cert
cert-1
cert-2

Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
FCP_FGT_AD-7.6 Exam - Verified By Experts
FCP_FGT_AD-7.6 Premium File

FCP_FGT_AD-7.6 Premium File

$69.99
$76.99
  • Premium File 128 Questions & Answers. Last Update: Nov 04, 2026

Whats Included:

  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
 
$76.99
$69.99
accept 55 downloads in the last 7 days
block-screenshots
Fortinet FCP_FGT_AD-7.6 Practice Test 69

Question 680

A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable.
  2. Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception.
  3. Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption.
  4. Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites.
  5. Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log.

Explanation

Correct Answers

D:

Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This directly addresses the FortiOS configuration or response required by the case. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. Verify with: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This is the implementation portion of the required complementary pair. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

E:

Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This distinguishes the relevant FortiGate device, session or controller evidence. Category-based filtering is only as accurate as current rating data and profile ordering; an override for one domain can affect all paths hosted there. The corresponding action is: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. This is the verification portion of the required complementary pair. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

Incorrect Answers

A:

Correlate TLS metadata visibility, SNI or certificate names and FortiOS web-filter logs to determine when domain-only versus full-URL controls are technically enforceable. This choice relates to HTTPS web filtering hostname limitations and logging, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

B:

Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. This choice relates to Targeted SSL inspection exclusions and privacy controls, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

C:

Only unauthorized application categories are blocked while monitored business tools generate usable visibility without unexpected interruption. This choice relates to Application control monitor versus block actions and exceptions, not the complementary implementation-and-evidence pair for the case. Implement: Use FortiGuard website categories and supported rating overrides to enforce approved access policy, documenting exceptions for miscategorized business sites. Check: Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. Scenario: A category-rating lookup succeeds from FortiGate, yet policy enforcement differs because an administrator modified a local category override without approval.

Question 681

An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests.
  2. The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection.
  3. Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log.
  4. Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open.
  5. Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database.

Explanation

Correct Answers

A:

Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This distinguishes the relevant FortiGate device, session or controller evidence. An allowed oversize bypass can create a malware scanning gap even though the AV profile is enabled for smaller files; archive depth changes effective inspection capability. The corresponding action is: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. This is the verification portion of the required complementary pair. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

D:

Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. This directly addresses the FortiOS configuration or response required by the case. An allowed oversize bypass can create a malware scanning gap even though the AV profile is enabled for smaller files; archive depth changes effective inspection capability. Verify with: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. This is the implementation portion of the required complementary pair. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

Incorrect Answers

B:

The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection. This choice relates to HTTPS web filtering hostname limitations and logging, not the complementary implementation-and-evidence pair for the case. Implement: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Check: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

C:

Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. This choice relates to Antivirus profile scanning modes and supported protocol boundaries, not the complementary implementation-and-evidence pair for the case. Implement: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Check: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

E:

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. Check: Inspect antivirus profile oversize behavior, archive nesting limits, stream/proxy mode, protocol options, log action and representative file-size tests. Scenario: An engineering team transfers large ZIP archives and assumes every file is virus-scanned, although the profile's oversize action is set to pass without inspection.

Question 682

A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it.
  2. Memory pressure falls to acceptable levels and the FortiGate exits conserve mode while essential inspections and sessions continue as intended.
  3. The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic.
  4. Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint.

Explanation

Correct Answer

C:

The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. This is the operational validation outcome rather than merely an enabled setting. An IKE SA in established state does not prove any user payload crossed the tunnel, and generic ping failure can arise from routes or firewall rules after both phases succeed. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

Incorrect Answers

A:

Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. This result would test IPsec multi-subnet protection and routed prefix changes but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

B:

Memory pressure falls to acceptable levels and the FortiGate exits conserve mode while essential inspections and sessions continue as intended. This result would test FortiGate memory pressure and conserve-mode diagnosis but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

D:

Identity-aware policies recognize the appropriate individual after IP lease changes without transferring a previous user's access to the wrong endpoint. This result would test FSSO user-to-IP identity across DHCP and shared networks but does not demonstrate the desired FortiGate outcome here. Verify instead: The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. Scenario: A tunnel forwards traffic in one direction but the return path is denied by the remote firewall, and the operator concludes the shared pre-shared key must be incorrect.

Question 683

A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it.
  2. The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic.
  3. The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege.
  4. Important traffic and security logs persist for the required investigation period and missing or delayed export produces observable alerts.

Explanation

Correct Answer

A:

Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. This is the operational validation outcome rather than merely an enabled setting. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Incorrect Answers

B:

The failure is attributed to the correct negotiation or data-path layer and a tested remediation restores encrypted application traffic. This result would test IKE and IPsec debug evidence for Phase 1 versus child-SA failures but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

C:

The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. This result would test Cloud FortiGate licensing and infrastructure ownership boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

D:

Important traffic and security logs persist for the required investigation period and missing or delayed export produces observable alerts. This result would test FortiGate local log storage and reliable export but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Question 684

A partner renews its IPsec certificate under a new intermediate CA, and the local FortiGate rejects the IKE signature because its trusted chain was not updated. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. When one tunnel or underlay fails, protected applications reconnect through a valid alternative within the documented recovery target.
  2. A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies.
  3. Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT.
  4. Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability.

Explanation

Correct Answer

D:

Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. This is the operational validation outcome rather than merely an enabled setting. Disabling certificate or peer identity verification may bring a tunnel up but defeats authentication, and scheduled IKE/ESP rekey depends on both ends agreeing on proposals. Scenario: A partner renews its IPsec certificate under a new intermediate CA, and the local FortiGate rejects the IKE signature because its trusted chain was not updated.

Incorrect Answers

A:

When one tunnel or underlay fails, protected applications reconnect through a valid alternative within the documented recovery target. This result would test Redundant tunnels, dead peer detection and controlled failover but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. Scenario: A partner renews its IPsec certificate under a new intermediate CA, and the local FortiGate rejects the IKE signature because its trusted chain was not updated.

B:

A valid user authenticates into the correct FortiGate user group while wrong passwords and unmapped groups are denied without bypass policies. This result would test LDAP remote user integration over trusted TLS but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. Scenario: A partner renews its IPsec certificate under a new intermediate CA, and the local FortiGate rejects the IKE signature because its trusted chain was not updated.

C:

Permitted LAN-to-LAN traffic crosses the established IPsec interface with expected addressing and no unintended source NAT. This result would test Route-based IPsec tunnel interface and matching security policies but does not demonstrate the desired FortiGate outcome here. Verify instead: Approved VPN peers authenticate and rotate keys or certificates without accepting expired, revoked or unexpected identities and while maintaining tested availability. Scenario: A partner renews its IPsec certificate under a new intermediate CA, and the local FortiGate rejects the IKE signature because its trusted chain was not updated.

Question 685

A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path.
  2. Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration.
  3. Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs.
  4. Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting.
  5. Known harmless test signatures trigger the expected controlled action and SOC operators can trace detection to file, user, policy and update state.

Explanation

Correct Answers

C:

Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This distinguishes the relevant FortiGate device, session or controller evidence. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. The corresponding action is: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This is the verification portion of the required complementary pair. Scenario: A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted.

D:

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This directly addresses the FortiOS configuration or response required by the case. A passed TCP handshake does not prove a successful TLS handshake, and deep inspection can alter observed certificate chains or interfere with application client certificates. Verify with: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. This is the implementation portion of the required complementary pair. Scenario: A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted.

Incorrect Answers

A:

Evaluate supported TLS interception and QUIC/HTTP3 handling against FortiOS model capacity, application requirements and policy visibility instead of assuming every encrypted protocol follows the same inspection path. This choice relates to SSL inspection resources and QUIC protocol behavior, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted.

B:

Review IPS signature ID and revision, source/destination flow, detected action, matched sensor and policy, packet context and exception expiration. This choice relates to IPS signatures, logs and focused exception maintenance, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted.

E:

Known harmless test signatures trigger the expected controlled action and SOC operators can trace detection to file, user, policy and update state. This choice relates to FortiGuard antivirus signature freshness and incident response, not the complementary implementation-and-evidence pair for the case. Implement: Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. Check: Inspect certificate subject and SAN, trusted CAs, handshake alerts, supported TLS versions, mTLS client-cert requirements, inspection profile and FortiOS SSL logs. Scenario: A web destination rotates to a certificate with a missing intermediate CA, and users see FortiGate SSL errors even though the URL category remains permitted.

Question 686

An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan.
  2. Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path.
  3. Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration.
  4. Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM.

Explanation

Correct Answer

B:

Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. This directly addresses the FortiOS configuration or response required by the case. FortiGate VM policies cannot inspect packets that cloud-native route tables never send to it, and cloud security groups remain separate enforcement layers. Verify with: Review cloud vNIC and subnet placement, effective cloud routes, source/destination checks where applicable, FortiOS interface addresses, security groups and return-path symmetry. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

Incorrect Answers

A:

Capture an encrypted, version-appropriate configuration backup and upgrade FortiOS along the supported path after compatibility checks and a documented recovery plan. This addresses Configuration backups and controlled FortiOS firmware changes, but not the principal task of the described flow. A configuration backup is not a device image, and skipping an intermediate vendor-supported upgrade step can change feature behavior or render settings incompatible. The better fit is: Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

C:

Verify the appliance registration and FortiGuard reachability while providing LAN clients with a correctly scoped DHCP address pool, default gateway and DNS configuration. This addresses FortiGuard connectivity, registration and internal DHCP provisioning, but not the principal task of the described flow. FortiGuard service communication and LAN DHCP configuration solve different problems; a functioning DHCP pool does not establish that threat intelligence subscriptions are current. The better fit is: Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

D:

Choose supported FortiGate Cloud-Native Firewall integration when centralized cloud firewall policies and service-managed dataplane fit the project, rather than assuming CNF is a self-managed FortiGate VM. This addresses FortiGate cloud-native firewall CNF service responsibility, but not the principal task of the described flow. FortiGate CNF and FortiGate VM have different deployment and management responsibilities; creating a cloud service object does not force every VPC flow through it. The better fit is: Deploy supported FortiGate-VM interfaces, cloud route tables and security controls so inspected application traffic actually traverses the intended firewall path. Scenario: An Azure hub-spoke deployment sends ingress through FortiGate-VM while return packets take the direct peering path, causing stateful inspection sessions to fail.

Question 687

A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain. Which FortiOS 7.6 configuration or corrective action is MOST appropriate?

  1. Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility.
  2. Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver.
  3. Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports.
  4. Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database.

Explanation

Correct Answer

B:

Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. This directly addresses the FortiOS configuration or response required by the case. DNS filtering acts on DNS lookups, not arbitrary HTTP URL paths or already established IP connections, and encrypted DNS may bypass poorly placed resolver controls. Verify with: Review DNS policy/profile, DNS transport, query logs, client resolver configuration, DoH/DoT behavior, browser HTTPS requests and matching web-filter outcomes. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

Incorrect Answers

A:

Select the supported web filtering profile and inspection mode for the desired FortiGate URL or category enforcement, validating policy attachment and expected traffic visibility. This addresses Flow-based versus proxy-based web filter enforcement, but not the principal task of the described flow. Flow-based and proxy-based features may expose different controls and troubleshooting evidence; a web filter profile cannot enforce unseen encrypted URL paths. The better fit is: Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

C:

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This addresses Application control signature matching and required visibility, but not the principal task of the described flow. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. The better fit is: Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

D:

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This addresses FortiGuard antivirus signature freshness and incident response, but not the principal task of the described flow. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. The better fit is: Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

Question 688

An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected.
  2. Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass.
  3. Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it.
  4. The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails.

Explanation

Correct Answer

C:

Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. This is the operational validation outcome rather than merely an enabled setting. Adding a new VLAN locally does not automatically extend remote IPsec selectors, route advertisements and firewall allow policies; each layer must agree. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

Incorrect Answers

A:

A legitimate mobile branch reconnects after its public address changes and unauthorized unknown peer identities are rejected. This result would test Dialup IPsec dynamic peer identification and authentication but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

B:

Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass. This result would test HA session-pickup and failover continuity but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

D:

The appliance completes the planned upgrade with firewall rules and connectivity preserved, and administrators can restore a tested configuration if a change fails. This result would test Configuration backups and controlled FortiOS firmware changes but does not demonstrate the desired FortiGate outcome here. Verify instead: Each authorized internal subnet communicates through the intended encrypted tunnel and unapproved segments remain unable to traverse it. Scenario: An administrator broadens IPsec traffic selectors to 0.0.0.0/0 to fix one missing VLAN without validating the peer route and least-privilege requirements.

Question 689

An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement. Which TWO complementary choices provide the appropriate response AND the key evidence for verifying it? Select TWO.

  1. Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs.
  2. Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics.
  3. Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs.
  4. Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile.
  5. Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior.

Explanation

Correct Answers

A:

Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This distinguishes the relevant FortiGate device, session or controller evidence. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. The corresponding action is: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This is the verification portion of the required complementary pair. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

D:

Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. This directly addresses the FortiOS configuration or response required by the case. A static remote-gateway configuration is brittle for dynamic branch addressing; accepting arbitrary peer identities weakens site-to-site VPN authentication. Verify with: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. This is the implementation portion of the required complementary pair. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Incorrect Answers

B:

Inspect tunnel interface status, active static or dynamic routes, firewall source and destination interfaces, NAT settings, selectors and session diagnostics. This choice relates to Route-based IPsec tunnel interface and matching security policies, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

C:

Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. This choice relates to Oversized transfer handling and antivirus inspection limits, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

E:

Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. This choice relates to Phase 2 selectors, PFS and encryption lifecycle, not the complementary implementation-and-evidence pair for the case. Implement: Configure supported FortiGate dialup site-to-site peer identity and address handling for a branch with a dynamic public IP, while preventing unrelated peers from claiming the same tunnel profile. Check: Inspect dynamic gateway setting, peer ID, certificate or PSK selection, dialup phase1 state, NAT traversal, link address change and IKE logs. Scenario: An engineer enables a permissive dialup tunnel for a new temporary branch but never configures a certificate or unique peer authentication requirement.

Question 690

An engineer upgrades one HA member directly to an unsupported image and leaves the cluster split between incompatible FortiOS versions. Which observable result BEST demonstrates that the intended FortiGate security or connectivity requirement is satisfied?

  1. Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass.
  2. Operators can reach and diagnose both nodes even when traffic fails over, and upgrades maintain a recoverable and healthy cluster state.
  3. The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege.
  4. Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence.

Explanation

Correct Answer

B:

Operators can reach and diagnose both nodes even when traffic fails over, and upgrades maintain a recoverable and healthy cluster state. This is the operational validation outcome rather than merely an enabled setting. Access to the virtual cluster primary is not the same as independent access to each physical peer, and an HA firmware upgrade requires build compatibility and sequence planning. Scenario: An engineer upgrades one HA member directly to an unsupported image and leaves the cluster split between incompatible FortiOS versions.

Incorrect Answers

A:

Supported established sessions survive or reconnect within documented expectations after a primary failure, with no uncontrolled security policy bypass. This result would test HA session-pickup and failover continuity but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can reach and diagnose both nodes even when traffic fails over, and upgrades maintain a recoverable and healthy cluster state. Scenario: An engineer upgrades one HA member directly to an unsupported image and leaves the cluster split between incompatible FortiOS versions.

C:

The FortiGate instance is licensed and reachable through approved cloud paths while cloud IAM and network controls retain least privilege. This result would test Cloud FortiGate licensing and infrastructure ownership boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can reach and diagnose both nodes even when traffic fails over, and upgrades maintain a recoverable and healthy cluster state. Scenario: An engineer upgrades one HA member directly to an unsupported image and leaves the cluster split between incompatible FortiOS versions.

D:

Only appropriately enrolled and authenticated endpoints reach approved applications, with denied or noncompliant clients producing interpretable policy evidence. This result would test FortiSASE endpoint onboarding and identity-bound access but does not demonstrate the desired FortiGate outcome here. Verify instead: Operators can reach and diagnose both nodes even when traffic fails over, and upgrades maintain a recoverable and healthy cluster state. Scenario: An engineer upgrades one HA member directly to an unsupported image and leaves the cluster split between incompatible FortiOS versions.

FCP - FortiGate 7.6 Administrator (FCP_FGT_AD-7.6) Practice Tests