Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. This addresses FortiGuard antivirus signature freshness and incident response, but not the principal task of the described flow. Antivirus effectiveness depends on inspection visibility and current definitions, and an allow action on a profile can still report detections without blocking them. The better fit is: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Choose FortiOS DNS filtering or web filtering controls based on the traffic path and available request metadata, verifying that protected clients actually use the intended DNS resolver. This addresses DNS filtering versus web filtering visibility boundaries, but not the principal task of the described flow. DNS filtering acts on DNS lookups, not arbitrary HTTP URL paths or already established IP connections, and encrypted DNS may bypass poorly placed resolver controls. The better fit is: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. This addresses Application control signature matching and required visibility, but not the principal task of the described flow. Application detection is not identical to TCP service-port matching; encrypted or evasive traffic can require additional visibility and signature coverage. The better fit is: Apply FortiOS antivirus profiles and protocol options in the supported inspection mode on the relevant firewall policies, with suitable FortiGuard definitions and HTTPS visibility. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Inspect URL rating lookup, category database update, applied web filter rule, local rating override, browser result and web-filter log. This choice relates to FortiGuard category ratings and controlled recategorization, not the complementary implementation-and-evidence pair for the case. Implement: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Check: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A security team adds an exception for one trusted application but accidentally exempts a wildcard domain that also hosts untrusted tenant content.

Only the intended URL patterns are allowed or denied, and neighboring hostnames or paths still follow their applicable category rules. This choice relates to Static URL filter ordering and wildcard match behavior, not the complementary implementation-and-evidence pair for the case. Implement: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Check: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A security team adds an exception for one trusted application but accidentally exempts a wildcard domain that also hosts untrusted tenant content.

Identify TLS protocol, hostname, certificate-chain, revocation and mutual-TLS failures separately from FortiGate firewall policy denies during outbound inspection troubleshooting. This choice relates to TLS and mutual-certificate handshake fault isolation, not the complementary implementation-and-evidence pair for the case. Implement: Apply narrowly scoped, auditable SSL-inspection exclusions for supported certificate-pinned or regulated applications without disabling inspection for every other destination. Check: Inspect exemption target entries, application URL or certificate behavior, matched firewall policy, destination reputation and security logs before and after exception. Scenario: A security team adds an exception for one trusted application but accidentally exempts a wildcard domain that also hosts untrusted tenant content.

Inspect IPS sensor filter severity/category, signature IDs, action selection, policy assignment, SSL visibility and actual IPS event logs. This diagnostic is related to IPS signature filters, severity and policy actions rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Examine FortiGuard category decision, encrypted request behavior, SSL inspection profile, server name/certificate, protocol handling and web-filter event fields. This diagnostic is related to HTTPS web filtering hostname limitations and logging rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Review SSL decryption logs, endpoint CA trust, AV protocol scanning, matching policy, file action, exception object and user browser errors. This diagnostic is related to HTTPS malware scanning with controlled exception validation rather than the controlling evidence for this scenario. Examine instead: Check AV profile action, inspection mode, protocol handling, signature version, SSL inspection profile, matched policy and antivirus log. Scenario: An administrator enables antivirus on a policy but users download malware over encrypted HTTPS while only certificate inspection is enabled.

Validate supported FortiGate-VM entitlement, public-cloud capacity requirements and cloud security policies before cutover, distinguishing vendor appliance configuration from cloud platform permissions. This addresses Cloud FortiGate licensing and infrastructure ownership boundaries, but not the principal task of the described flow. An active FortiOS license does not confer AWS or Azure rights, and an allowed firewall rule cannot override a cloud-native deny or missing route. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

Configure compatible FortiGate peers as an FGCP high-availability cluster with appropriate heartbeat interfaces, group identity, matching licenses and tracked interfaces. This addresses FGCP cluster heartbeat, synchronization and election settings, but not the principal task of the described flow. FGCP heartbeat must operate over suitable dedicated links; two matching hostnames alone cannot build a synchronized HA pair or guarantee traffic survival. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

Onboard supported remote users and endpoints through FortiSASE identity enrollment and device posture policies, then apply least-privilege internet or private-application access rules. This addresses FortiSASE endpoint onboarding and identity-bound access, but not the principal task of the described flow. An internet connection from the user is not equivalent to successful FortiSASE enrollment or private-app authorization, and endpoint posture must be evaluated separately from username. The better fit is: Provide out-of-band access to each HA member through supported reserved management interfaces, and stage firmware upgrades with cluster health and rollback checks. Scenario: The secondary FortiGate becomes unreachable for diagnostics because both members depend on the shared cluster management address and no reserved management path exists.

Approved sessions recover over a permitted secondary member according to policy while unexpected fallback links remain excluded. This result would test SD-WAN implicit rules, failover decisions and session persistence but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A branch uses SD-WAN physical links for internet traffic, but private traffic escapes to the public interface because its overlay destination route points at the wrong zone.

Tests confirm approved users reach only intended destinations and services without unintended wildcard access after object or zone changes. This result would test Address and service objects, interface zones, and policy scoping but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A branch uses SD-WAN physical links for internet traffic, but private traffic escapes to the public interface because its overlay destination route points at the wrong zone.

The expected peer establishes an authenticated IKE security association under approved cryptographic settings without accepting an unintended identity. This result would test FortiGate IPsec Phase 1 IKE negotiation and peer identity but does not demonstrate the desired FortiGate outcome here. Verify instead: Private application sessions traverse an eligible encrypted overlay with tested failover and stable return routing across the WAN links. Scenario: A branch uses SD-WAN physical links for internet traffic, but private traffic escapes to the public interface because its overlay destination route points at the wrong zone.

Review matched SD-WAN service rule, SLA thresholds, measured jitter/loss/latency, session destination, selected member and failover behavior. This diagnostic is related to SD-WAN application steering by performance SLA thresholds rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: Two SD-WAN links show low physical errors, yet one suffers heavy upstream jitter and should not serve real-time calls under the established SLA policy.

Inspect the active route table, equal-prefix candidates, distance values, priorities, ECMP status, next-hop reachability and matching interface state. This diagnostic is related to Static route priority, administrative distance and ECMP design rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: Two SD-WAN links show low physical errors, yet one suffers heavy upstream jitter and should not serve real-time calls under the established SLA policy.

Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. This diagnostic is related to SD-WAN implicit rules, failover decisions and session persistence rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN member status, zone membership, performance SLA targets, latency/jitter/loss, route presence and monitoring events. Scenario: Two SD-WAN links show low physical errors, yet one suffers heavy upstream jitter and should not serve real-time calls under the established SLA policy.

Use FortiGate route and session diagnostics to isolate asymmetric return paths, overlapping prefixes and wrong interface selection before opening firewall policy to compensate. This addresses Routing table and reverse-path asymmetric connectivity analysis, but not the principal task of the described flow. A permitted inbound SYN with no symmetric return route can fail even when its matching firewall policy allows it; static route tables are prefix-sensitive. The better fit is: Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. Scenario: A backup route never becomes active because both candidate routes remain installed despite a primary upstream outage that does not drop the Ethernet link.

Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. This addresses FortiGate SD-WAN members, zones and health-check design, but not the principal task of the described flow. SD-WAN rules do not create physical connectivity or an underlay default route, and a green interface link is not proof the measured application path is healthy. The better fit is: Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. Scenario: A backup route never becomes active because both candidate routes remain installed despite a primary upstream outage that does not drop the Ethernet link.

Trace FortiOS policy-based routing decisions against static routes and supported SD-WAN rules, accounting for source, ingress, destination, protocol and service matches. This addresses Policy routes versus destination routing and session steering, but not the principal task of the described flow. A policy route can alter traffic steering relative to ordinary destination-route selection; changing a default static route alone may not fix sessions matched by a higher-priority PBR rule. The better fit is: Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. Scenario: A backup route never becomes active because both candidate routes remain installed despite a primary upstream outage that does not drop the Ethernet link.

Internal clients resolve and reach the intended server consistently without bypassing stateful inspection or exposing additional services. This choice relates to NAT hairpin and internal use of public VIP names, not the complementary implementation-and-evidence pair for the case. Implement: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Check: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This choice relates to VIP destination NAT and published server policies, not the complementary implementation-and-evidence pair for the case. Implement: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Check: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. This choice relates to Active versus passive FortiGate authentication evidence, not the complementary implementation-and-evidence pair for the case. Implement: Use a supported FortiGate captive portal or identity-aware authentication policy to identify users before applying restricted network access, testing redirection and session lifetime. Check: Inspect authentication rule order, captive portal URL and certificate, user group, browser redirect behavior, session authentication list and logout/timeout timestamps. Scenario: After users disconnect from guest Wi-Fi, stale portal sessions persist beyond policy requirements because the administrator never configured or tested idle expiration.

The desired category or hostname restriction is enforced where supported and any path-based policy explicitly requires appropriate decrypting inspection. This result would test HTTPS web filtering hostname limitations and logging but does not demonstrate the desired FortiGate outcome here. Verify instead: Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. This result would test Flow-based versus proxy-based web filter enforcement but does not demonstrate the desired FortiGate outcome here. Verify instead: Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

Managed endpoints validate permitted intercepted TLS sessions without certificate errors and reject untrusted or forged inspection identities. This result would test FortiGate deep-inspection CA trust and certificate deployment but does not demonstrate the desired FortiGate outcome here. Verify instead: Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. Scenario: A web filter denies a specific path, but administrators expect a DNS filter to distinguish that path from other pages at the same domain.

Inspect IKE version, peer gateway, proposal algorithms, Diffie-Hellman group, pre-shared key or certificate, peer IDs, NAT detection and IKE debug messages. This diagnostic is related to FortiGate IPsec Phase 1 IKE negotiation and peer identity rather than the controlling evidence for this scenario. Examine instead: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. This diagnostic is related to Address and service objects, interface zones, and policy scoping rather than the controlling evidence for this scenario. Examine instead: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

Check interface administrative-access flags, admin trusted-host entries, role profiles, management service ports, certificate warnings and successful authorized logins. This diagnostic is related to FortiGate administrator access and trusted management surfaces rather than the controlling evidence for this scenario. Examine instead: Review SD-WAN tunnel member status, underlay interface selection, phase1/phase2 state, performance SLA, overlay destination route and policy logs. Scenario: After one ISP fails, the IPsec tunnel SA is healthy through the backup WAN yet its SD-WAN service rule still steers business traffic to the unavailable original overlay path.

Investigate FortiOS SD-WAN anomalies through rule match, health-check statistics, session tables and routing diagnostics before changing priorities or disabling monitoring. This addresses SD-WAN diagnostics, route changes and link-quality evidence, but not the principal task of the described flow. One successful ping to a monitoring host cannot establish all application paths are healthy, and unnecessary route changes can mask the original packet-loss cause. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Choose administrative distances and route priorities for redundant FortiGate static routes, and use supported equal-cost multipath behavior only where it matches the desired resilience and session steering. This addresses Static route priority, administrative distance and ECMP design, but not the principal task of the described flow. Two equal prefixes are not necessarily equally preferred if their administrative distances or priority differ; ECMP can distribute sessions rather than guaranteeing one preferred path. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.

Coordinate FortiGate firewall policies and SD-WAN zones with route or application-based service steering so chosen WAN members are compatible with the intended security and NAT policy. This addresses SD-WAN interactions with firewall policies and source-specific routes, but not the principal task of the described flow. Traffic must pass both policy and routing requirements; a correctly configured SD-WAN rule cannot override a denied firewall session or fix missing NAT. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: An engineer configures a static route using a gateway outside the connected interface subnet and assumes the route will be usable just because the command was accepted.