Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. This choice relates to SD-WAN IPsec overlay routing and tunnel path choice, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This choice relates to FortiGate static default routes and interface reachability, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This choice relates to Route-based IPsec tunnel interface and matching security policies, not the complementary implementation-and-evidence pair for the case. Implement: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Check: Examine Phase 2 source and destination selectors, PFS group, ESP proposal, SA lifetimes, phase negotiation events and counters for protected prefixes. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. This addresses Reserved HA management, monitoring and firmware upgrades, but not the principal task of the described flow. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: Contractors authenticate successfully to the identity provider but fail private app access because their device was never onboarded under the FortiSASE posture policy.

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This addresses FortiSASE PoP policy steering and remote diagnostics, but not the principal task of the described flow. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: Contractors authenticate successfully to the identity provider but fail private app access because their device was never onboarded under the FortiSASE posture policy.

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This addresses FortiGate local log storage and reliable export, but not the principal task of the described flow. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: Contractors authenticate successfully to the identity provider but fail private app access because their device was never onboarded under the FortiSASE posture policy.

Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. This diagnostic is related to FortiGate certificate inspection versus full SSL/SSH inspection rather than the controlling evidence for this scenario. Examine instead: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This diagnostic is related to FortiGuard antivirus signature freshness and incident response rather than the controlling evidence for this scenario. Examine instead: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

Review application log signature name, action, profile override, FortiGuard signature version, client flow, SSL inspection and change history. This diagnostic is related to Application control incident logging and false positive investigation rather than the controlling evidence for this scenario. Examine instead: Inspect application category membership, application-specific overrides, signature IDs, traffic matches, session logs and inspection visibility. Scenario: A company must block a particular unauthorized remote desktop tool but allow its approved collaboration suite, yet the security rule blocks all remote-access and collaboration applications together.

Application traffic uses the approved supported encryption and inspection path without unexamined bypasses or sustained inspection overload. This result would test SSL inspection resources and QUIC protocol behavior but does not demonstrate the desired FortiGate outcome here. Verify instead: The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

A controlled benign exploit simulation triggers the expected IPS action while legitimate application transactions continue under tested exclusions. This result would test IPS signature filters, severity and policy actions but does not demonstrate the desired FortiGate outcome here. Verify instead: The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. This result would test Static URL filter ordering and wildcard match behavior but does not demonstrate the desired FortiGate outcome here. Verify instead: The targeted false positive no longer interrupts an approved service, while exploit attempts retain blocking coverage and traceable alerts. Scenario: A remediation team permits an entire WAN destination group to bypass IPS for one fragile legacy application, unintentionally expanding the exception to sensitive new services.

Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. This diagnostic is related to Application control signature matching and required visibility rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: After migrating a security profile, HTTPS web categories still evaluate certificate metadata but content-based DLP controls do not see uploaded documents.

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This diagnostic is related to Application control monitor versus block actions and exceptions rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: After migrating a security profile, HTTPS web categories still evaluate certificate metadata but content-based DLP controls do not see uploaded documents.

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This diagnostic is related to Targeted SSL inspection exclusions and privacy controls rather than the controlling evidence for this scenario. Examine instead: Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. Scenario: After migrating a security profile, HTTPS web categories still evaluate certificate metadata but content-based DLP controls do not see uploaded documents.

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This addresses FortiGate local log storage and reliable export, but not the principal task of the described flow. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This addresses FortiSASE PoP policy steering and remote diagnostics, but not the principal task of the described flow. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. This addresses FortiGate VM in public-cloud route and interface topology, but not the principal task of the described flow. FortiGate VM policies cannot inspect packets that cloud-native route tables never send to it, and cloud security groups remain separate enforcement layers. The better fit is: Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. Scenario: An endpoint agent shows Connected after enrollment, but its failed posture check prevents access to a restricted application despite valid SSO credentials.

Inspect AV engine and signature version, FortiGuard reachability, licensing, matched policy, malware verdict, file hash and action logs. This diagnostic is related to FortiGuard antivirus signature freshness and incident response rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: A deeply nested archive crosses inspection limits without a clear antivirus event, and a tester mistakes the absence of detection for a clean file.

Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. This diagnostic is related to FSSO user-to-IP identity across DHCP and shared networks rather than the controlling evidence for this scenario. Examine instead: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: An operator installs a DC agent on one domain controller but assumes FSSO sees all branch logins even when they are handled by different unmonitored controllers.

Compare collector monitored groups, AD membership, security identifier/group names, group refresh status, FortiGate group objects and policy group references. This diagnostic is related to FSSO group filters and AD membership reconciliation rather than the controlling evidence for this scenario. Examine instead: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: An operator installs a DC agent on one domain controller but assumes FSSO sees all branch logins even when they are handled by different unmonitored controllers.

Check RADIUS server address and UDP ports, shared secret, source IP, request logs, returned group attributes, timeout, MFA challenge capability and user policy. This diagnostic is related to RADIUS authentication and policy-bound MFA validation rather than the controlling evidence for this scenario. Examine instead: Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. Scenario: An operator installs a DC agent on one domain controller but assumes FSSO sees all branch logins even when they are handled by different unmonitored controllers.

Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. This diagnostic is related to FortiGate SD-WAN members, zones and health-check design rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This diagnostic is related to Static route priority, administrative distance and ECMP design rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This diagnostic is related to SD-WAN interactions with firewall policies and source-specific routes rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: After restoring the primary ISP, operators expect every established connection to jump instantly back to it, ignoring sticky-session and established-path behavior.

Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. This addresses Configuration backups and controlled FortiOS firmware changes, but not the principal task of the described flow. A configuration backup is not a device image, and skipping an intermediate vendor-supported upgrade step can change feature behavior or render settings incompatible. The better fit is: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Scenario: A home-office gateway changes its external mapped UDP port frequently, causing repeated IKE failures even though users can browse the internet normally.

Build supported route-based FortiGate IPsec tunnel interfaces with destination routes and bidirectional firewall policies so accepted encrypted traffic travels through the correct tunnel. This addresses Route-based IPsec tunnel interface and matching security policies, but not the principal task of the described flow. An established VPN SA cannot route user packets without valid route and firewall policy; applying source NAT across a private site-to-site tunnel can break peer selectors or application identity. The better fit is: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Scenario: A home-office gateway changes its external mapped UDP port frequently, causing repeated IKE failures even though users can browse the internet normally.

Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This addresses FortiGate IPsec Phase 1 IKE negotiation and peer identity, but not the principal task of the described flow. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The better fit is: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Scenario: A home-office gateway changes its external mapped UDP port frequently, causing repeated IKE failures even though users can browse the internet normally.

Unauthenticated clients encounter the intended portal or deny behavior and authenticated users reach only their approved resources. This result would test Captive portal and explicit firewall user authentication but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

Only intended flows match the narrow allow rule while unauthorized traffic remains denied with sufficient diagnostics. This result would test Firewall policy evaluation order, interfaces and least privilege but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.

Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This result would test NAT hairpin and internal use of public VIP names but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can prove why a given session was accepted or denied and can distinguish missing logging from absent traffic. Scenario: A security team adds an explicit deny rule for outbound SMB but sees no alert because the rule does not log its matching traffic.