Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This addresses FortiGate IPsec Phase 1 IKE negotiation and peer identity, but not the principal task of the described flow. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This addresses FortiGate deep-inspection CA trust and certificate deployment, but not the principal task of the described flow. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This addresses IPsec multi-subnet protection and routed prefix changes, but not the principal task of the described flow. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A security engineer shortens Phase 2 SA lifetime on one peer without coordinating rekey behavior, leading recurring outages at predictable intervals.

Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. This diagnostic is related to LDAP remote user integration over trusted TLS rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A partner's new public source range must access one VIP, but the administrator broadens the firewall source to any address instead of updating the approved source object.

Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This diagnostic is related to Address and service objects, interface zones, and policy scoping rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A partner's new public source range must access one VIP, but the administrator broadens the firewall source to any address instead of updating the approved source object.

Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. This diagnostic is related to Policy NAT source translation and IP pool selection rather than the controlling evidence for this scenario. Examine instead: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A partner's new public source range must access one VIP, but the administrator broadens the firewall source to any address instead of updating the approved source object.

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This addresses FSSO collector agent and domain-controller event acquisition, but not the principal task of the described flow. FSSO identifies users from login events rather than interrogating the user at every new TCP connection; a broken collector can leave stale or missing identities. The better fit is: Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This addresses FSSO group filters and AD membership reconciliation, but not the principal task of the described flow. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. The better fit is: Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. Scenario: FSSO records show a different workstation username from the endpoint's current login because the collector timestamp differs from the directory time source.

Investigators can trace an allowed or denied session through a matched policy and identify the security feature responsible for any block. This result would test Policy traffic log interpretation and diagnostic event filtering but does not demonstrate the desired FortiGate outcome here. Verify instead: Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

Cloud resources are protected by the approved managed firewall service with visible policy hits and provider-cloud routing appropriate to that deployment model. This result would test FortiGate cloud-native firewall CNF service responsibility but does not demonstrate the desired FortiGate outcome here. Verify instead: Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This result would test FortiGate administrator access and trusted management surfaces but does not demonstrate the desired FortiGate outcome here. Verify instead: Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. Scenario: An engineer scales FortiGate-VM to an additional NIC but forgets the cloud platform's subnet association and effective route table requirements.

Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This addresses NAT hairpin and internal use of public VIP names, but not the principal task of the described flow. Hairpin NAT can require specific policy and routing considerations; a public VIP that works from the internet is not proof an inside client using the same name will work. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. This addresses Policy NAT source translation and IP pool selection, but not the principal task of the described flow. NAT is address translation, not a permit decision; a working outbound policy still needs correct return routing and enough translated addresses and ports. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Configure a supported RADIUS server and shared secrets for user authentication, interpreting Access-Accept, Access-Reject, timeout and group attributes before changing network policy. This addresses RADIUS authentication and policy-bound MFA validation, but not the principal task of the described flow. A reachable RADIUS server can still reject every user if the shared secret, client registration, user group mapping or MFA flow is incorrect. The better fit is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. This addresses Antivirus profile scanning modes and supported protocol boundaries, but not the principal task of the described flow. An antivirus profile can only scan content visible in its inspection path and within supported protocol or size limits; a scanner configured but unattached is ineffective. The better fit is: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This addresses FortiGuard antivirus signature freshness and incident response, but not the principal task of the described flow. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. The better fit is: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This addresses FortiGate local log storage and reliable export, but not the principal task of the described flow. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The better fit is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: After a FortiAnalyzer address change, network reachability tests succeed, but the logging destination still references the decommissioned collector.

Enable and validate supported FGCP session synchronization and session-pickup behavior appropriate to traffic type and device capability, with realistic application failover exercises. This addresses HA session-pickup and failover continuity, but not the principal task of the described flow. HA configuration synchronization does not imply every TCP, UDP or proxy inspection session will survive unchanged; session pickup has platform and feature limitations. The better fit is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: After a FortiAnalyzer address change, network reachability tests succeed, but the logging destination still references the decommissioned collector.

Use FortiOS process and resource diagnostics to isolate sustained CPU load, distinguishing normal packet processing from logging, security scanning or runaway control-plane tasks. This addresses CPU process health and abnormal-load troubleshooting, but not the principal task of the described flow. A high CPU percentage cannot by itself identify a failing security module; FortiOS hardware offload and device model affect the meaning of process and throughput measurements. The better fit is: Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. Scenario: After a FortiAnalyzer address change, network reachability tests succeed, but the logging destination still references the decommissioned collector.

Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. This addresses Captive portal and explicit firewall user authentication, but not the principal task of the described flow. A captive portal requires appropriate traffic interception, browser/TLS behavior and a valid identity mapping; it is not activated merely by naming a user group in a firewall address object. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. This addresses FSSO troubleshooting and authentication connector health, but not the principal task of the described flow. A firewall policy allowing any user is an unsafe substitute for repairing a failed identity collector; authentication is a separate dependency from packet route reachability. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This addresses Firewall policy evaluation order, interfaces and least privilege, but not the principal task of the described flow. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: A terminal server hosts many simultaneous employees behind one network IP, but the team assumes ordinary FSSO one-IP-one-user mapping distinguishes every session.

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. This diagnostic is related to IPS signatures, logs and focused exception maintenance rather than the controlling evidence for this scenario. Examine instead: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This diagnostic is related to Targeted SSL inspection exclusions and privacy controls rather than the controlling evidence for this scenario. Examine instead: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A newly built IPS sensor uses an action of monitor for critical signatures and management incorrectly assumes every detected exploit was blocked.

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This choice relates to Routing table and reverse-path asymmetric connectivity analysis, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring. This choice relates to SD-WAN diagnostics, route changes and link-quality evidence, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Inspect routing monitor, static route enablement, interface link, neighbor ARP, gateway reachability, destination prefixes and diagnostic route lookups. This choice relates to FortiGate static default routes and interface reachability, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. This choice relates to Policy NAT source translation and IP pool selection, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.