the principal task of the described flow. One successful ping to a monitoring host cannot establish all application paths are healthy, and unnecessary route changes can mask the original packet-loss cause. The better fit is: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

D:

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This addresses Routing table and reverse-path asymmetric connectivity analysis, but not the principal task of the described flow. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The better fit is: Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. Scenario: A newly added ISP circuit appears in the SD-WAN GUI but carries no traffic because its member gateway and route integration were never completed.

Question 450

Two peers repeatedly establish Phase 1 then log Phase 2 NO_PROPOSAL_CHOSEN errors; administrators waste time changing firewall address objects instead of matching proposals. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs.
  2. Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions.
  3. Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures.
  4. Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs.

Explanation

Correct Answer

C:

Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures. This distinguishes the relevant FortiGate device, session or controller evidence. An IKE SA in established state does not prove any user payload crossed the tunnel, and generic ping failure can arise from routes or firewall rules after both phases succeed. The corresponding action is: Diagnose FortiOS IPsec connectivity by separating interface transport, IKE Phase 1 authentication, Phase 2 negotiation, routed packet selection and firewall policy outcomes. Scenario: Two peers repeatedly establish Phase 1 then log Phase 2 NO_PROPOSAL_CHOSEN errors; administrators waste time changing firewall address objects instead of matching proposals.

Incorrect Answers

A:

Compare connected PoP, endpoint tunnel state, DNS resolution, traffic steering mode, cloud security inspection result, private-app connector health and remote-user event logs. This diagnostic is related to FortiSASE PoP policy steering and remote diagnostics rather than the controlling evidence for this scenario. Examine instead: Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures. Scenario: Two peers repeatedly establish Phase 1 then log Phase 2 NO_PROPOSAL_CHOSEN errors; administrators waste time changing firewall address objects instead of matching proposals.

B:

Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. This diagnostic is related to FortiGate memory pressure and conserve-mode diagnosis rather than the controlling evidence for this scenario. Examine instead: Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures. Scenario: Two peers repeatedly establish Phase 1 then log Phase 2 NO_PROPOSAL_CHOSEN errors; administrators waste time changing firewall address objects instead of matching proposals.

D:

Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. This diagnostic is related to IPsec NAT traversal with upstream address translation rather than the controlling evidence for this scenario. Examine instead: Collect scoped IKE debug, vpn tunnel list state, security association counters, phase proposal messages, tunnel route, session table and forward/reverse packet captures. Scenario: Two peers repeatedly establish Phase 1 then log Phase 2 NO_PROPOSAL_CHOSEN errors; administrators waste time changing firewall address objects instead of matching proposals.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests