cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 68

Question 670

A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route.
  2. Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output.
  3. Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints.
  4. Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies.
  5. Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required.

Explanation

Correct Answers

A:

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This distinguishes the relevant FortiGate device, session or controller evidence. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. The corresponding action is: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This is the verification portion of the required complementary pair. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

C:

Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. This directly addresses the FortiOS configuration or response required by the case. Creating a VIP object alone does not allow traffic; a corresponding firewall policy, correct port mapping and valid server route are required. Verify with: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This is the implementation portion of the required complementary pair. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Incorrect Answers

B:

Inspect LDAPS connection and certificate trust, directory bind status, search base, user attributes, group membership and authentication test output. This choice relates to LDAP remote user integration over trusted TLS, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

D:

Domain logins populate fresh user-to-IP entries for supported clients and assigned groups drive the intended identity-aware firewall policies. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

E:

Design supported NAT loopback or split-horizon DNS for internal clients that use a service's public VIP, validating both destination and source translation where required. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Publish only approved internal services through FortiGate virtual IP destination NAT mappings and a matching WAN-to-server firewall policy, including appropriate port-forwarding constraints. Check: Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. Scenario: A published SSH VIP points to the correct internal host but maps external TCP 2222 to an unexpected internal port, generating connection resets.

Question 671

A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy.
  2. Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings.
  3. Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure.
  4. Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate.

Explanation

Correct Answer

A:

Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. This directly addresses the FortiOS configuration or response required by the case. Traffic must pass both policy and routing requirements; a correctly configured SD-WAN rule cannot override a denied firewall session or fix missing NAT. Verify with: Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Incorrect Answers

B:

Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. This addresses FortiGate SD-WAN members, zones and health-check design, but not the principal task of the described flow. SD-WAN rules do not create physical connectivity or an underlay default route, and a green interface link is not proof the measured application path is healthy. The better fit is: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

C:

Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. This addresses Link monitoring and static route failover triggers, but not the principal task of the described flow. Ethernet carrier status is insufficient to prove internet reachability past an ISP modem, and an incorrect monitor target can create false failovers. The better fit is: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

D:

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This addresses Routing table and reverse-path asymmetric connectivity analysis, but not the principal task of the described flow. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The better fit is: Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. Scenario: A source-specific route inherited from a migration diverts traffic before the intended SD-WAN policy and is mistaken for a broken link SLA.

Question 672

A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations.
  2. Configure compatible FortiGate peers as an FGCP high-availability cluster with appropriate heartbeat interfaces, group identity, matching licenses and tracked interfaces.
  3. Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded.
  4. Trace a permitted test flow using FortiOS interface status, routing tables, packet sniffers, session tables and narrowly scoped debug flow, then stop diagnostics safely.

Explanation

Correct Answer

C:

Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. This directly addresses the FortiOS configuration or response required by the case. Some FortiGate models have no local log disk; memory-resident events are not durable archival storage, and choosing a collector without verifying ingestion is insufficient. Verify with: Compare hardware log-storage availability, logging destination configuration, severity filters, disk usage, log-rate statistics and remote collector acknowledgments. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

Incorrect Answers

A:

Register FortiGate with the intended FortiAnalyzer instance, permit trusted management connectivity and enable logs on relevant policies and event categories before relying on central investigations. This addresses FortiAnalyzer registration and centralized log forwarding, but not the principal task of the described flow. A healthy route to FortiAnalyzer does not mean the device has been authorized, that the right log categories are enabled, or that records are arriving. The better fit is: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

B:

Configure compatible FortiGate peers as an FGCP high-availability cluster with appropriate heartbeat interfaces, group identity, matching licenses and tracked interfaces. This addresses FGCP cluster heartbeat, synchronization and election settings, but not the principal task of the described flow. FGCP heartbeat must operate over suitable dedicated links; two matching hostnames alone cannot build a synchronized HA pair or guarantee traffic survival. The better fit is: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

D:

Trace a permitted test flow using FortiOS interface status, routing tables, packet sniffers, session tables and narrowly scoped debug flow, then stop diagnostics safely. This addresses Packet capture, debug flow and physical-path investigation, but not the principal task of the described flow. A ping from the FortiGate control plane may use a different source and route than user traffic; overbroad live debug capture can also expose sensitive packets or strain production. The better fit is: Select supported memory, local-disk, FortiAnalyzer or syslog destinations for the model and retention requirement, and detect loss of records before storage or forwarding limits are exceeded. Scenario: A traffic spike fills the configured local log disk and the appliance begins overwriting records earlier than its retention target.

Question 673

A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details.
  2. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  3. Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges.
  4. Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client.
  5. Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence.

Explanation

Correct Answers

A:

Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This distinguishes the relevant FortiGate device, session or controller evidence. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. The corresponding action is: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This is the verification portion of the required complementary pair. Scenario: A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events.

E:

Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. This directly addresses the FortiOS configuration or response required by the case. An implicit firewall deny may have different log visibility than an explicit deny; no traffic log is not reliable evidence that a packet never reached the FortiGate. Verify with: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. This is the implementation portion of the required complementary pair. Scenario: A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events.

Incorrect Answers

B:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This choice relates to Firewall policy evaluation order, interfaces and least privilege, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events.

C:

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This choice relates to FSSO group filters and AD membership reconciliation, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events.

D:

Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client. This choice relates to Schedule, authenticated groups and policy-specific change control, not the complementary implementation-and-evidence pair for the case. Implement: Enable the intended logging options on relevant FortiGate allow and deny policies, then correlate explicit and implicit deny handling with counters and session evidence. Check: Review matched policy ID, source and destination addresses, logged action, logtraffic settings, deny policy configuration and session or debug-flow details. Scenario: A data center firewall allows an application connection, but no detailed accept log exists because the matching rule logs only selected security events.

Question 674

A new inspection exception fixes one pinned business app but expands to all financial sites, inadvertently removing malware scanning for unrelated traffic. Which diagnostic evidence should the FortiGate administrator check FIRST?

  1. Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support.
  2. Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests.
  3. Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors.
  4. Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log.

Explanation

Correct Answer

C:

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This distinguishes the relevant FortiGate device, session or controller evidence. FortiGate cannot content-scan encrypted HTTP payload merely because a web category or trusted certificate is visible; indiscriminate TLS decryption may break pinned clients. The corresponding action is: Verify that security policies for TLS downloads use appropriate deep inspection, antivirus scanning and certificate handling, restricting bypasses to narrowly documented incompatible services. Scenario: A new inspection exception fixes one pinned business app but expands to all financial sites, inadvertently removing malware scanning for unrelated traffic.

Incorrect Answers

A:

Inspect SSL inspection mode, matched policy, negotiated TLS version, inspected application certificate, session log and target protocol support. This diagnostic is related to FortiGate certificate inspection versus full SSL/SSH inspection rather than the controlling evidence for this scenario. Examine instead: Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. Scenario: A new inspection exception fixes one pinned business app but expands to all financial sites, inadvertently removing malware scanning for unrelated traffic.

B:

Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This diagnostic is related to Oversized transfer handling and antivirus inspection limits rather than the controlling evidence for this scenario. Examine instead: Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. Scenario: A new inspection exception fixes one pinned business app but expands to all financial sites, inadvertently removing malware scanning for unrelated traffic.

D:

Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This diagnostic is related to FortiGuard category ratings and controlled recategorization rather than the controlling evidence for this scenario. Examine instead: Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. Scenario: A new inspection exception fixes one pinned business app but expands to all financial sites, inadvertently removing malware scanning for unrelated traffic.

Question 675

One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps.
  2. Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation.
  3. Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints.
  4. Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route.
  5. Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages.

Explanation

Correct Answers

C:

Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This directly addresses the FortiOS configuration or response required by the case. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. Verify with: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. This is the implementation portion of the required complementary pair. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

E:

Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. This distinguishes the relevant FortiGate device, session or controller evidence. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The corresponding action is: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This is the verification portion of the required complementary pair. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

Incorrect Answers

A:

Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. This choice relates to Captive portal and explicit firewall user authentication, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

B:

Use appropriate certificate trust, subject identity and revocation or PSK rotation controls for FortiGate site-to-site IPsec, and verify rekey without disabling peer validation. This choice relates to Certificate-based IPsec authentication and safe tunnel rekey, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

D:

Traffic exits the intended interface through a reachable next hop and return connectivity works without a broader unapproved default route. This choice relates to FortiGate static default routes and interface reachability, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. Check: Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. Scenario: One VPN peer offers only a DH group disallowed by the other side, producing IKE proposal mismatch while interface routing remains correct.

Question 676

A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver.
  2. Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record.
  3. Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields.
  4. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
  5. The desired application is identified and controlled even when users vary ports or use the approved SaaS interface, without excessive category-wide collateral blocks.

Explanation

Correct Answers

C:

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This distinguishes the relevant FortiGate device, session or controller evidence. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. The corresponding action is: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This is the verification portion of the required complementary pair. Scenario: A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger.

D:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This directly addresses the FortiOS configuration or response required by the case. Certificate inspection does not expose all encrypted HTTP headers and paths; some modern encrypted client protocols reduce metadata availability. Verify with: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This is the implementation portion of the required complementary pair. Scenario: A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger.

Incorrect Answers

A:

Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. This choice relates to DNS filtering versus web filtering visibility boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger.

B:

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This choice relates to Application control monitor versus block actions and exceptions, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger.

E:

The desired application is identified and controlled even when users vary ports or use the approved SaaS interface, without excessive category-wide collateral blocks. This choice relates to Application category filters and application-specific enforcement, not the complementary implementation-and-evidence pair for the case. Implement: Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. Check: Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. Scenario: A policy blocks a specific HTTPS upload path but uses only certificate inspection, and the administrator is surprised that path-specific web filter entries do not trigger.

Question 677

After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints.
  2. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
  3. Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic.
  4. Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes.

Explanation

Correct Answer

C:

Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. This directly addresses the FortiOS configuration or response required by the case. An SD-WAN member rule may select a physical underlay without providing the encrypted overlay route; policy, tunnel health and overlay steering are distinct dependencies. Verify with: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

Incorrect Answers

A:

Configure supported FortiOS IKE Phase 1 proposals, authentication and peer identity for approved site-to-site IPsec peers, matching encryption and key exchange parameters at both endpoints. This addresses FortiGate IPsec Phase 1 IKE negotiation and peer identity, but not the principal task of the described flow. A reachable VPN peer does not guarantee matching Phase 1 identity, PSK or proposal; authentication and crypto negotiation fail before user traffic selectors can be installed. The better fit is: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

B:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This addresses TLS and mutual-certificate handshake fault isolation, but not the principal task of the described flow. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The better fit is: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

D:

Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. This addresses IPsec multi-subnet protection and routed prefix changes, but not the principal task of the described flow. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. The better fit is: Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

Question 678

A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches.
  2. Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches.
  3. Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges.
  4. Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary.
  5. Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state.

Explanation

Correct Answers

A:

Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. This directly addresses the FortiOS configuration or response required by the case. A reusable firewall object can expand privileges across multiple policies; zone membership and service port definitions matter independently of the policy name. Verify with: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This is the implementation portion of the required complementary pair. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

B:

Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This distinguishes the relevant FortiGate device, session or controller evidence. A reusable firewall object can expand privileges across multiple policies; zone membership and service port definitions matter independently of the policy name. The corresponding action is: Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. This is the verification portion of the required complementary pair. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

Incorrect Answers

C:

Users receive policy access consistent with actual intended directory membership and changes propagate without expanding unrelated privileges. This choice relates to FSSO group filters and AD membership reconciliation, not the complementary implementation-and-evidence pair for the case. Implement: Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. Check: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

D:

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This choice relates to Firewall policy evaluation order, interfaces and least privilege, not the complementary implementation-and-evidence pair for the case. Implement: Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. Check: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

E:

Inspect collector connectivity, DC agent or polling status, directory event permissions, group filters, collector learned user/IP mappings and FortiGate FSSO server state. This choice relates to FSSO collector agent and domain-controller event acquisition, not the complementary implementation-and-evidence pair for the case. Implement: Maintain precise address objects, FQDN objects, service definitions and supported interface zones so FortiGate rules express intended business segments rather than accidental broad matches. Check: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

Question 679

A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile.
  2. Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services.
  3. Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability.
  4. Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs.
  5. Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results.

Explanation

Correct Answers

C:

Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. This directly addresses the FortiOS configuration or response required by the case. ESP may need UDP encapsulation through NAT, and multiple layers of translation or endpoint port restrictions can disrupt peer reachability independently of Phase 2 selectors. Verify with: Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. This is the implementation portion of the required complementary pair. Scenario: A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed.

D:

Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. This distinguishes the relevant FortiGate device, session or controller evidence. ESP may need UDP encapsulation through NAT, and multiple layers of translation or endpoint port restrictions can disrupt peer reachability independently of Phase 2 selectors. The corresponding action is: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. This is the verification portion of the required complementary pair. Scenario: A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed.

Incorrect Answers

A:

Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This choice relates to Dialup IPsec dynamic peer identification and authentication, not the complementary implementation-and-evidence pair for the case. Implement: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Check: Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. Scenario: A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed.

B:

Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Check: Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. Scenario: A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed.

E:

Check both tunnel status, DPD behavior, dead peer timers, route priority/distance, SD-WAN tunnel member eligibility and active session results. This choice relates to Redundant tunnels, dead peer detection and controlled failover, not the complementary implementation-and-evidence pair for the case. Implement: Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. Check: Inspect peer NAT detection, outer public addresses and ports, IKE 500/4500 flows, upstream firewall rules, mapped address stability and peer debug logs. Scenario: A new FortiGate branch is placed behind an ISP router performing source NAT, and its old tunnel fails until NAT-T negotiation and UDP reachability are reviewed.

Question 680

A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
  2. Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception.
  3. Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption.
  4. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
  5. Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log.

Explanation

Correct Answers

D:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This directly addresses the FortiOS configuration or response required by the case. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. Verify with: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This is the implementation portion of the required complementary pair. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

E:

Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This distinguishes the relevant FortiGate device, session or controller evidence. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The corresponding action is: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This is the verification portion of the required complementary pair. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

Incorrect Answers

A:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This choice relates to HTTPS web filtering hostname limitations and logging, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

B:

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This choice relates to Targeted SSL inspection exclusions and privacy controls, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

C:

Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption. This choice relates to Application control monitor versus block actions and exceptions, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests