Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Review matched firewall policy, NAT mode, pool range, assigned translated IP and source port, session table, egress interface and reverse-path route. This choice relates to Policy NAT source translation and IP pool selection, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: An HTTPS service is mapped in a FortiGate VIP but receives connection timeouts because the administrator forgot to add a matching inbound allow policy.

Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing. This addresses FortiGate memory pressure and conserve-mode diagnosis, but not the principal task of the described flow. Memory conserve mode can restrict session establishment or inspection by policy; simply disabling security services may hide the symptom while creating protection gaps. The better fit is: Use FortiOS process and resource diagnostics to isolate sustained CPU load, distinguishing normal packet processing from logging, security scanning or runaway control-plane tasks. Scenario: A dashboard reports a brief CPU spike during scheduled signature updates, and the operations team treats it as a sustained dataplane outage without correlating processes and timing.

Use the correct FortiGate traffic, UTM and system event logs with deliberate policy log settings and filters to explain session handling and threat actions. This addresses Policy traffic log interpretation and diagnostic event filtering, but not the principal task of the described flow. A UTM blocked-threat record and a firewall implicit-deny event are not interchangeable; absence of a traffic log may mean logging is disabled rather than that no packet arrived. The better fit is: Use FortiOS process and resource diagnostics to isolate sustained CPU load, distinguishing normal packet processing from logging, security scanning or runaway control-plane tasks. Scenario: A dashboard reports a brief CPU spike during scheduled signature updates, and the operations team treats it as a sustained dataplane outage without correlating processes and timing.

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This addresses FortiSASE PoP policy steering and remote diagnostics, but not the principal task of the described flow. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. The better fit is: Use FortiOS process and resource diagnostics to isolate sustained CPU load, distinguishing normal packet processing from logging, security scanning or runaway control-plane tasks. Scenario: A dashboard reports a brief CPU spike during scheduled signature updates, and the operations team treats it as a sustained dataplane outage without correlating processes and timing.

Deploy a controlled inspection CA and trusted endpoint certificate chain for full SSL inspection, protecting its private key and ensuring endpoint browsers accept the configured inspection certificate. This addresses FortiGate deep-inspection CA trust and certificate deployment, but not the principal task of the described flow. Deep inspection creates a controlled man-in-the-middle TLS endpoint; users should not be trained to ignore certificate warnings, and protected trust material requires lifecycle management. The better fit is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This addresses Route-based IPsec tunnel interface and matching security policies, but not the principal task of the described flow. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. The better fit is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This addresses FortiGate IPsec Phase 1 IKE negotiation and peer identity, but not the principal task of the described flow. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The better fit is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Measure FortiOS IPS engine and appliance resource load under representative traffic before changing signature sets or SSL inspection scope, keeping protection while isolating bottlenecks. This choice relates to IPS process CPU demand and inspection capacity, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A security architect enables every IPS signature on a sensitive OT segment without testing false-positive and latency impacts on legacy industrial protocols.

Only connections with acceptable certificate and protocol parameters succeed under the intended inspection policy, and true trust failures remain blocked. This choice relates to TLS and mutual-certificate handshake fault isolation, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A security architect enables every IPS signature on a sensitive OT segment without testing false-positive and latency impacts on legacy industrial protocols.

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This choice relates to Antivirus profile scanning modes and supported protocol boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Build a FortiGate intrusion prevention sensor using supported signature filters, action overrides and protected-application context, then attach it to the correct policy. Check: Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. Scenario: A security architect enables every IPS signature on a sensitive OT segment without testing false-positive and latency impacts on legacy industrial protocols.

Traffic uses the alternative route when the monitored upstream path fails, and the preferred path returns without oscillating under the configured hold-down policy. This result would test Link monitoring and static route failover triggers but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: Employees report that VoIP exits the wrong WAN circuit despite a new lower-distance default route, because an older policy route still matches UDP voice traffic.

An impaired member is correctly classified and a tested policy change restores traffic without hiding intermittent loss or creating new path asymmetry. This result would test SD-WAN diagnostics, route changes and link-quality evidence but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: Employees report that VoIP exits the wrong WAN circuit despite a new lower-distance default route, because an older policy route still matches UDP voice traffic.

The preferred route is selected under normal conditions and documented alternates take over consistently when the primary path is unusable. This result would test Static route priority, administrative distance and ECMP design but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: Employees report that VoIP exits the wrong WAN circuit despite a new lower-distance default route, because an older policy route still matches UDP voice traffic.

Trace FortiGate SNAT and DNAT changes alongside policy decision and route choice to correct sessions that translate properly outbound but fail on the reverse path. This addresses Diagnosing translated session return path and policy NAT mismatches, but not the principal task of the described flow. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: The user authenticates on a portal with a certificate warning but remains denied because the post-authenticated firewall policy matches the wrong group.

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: The user authenticates on a portal with a certificate warning but remains denied because the post-authenticated firewall policy matches the wrong group.

Deploy and validate a supported Fortinet Single Sign-On collector and domain-controller event source, ensuring logon events reach the correct FortiGate connector. This addresses FSSO collector agent and domain-controller event acquisition, but not the principal task of the described flow. FSSO identifies users from login events rather than interrogating the user at every new TCP connection; a broken collector can leave stale or missing identities. The better fit is: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Scenario: The user authenticates on a portal with a certificate warning but remains denied because the post-authenticated firewall policy matches the wrong group.

The selected IPS policy blocks intended known threats with acceptable measured latency and resource load under real peak conditions. This result would test IPS process CPU demand and inspection capacity but does not demonstrate the desired FortiGate outcome here. Verify instead: Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This result would test HTTPS malware scanning with controlled exception validation but does not demonstrate the desired FortiGate outcome here. Verify instead: Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Known harmless test signatures trigger the expected controlled action and SOC operators can trace detection to file, user, policy and update state. This result would test FortiGuard antivirus signature freshness and incident response but does not demonstrate the desired FortiGate outcome here. Verify instead: Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. This choice relates to DNS filtering versus web filtering visibility boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Verify that security policies for TLS downloads use appropriate deep inspection, antivirus scanning and certificate handling, restricting bypasses to narrowly documented incompatible services. This choice relates to HTTPS malware scanning with controlled exception validation, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Check: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. This result would test DNS filtering versus web filtering visibility boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. This result would test Oversized transfer handling and antivirus inspection limits but does not demonstrate the desired FortiGate outcome here. Verify instead: Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. This result would test FortiGate deep-inspection CA trust and certificate deployment but does not demonstrate the desired FortiGate outcome here. Verify instead: Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. Scenario: An administrator copies a proxy-only web filter setting onto a policy still using a flow inspection mode and assumes feature parity without tests.

Inspect VM license status, instance capacity, cloud IAM roles, cloud interface attachment, health, FortiOS versions and native cloud traffic policy. This diagnostic is related to Cloud FortiGate licensing and infrastructure ownership boundaries rather than the controlling evidence for this scenario. Examine instead: Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags. Scenario: A debug flow is left running with a broad filter during peak traffic, generating massive diagnostics and obscuring the single failing client flow.

Review the current firmware build, supported upgrade path, hardware model, configuration checksum, encrypted backup availability and post-upgrade interface and policy diagnostics. This diagnostic is related to Configuration backups and controlled FortiOS firmware changes rather than the controlling evidence for this scenario. Examine instead: Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags. Scenario: A debug flow is left running with a broad filter during peak traffic, generating massive diagnostics and obscuring the single failing client flow.

Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. This diagnostic is related to FortiGate memory pressure and conserve-mode diagnosis rather than the controlling evidence for this scenario. Examine instead: Check link speed and duplex, ARP entries, ingress and egress interfaces, route choice, debug-flow policy messages, packet captures and session flags. Scenario: A debug flow is left running with a broad filter during peak traffic, generating massive diagnostics and obscuring the single failing client flow.

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This result would test SD-WAN implicit rules, failover decisions and session persistence but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: An application control signature matches a cloud service but its SD-WAN steer rule directs it through a member without the needed source NAT configuration.

Traffic uses the alternative route when the monitored upstream path fails, and the preferred path returns without oscillating under the configured hold-down policy. This result would test Link monitoring and static route failover triggers but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: An application control signature matches a cloud service but its SD-WAN steer rule directs it through a member without the needed source NAT configuration.

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This result would test FortiGate static default routes and interface reachability but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: An application control signature matches a cloud service but its SD-WAN steer rule directs it through a member without the needed source NAT configuration.