cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 52

Question 510

An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics.
  2. Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges.
  3. A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules.
  4. Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services.

Explanation

Correct Answer

B:

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This is the operational validation outcome rather than merely an enabled setting. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

Incorrect Answers

A:

Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. This result would test Firewall policy evaluation order, interfaces and least privilege but does not demonstrate the desired FortiGate outcome here. Verify instead: Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

C:

A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. This result would test FSSO troubleshooting and authentication connector health but does not demonstrate the desired FortiGate outcome here. Verify instead: Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

D:

Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This result would test NAT hairpin and internal use of public VIP names but does not demonstrate the desired FortiGate outcome here. Verify instead: Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. Scenario: An engineering group is nested under a broader department group, but the FSSO connector's group retrieval design does not deliver the expected nested mapping for the firewall rule.

Question 511

A branch creates two default static routes at the same distance but expects all sessions to use one circuit exclusively without considering ECMP behavior. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering.
  2. Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring.
  3. Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery.
  4. Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure.

Explanation

Correct Answer

A:

Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. This directly addresses the FortiOS configuration or response required by the case. Two equal prefixes are not necessarily equally preferred if their administrative distances or priority differ; ECMP can distribute sessions rather than guaranteeing one preferred path. Verify with: Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. Scenario: A branch creates two default static routes at the same distance but expects all sessions to use one circuit exclusively without considering ECMP behavior.

Incorrect Answers

B:

Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring. This addresses SD-WAN diagnostics, route changes and link-quality evidence, but not the principal task of the described flow. One successful ping to a monitoring host cannot establish all application paths are healthy, and unnecessary route changes can mask the original packet-loss cause. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A branch creates two default static routes at the same distance but expects all sessions to use one circuit exclusively without considering ECMP behavior.

C:

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This addresses SD-WAN implicit rules, failover decisions and session persistence, but not the principal task of the described flow. A healthy member can still be chosen incorrectly because of service-rule ordering, and existing sessions may not instantly rebalance when a different member becomes optimal. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A branch creates two default static routes at the same distance but expects all sessions to use one circuit exclusively without considering ECMP behavior.

D:

Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. This addresses Link monitoring and static route failover triggers, but not the principal task of the described flow. Ethernet carrier status is insufficient to prove internet reachability past an ISP modem, and an incorrect monitor target can create false failovers. The better fit is: Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. Scenario: A branch creates two default static routes at the same distance but expects all sessions to use one circuit exclusively without considering ECMP behavior.

Question 512

An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state.
  2. Inspect monitor target, probe protocol, gateway link state, route suppression, recovery thresholds, event log and controlled failover timings.
  3. Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events.
  4. Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups.

Explanation

Correct Answer

D:

Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This distinguishes the relevant FortiGate device, session or controller evidence. An installed firewall policy cannot supply a missing route; administrative distance, route status and usable next-hop reachability affect forwarding. The corresponding action is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Incorrect Answers

A:

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This diagnostic is related to Static route priority, administrative distance and ECMP design rather than the controlling evidence for this scenario. Examine instead: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

B:

Inspect monitor target, probe protocol, gateway link state, route suppression, recovery thresholds, event log and controlled failover timings. This diagnostic is related to Link monitoring and static route failover triggers rather than the controlling evidence for this scenario. Examine instead: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

C:

Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. This diagnostic is related to FortiGate SD-WAN members, zones and health-check design rather than the controlling evidence for this scenario. Examine instead: Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Question 513

A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked.
  2. The desired application is identified and controlled even when users vary ports or use the approved SaaS interface, without excessive category-wide collateral blocks.
  3. An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional.
  4. Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption.

Explanation

Correct Answer

A:

A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. This is the operational validation outcome rather than merely an enabled setting. A single application signature hit may be insufficient to prove a user deliberately launched that program; classification and encrypted traffic can be imperfect. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

Incorrect Answers

B:

The desired application is identified and controlled even when users vary ports or use the approved SaaS interface, without excessive category-wide collateral blocks. This result would test Application category filters and application-specific enforcement but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

C:

An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. This result would test Antivirus profile scanning modes and supported protocol boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

D:

Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption. This result would test Application control monitor versus block actions and exceptions but does not demonstrate the desired FortiGate outcome here. Verify instead: A false positive is isolated, resolved with the smallest verified rule change and monitored for recurrence while prohibited applications remain blocked. Scenario: A new application signature begins flagging internal update traffic as anonymization software, and administrators need packet and signature context before adding an exception.

Question 514

A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins.
  2. Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events.
  3. Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics.
  4. Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags.

Explanation

Correct Answer

A:

Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. This distinguishes the relevant FortiGate device, session or controller evidence. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. The corresponding action is: Bind HTTPS or SSH administration to the approved management interfaces, create named least-privilege admin profiles and restrict trusted hosts before permitting remote operations. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

Incorrect Answers

B:

Inspect reserved management configuration, independent management routes, peer access, HA firmware upgrade status, pre/post checksums and cluster election events. This diagnostic is related to Reserved HA management, monitoring and firmware upgrades rather than the controlling evidence for this scenario. Examine instead: Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

C:

Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. This diagnostic is related to Configuration backups and controlled FortiOS firmware changes rather than the controlling evidence for this scenario. Examine instead: Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

D:

Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags. This diagnostic is related to Packet capture, debug flow and physical-path investigation rather than the controlling evidence for this scenario. Examine instead: Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

Question 515

An SOC sees a recently replaced FortiGate online but finds no traffic events because the new serial number has not been authorized on the FortiAnalyzer receiver. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps.
  2. Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination.
  3. Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments.
  4. Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums.

Explanation

Correct Answer

A:

Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. This distinguishes the relevant FortiGate device, session or controller evidence. A healthy route to FortiAnalyzer does not mean the device has been authorized, that the right log categories are enabled, or that records are arriving. The corresponding action is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: An SOC sees a recently replaced FortiGate online but finds no traffic events because the new serial number has not been authorized on the FortiAnalyzer receiver.

Incorrect Answers

B:

Correlate policy ID, source/destination interfaces, session action, NAT translation, security profile result, user identity, time range and log destination. This diagnostic is related to Policy traffic log interpretation and diagnostic event filtering rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: An SOC sees a recently replaced FortiGate online but finds no traffic events because the new serial number has not been authorized on the FortiAnalyzer receiver.

C:

Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. This diagnostic is related to FortiGate local log storage and reliable export rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: An SOC sees a recently replaced FortiGate online but finds no traffic events because the new serial number has not been authorized on the FortiAnalyzer receiver.

D:

Inspect HA group name and password, heartbeat link status, cluster member health, firmware/build compatibility, priority settings and synchronization checksums. This diagnostic is related to FGCP cluster heartbeat, synchronization and election settings rather than the controlling evidence for this scenario. Examine instead: Inspect FortiAnalyzer registration and authorization, connectivity, device identity, log forwarding state, log types, policy logging settings and timestamps. Scenario: An SOC sees a recently replaced FortiGate online but finds no traffic events because the new serial number has not been authorized on the FortiAnalyzer receiver.

Question 516

Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references.
  2. Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector.
  3. Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity.
  4. The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked.
  5. Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs.

Explanation

Correct Answers

A:

Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This distinguishes the relevant FortiGate device, session or controller evidence. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. The corresponding action is: Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This is the verification portion of the required complementary pair. Scenario: Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled.

C:

Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This directly addresses the FortiOS configuration or response required by the case. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. Verify with: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This is the implementation portion of the required complementary pair. Scenario: Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled.

Incorrect Answers

B:

Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. Check: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled.

D:

The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked. This choice relates to VIP destination NAT and published server policies, not the complementary implementation-and-evidence pair for the case. Implement: Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. Check: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled.

E:

Examine FSSO agent status, polling event backlog, collector filters, clock skew, affected user/IP mapping, session age and matching policy logs. This choice relates to FSSO troubleshooting and authentication connector health, not the complementary implementation-and-evidence pair for the case. Implement: Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. Check: Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. Scenario: Security removes an employee from a privileged AD group but FSSO continues treating the user's cached logon as authorized until membership refresh is handled.

Question 517

An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  2. Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating.
  3. Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record.
  4. Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures.
  5. The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts.

Explanation

Correct Answers

B:

Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. This directly addresses the FortiOS configuration or response required by the case. A monitor action records detections but is not a deny; globally blocking all unknown applications can disrupt legitimate services and requires risk-based exceptions. Verify with: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This is the implementation portion of the required complementary pair. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.

C:

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This distinguishes the relevant FortiGate device, session or controller evidence. A monitor action records detections but is not a deny; globally blocking all unknown applications can disrupt legitimate services and requires risk-based exceptions. The corresponding action is: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. This is the verification portion of the required complementary pair. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.

Incorrect Answers

A:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This choice relates to Antivirus profile scanning modes and supported protocol boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Check: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.

D:

Build controlled application category and individual signature overrides for FortiGate policies, accounting for dynamic ports, TLS and shared SaaS infrastructures. This choice relates to Application category filters and application-specific enforcement, not the complementary implementation-and-evidence pair for the case. Implement: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Check: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.

E:

The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. This choice relates to IPS signatures, logs and focused exception maintenance, not the complementary implementation-and-evidence pair for the case. Implement: Choose monitor, pass, block or supported application control actions for specific signatures and business roles, validating whether a detected application is truly prevented from operating. Check: Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. Scenario: An administrator exempts an entire remote-access application category after one false positive, unintentionally allowing unrelated high-risk tunneling tools.

Question 518

After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.
  2. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  3. Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs.
  4. Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs.

Explanation

Correct Answer

D:

Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. This distinguishes the relevant FortiGate device, session or controller evidence. Flow-based and proxy-based features may expose different controls and troubleshooting evidence; a web filter profile cannot enforce unseen encrypted URL paths. The corresponding action is: Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

Incorrect Answers

A:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

B:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

C:

Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This diagnostic is related to TLS and mutual-certificate handshake fault isolation rather than the controlling evidence for this scenario. Examine instead: Review policy flow/proxy mode, web filter profile, SSL inspection depth, web request metadata, FortiGuard rating and matching event logs. Scenario: After changing an outbound policy's inspection mode, the team sees new latency and decides to disable all web filtering rather than examining feature compatibility.

Question 519

A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic.
  2. Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics.
  3. Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages.
  4. Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record.

Explanation

Correct Answer

C:

Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. This distinguishes the relevant FortiGate device, session or controller evidence. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The corresponding action is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Incorrect Answers

A:

Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. This diagnostic is related to IPsec multi-subnet protection and routed prefix changes rather than the controlling evidence for this scenario. Examine instead: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

B:

Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. This diagnostic is related to Route-based IPsec tunnel interface and matching security policies rather than the controlling evidence for this scenario. Examine instead: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

D:

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This diagnostic is related to Application control monitor versus block actions and exceptions rather than the controlling evidence for this scenario. Examine instead: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Question 520

A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service.
  2. The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails.
  3. Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations.
  4. The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege.

Explanation

Correct Answer

A:

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This is the operational validation outcome rather than merely an enabled setting. A firewall policy permitting transit packets is not equivalent to management-plane access; local-in controls and interface administration settings have separate effects. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

Incorrect Answers

B:

The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails. This result would test Configuration backups and controlled FortiOS firmware changes but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

C:

Remote clients use the intended FortiSASE security edge and authorized private resources consistently, with failed policy or connector conditions visible to operations. This result would test FortiSASE PoP policy steering and remote diagnostics but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

D:

The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. This result would test Cloud FortiGate licensing and infrastructure ownership boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. Scenario: A contractor receives a full super_admin profile just to inspect system health, while the security policy requires a view-only account scoped to approved management hosts.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests