Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This addresses VIP destination NAT and published server policies, but not the principal task of the described flow. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This addresses IPsec multi-subnet protection and routed prefix changes, but not the principal task of the described flow. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

Validate the FortiSASE service edge, policy assignment, client route steering and logging for remote access and internet security scenarios before attributing every failure to FortiGate site firewall rules. This addresses FortiSASE PoP policy steering and remote diagnostics, but not the principal task of the described flow. FortiSASE cloud inspection and a branch FortiGate security policy are distinct enforcement points; successful endpoint authentication alone does not prove traffic steering. The better fit is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. This result would test Flow-based versus proxy-based web filter enforcement but does not demonstrate the desired FortiGate outcome here. Verify instead: Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. Scenario: A block rule targets an HTTPS subdirectory although the FortiGate profile only sees the server certificate name, resulting in unexpected permit events.

Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. This result would test DNS filtering versus web filtering visibility boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. Scenario: A block rule targets an HTTPS subdirectory although the FortiGate profile only sees the server certificate name, resulting in unexpected permit events.

Permitted test downloads receive the intended malware verdict, while excluded sensitive services keep documented and limited inspection behavior. This result would test HTTPS malware scanning with controlled exception validation but does not demonstrate the desired FortiGate outcome here. Verify instead: Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. Scenario: A block rule targets an HTTPS subdirectory although the FortiGate profile only sees the server certificate name, resulting in unexpected permit events.

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This choice relates to SD-WAN implicit rules, failover decisions and session persistence, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This choice relates to Dialup IPsec dynamic peer identification and authentication, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. This choice relates to SD-WAN IPsec overlay routing and tunnel path choice, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: A team rotates its site-to-site pre-shared key on one FortiGate but not the partner firewall, and Phase 1 logs show authentication failures after rekey.

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This result would test Routing table and reverse-path asymmetric connectivity analysis but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. This result would test Policy routes versus destination routing and session steering but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Voice or business transactions follow eligible links meeting their defined SLA while bulk traffic uses permitted alternatives without starving priority services. This result would test SD-WAN application steering by performance SLA thresholds but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This addresses Firewall policy evaluation order, interfaces and least privilege, but not the principal task of the described flow. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The better fit is: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Scenario: A branch engineer uses source NAT on a site-to-site private application link without documenting source preservation requirements, breaking the upstream allowlist.

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Scenario: A branch engineer uses source NAT on a site-to-site private application link without documenting source preservation requirements, breaking the upstream allowlist.

Trace FortiGate SNAT and DNAT changes alongside policy decision and route choice to correct sessions that translate properly outbound but fail on the reverse path. This addresses Diagnosing translated session return path and policy NAT mismatches, but not the principal task of the described flow. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. The better fit is: Use supported policy-based SNAT or central SNAT options with interface address or appropriate IP pools, ensuring return traffic and overlapping network requirements are considered. Scenario: A branch engineer uses source NAT on a site-to-site private application link without documenting source preservation requirements, breaking the upstream allowlist.

Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This diagnostic is related to Oversized transfer handling and antivirus inspection limits rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: An IPS event shows a signature match with action pass, but the incident report claims the FortiGate blocked a real exploit despite the lack of a block event.

Examine IPS process CPU, concurrent sessions, per-policy UTM statistics, inspection mode, hardware offload status, log rate and throughput baseline. This diagnostic is related to IPS process CPU demand and inspection capacity rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: An IPS event shows a signature match with action pass, but the incident report claims the FortiGate blocked a real exploit despite the lack of a block event.

Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. This diagnostic is related to IPS signature filters, severity and policy actions rather than the controlling evidence for this scenario. Examine instead: Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. Scenario: An IPS event shows a signature match with action pass, but the incident report claims the FortiGate blocked a real exploit despite the lack of a block event.

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This choice relates to SD-WAN implicit rules, failover decisions and session persistence, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Check: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This choice relates to Static route priority, administrative distance and ECMP design, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Check: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This choice relates to Routing table and reverse-path asymmetric connectivity analysis, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. Check: Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. Scenario: Voice traffic is steered to the cheapest link despite jitter exceeding the approved threshold because the SD-WAN rule uses bandwidth as its only preference.

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This result would test FortiGate static default routes and interface reachability but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: An administrator tests a policy route using FortiGate's own ping command and assumes it proves the same source-interface policy selection as client traffic.

New connections and replies use a consistent permitted route with no unexplained asymmetric session resets or untracked return flows. This result would test Routing table and reverse-path asymmetric connectivity analysis but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: An administrator tests a policy route using FortiGate's own ping command and assumes it proves the same source-interface policy selection as client traffic.

The intended applications traverse approved security policy and selected SD-WAN members with correct translation and bidirectional return traffic. This result would test SD-WAN interactions with firewall policies and source-specific routes but does not demonstrate the desired FortiGate outcome here. Verify instead: The intended application follows the approved source-aware path without inadvertently diverting unrelated users or bypassing inspection policy. Scenario: An administrator tests a policy route using FortiGate's own ping command and assumes it proves the same source-interface policy selection as client traffic.

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This result would test Address and service objects, interface zones, and policy scoping but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This result would test FSSO group filters and AD membership reconciliation but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint. This result would test FSSO user-to-IP identity across DHCP and shared networks but does not demonstrate the desired FortiGate outcome here. Verify instead: A reproducible user authentication event produces the expected group entry and protected session, while stale entries are cleared without broadening firewall rules. Scenario: A domain controller stops generating expected security log events and FSSO access fails, but operations attempt to fix it by adding an any-any firewall rule.

The specific public port reaches the intended internal listener and unauthorized external service or source combinations remain blocked. This choice relates to VIP destination NAT and published server policies, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A remote user changes networks mid-day yet an old cached FSSO entry remains attached to the previous hotspot address, complicating firewall-policy troubleshooting.

Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This choice relates to FSSO group filters and AD membership reconciliation, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A remote user changes networks mid-day yet an old cached FSSO entry remains attached to the previous hotspot address, complicating firewall-policy troubleshooting.

Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This choice relates to Address and service objects, interface zones, and policy scoping, not the complementary implementation-and-evidence pair for the case. Implement: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Check: Inspect user login record, workstation lease, FSSO IP mapping, authentication cache age, NAT visibility, terminal service mappings and policy match logs. Scenario: A remote user changes networks mid-day yet an old cached FSSO entry remains attached to the previous hotspot address, complicating firewall-policy troubleshooting.

Validate the explicit and implicit FortiOS SD-WAN service-rule ordering, fallbacks and session behavior under primary member failure and subsequent recovery. This choice relates to SD-WAN implicit rules, failover decisions and session persistence, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This choice relates to Static route priority, administrative distance and ECMP design, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This choice relates to FortiGate static default routes and interface reachability, not the complementary implementation-and-evidence pair for the case. Implement: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Check: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A branch moves internet uplinks into an SD-WAN zone but leaves its outbound firewall policy bound to an individual former WAN interface, causing drops.