Pass Fortinet FCP_FGT_AD-7.6 Exam in First Attempt Guaranteed!

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This choice relates to Application control monitor versus block actions and exceptions, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Authorized workloads cross the inspection interfaces and return through a symmetric allowed path rather than bypassing the FortiGate VM or being blackholed. This choice relates to FortiGate VM in public-cloud route and interface topology, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Enable and diagnose FortiOS IPsec NAT traversal where peers sit behind compatible NAT devices, checking UDP 4500 encapsulation and public endpoint reachability. This choice relates to IPsec NAT traversal with upstream address translation, not the complementary implementation-and-evidence pair for the case. Implement: Maintain site-to-site IPsec protected subnet coverage as network segments change, using compatible traffic selectors, routes and firewall policies for new or removed prefixes. Check: Check remote and local subnet definitions, phase2 selectors, route advertisements, tunnel interface, policy group membership and packet traces for test traffic. Scenario: A partner removes an old subnet from the VPN encryption policy but the branch keeps routing that prefix into the tunnel, producing blackholed traffic.

Map the intended AD security groups through FSSO collector group filters and FortiGate firewall user groups, checking nested membership and current event identity. This addresses FSSO group filters and AD membership reconciliation, but not the principal task of the described flow. An FSSO logon event can be valid while its group mapping is incomplete; FortiGate rules depend on the group data and policy references available at match time. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: After a laptop receives a new DHCP lease, FortiGate still maps the old address to an administrator and grants a guest machine access to a restricted VLAN.

Trace FortiGate SNAT and DNAT changes alongside policy decision and route choice to correct sessions that translate properly outbound but fail on the reverse path. This addresses Diagnosing translated session return path and policy NAT mismatches, but not the principal task of the described flow. Firewall session state, NAT mapping and routing are coupled; an asymmetric return path or conflicting central NAT rule can cause failure despite correct outbound translation. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: After a laptop receives a new DHCP lease, FortiGate still maps the old address to an administrator and grants a guest machine access to a restricted VLAN.

Arrange specific FortiGate firewall rules above broad rules with correct source, destination, interface, service and schedule matching, and leave an auditable implicit-deny boundary. This addresses Firewall policy evaluation order, interfaces and least privilege, but not the principal task of the described flow. FortiGate policy order and first matching rule are crucial; creating a restrictive rule below an unrestricted matching policy does not constrain existing allowed sessions. The better fit is: Maintain reliable FSSO user-IP associations with accurate DHCP/session changes and supported endpoint identification, limiting trust in shared or NATed source addresses. Scenario: After a laptop receives a new DHCP lease, FortiGate still maps the old address to an administrator and grants a guest machine access to a restricted VLAN.

Inspect monitor target, probe protocol, gateway link state, route suppression, recovery thresholds, event log and controlled failover timings. This diagnostic is related to Link monitoring and static route failover triggers rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

Examine source/destination firewall policy, SD-WAN zone, NAT behavior, explicit policy routes, application signature, health check and session egress. This diagnostic is related to SD-WAN interactions with firewall policies and source-specific routes rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

Inspect FIB route selection, source and destination prefixes, reverse path, configured policy routes, ingress interface and paired packet traces. This diagnostic is related to Routing table and reverse-path asymmetric connectivity analysis rather than the controlling evidence for this scenario. Examine instead: Inspect SD-WAN rules in evaluation order, default service strategy, member health, route table, session interface selection and event history. Scenario: An ISP circuit fails while active sessions continue pointing at its original member until the FortiGate detects the failure and supports reconnection.

Approved administrators reach only the designated management address and untrusted source hosts cannot open the management service. This choice relates to FortiGate administrator access and trusted management surfaces, not the complementary implementation-and-evidence pair for the case. Implement: Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing. Check: Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. Scenario: A FortiGate enters conserve mode during a large file-transfer surge and users see new session failures even though link bandwidth is not saturated.

Examine diagnose sys top or equivalent supported process views, CPU load by core, session throughput, UTM process consumption, interrupts and incident timestamps. This choice relates to CPU process health and abnormal-load troubleshooting, not the complementary implementation-and-evidence pair for the case. Implement: Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing. Check: Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. Scenario: A FortiGate enters conserve mode during a large file-transfer surge and users see new session failures even though link bandwidth is not saturated.

Trace a permitted test flow using FortiOS interface status, routing tables, packet sniffers, session tables and narrowly scoped debug flow, then stop diagnostics safely. This choice relates to Packet capture, debug flow and physical-path investigation, not the complementary implementation-and-evidence pair for the case. Implement: Investigate conserve-mode state and memory consumption by processes and sessions before changing thresholds, inspection settings or hardware sizing. Check: Read diagnose hardware sysinfo mem, process memory distribution, session counts, conserve-mode events and affected security profile actions. Scenario: A FortiGate enters conserve mode during a large file-transfer surge and users see new session failures even though link bandwidth is not saturated.

Examine user authentication state, configured source user groups, policy schedule, session table, policy ID and log timestamps on the test client. This diagnostic is related to Schedule, authenticated groups and policy-specific change control rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

Inspect VIP external and mapped addresses and ports, external interface, inbound policy, source restrictions, session DNAT state and server return route. This diagnostic is related to VIP destination NAT and published server policies rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

Check client DNS answer, ingress/internal interfaces, VIP external address match, matched firewall policy, reverse session and asymmetric return packets. This diagnostic is related to NAT hairpin and internal use of public VIP names rather than the controlling evidence for this scenario. Examine instead: Inspect object IP ranges, DNS resolution for dynamic objects, zone membership, custom service ports and protocol, schedule objects and effective policy matches. Scenario: A new VLAN interface is accidentally added to an unrestricted LAN zone, allowing traffic through zone-based policies intended only for trusted employee networks.

Files above configured limits follow the documented block or controlled exception decision and the outcome is observable in FortiOS event logs. This result would test Oversized transfer handling and antivirus inspection limits but does not demonstrate the desired FortiGate outcome here. Verify instead: An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Users experience the configured category or URL behavior with explainable logs and without disabling unrelated accepted traffic. This result would test Flow-based versus proxy-based web filter enforcement but does not demonstrate the desired FortiGate outcome here. Verify instead: An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Blocked DNS queries and permitted browser requests behave in accordance with distinct DNS and web policies, with no assumption that one control inspects all channels. This result would test DNS filtering versus web filtering visibility boundaries but does not demonstrate the desired FortiGate outcome here. Verify instead: An authorized harmless test sample is detected or blocked according to configured profile while unrelated approved transfers remain functional. Scenario: A FortiGate appliance is isolated from FortiGuard updates for months but operators treat its enabled AV checkbox as proof of current threat protection.

Verify that security policies for TLS downloads use appropriate deep inspection, antivirus scanning and certificate handling, restricting bypasses to narrowly documented incompatible services. This addresses HTTPS malware scanning with controlled exception validation, but not the principal task of the described flow. FortiGate cannot content-scan encrypted HTTP payload merely because a web category or trusted certificate is visible; indiscriminate TLS decryption may break pinned clients. The better fit is: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Scenario: An incident report lists a malware signature name but not whether FortiGate blocked the transfer, so the analyst cannot claim prevention from the detection alone.

Set supported protocol and file-size inspection thresholds according to policy, explicitly handling oversized, compressed or unsupported transfers without silently failing open. This addresses Oversized transfer handling and antivirus inspection limits, but not the principal task of the described flow. An allowed oversize bypass can create a malware scanning gap even though the AV profile is enabled for smaller files; archive depth changes effective inspection capability. The better fit is: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Scenario: An incident report lists a malware signature name but not whether FortiGate blocked the transfer, so the analyst cannot claim prevention from the detection alone.

Investigate FortiOS IPS detection and blocking evidence with signature context and false-positive testing, maintaining tightly bounded exclusions and tested action overrides. This addresses IPS signatures, logs and focused exception maintenance, but not the principal task of the described flow. An IPS exemption by broad source subnet or application category may remove protection beyond one false positive; signature updates can change what matches. The better fit is: Validate FortiGuard AV updates and correlate malware detection logs to specific profiles and quarantines, applying safe containment rather than relying on a stale signature database. Scenario: An incident report lists a malware signature name but not whether FortiGate blocked the transfer, so the analyst cannot claim prevention from the detection alone.

Connect FortiGate to the intended LDAP directory over a verified encrypted transport, with correct base DN, bind account and group mappings for firewall authentication. This addresses LDAP remote user integration over trusted TLS, but not the principal task of the described flow. A successful TCP connection to a directory server does not establish that LDAP bind identity, group lookup or TLS certificate validation is correct. The better fit is: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Isolate FSSO group-policy failures by tracing directory login events to collector tables and FortiGate identity records before altering the protected firewall policy. This addresses FSSO troubleshooting and authentication connector health, but not the principal task of the described flow. A firewall policy allowing any user is an unsafe substitute for repairing a failed identity collector; authentication is a separate dependency from packet route reachability. The better fit is: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Attach supported antivirus, web filter, IPS and application control profiles to the relevant FortiGate firewall policies using a compatible flow-based or proxy-based inspection mode. This addresses Security profiles and flow versus proxy inspection boundaries, but not the principal task of the described flow. Security profiles take effect only when an appropriate policy matches and inspection requirements are met; a profile existing in the GUI does not make it globally active. The better fit is: Distinguish explicit firewall user authentication from passive identity sources, and diagnose username-to-IP mapping before attributing a FortiGate policy denial to the directory password. Scenario: An administrator enables an FSSO group policy for remote users who never generate domain logon events and wonders why the traffic is classified as unauthenticated.

Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. This addresses Link monitoring and static route failover triggers, but not the principal task of the described flow. Ethernet carrier status is insufficient to prove internet reachability past an ISP modem, and an incorrect monitor target can create false failovers. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Enable and validate supported FGCP session synchronization and session-pickup behavior appropriate to traffic type and device capability, with realistic application failover exercises. This addresses HA session-pickup and failover continuity, but not the principal task of the described flow. HA configuration synchronization does not imply every TCP, UDP or proxy inspection session will survive unchanged; session pickup has platform and feature limitations. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Integrate FortiGate IPsec tunnel interfaces into a supported SD-WAN steering design, ensuring underlay reachability, overlay routes and matching firewall policies for protected traffic. This addresses SD-WAN IPsec overlay routing and tunnel path choice, but not the principal task of the described flow. An SD-WAN member rule may select a physical underlay without providing the encrypted overlay route; policy, tunnel health and overlay steering are distinct dependencies. The better fit is: Align FortiOS IPsec Phase 2 selectors and supported PFS or crypto settings across peers, preserving intended local and remote subnets and rekey behavior. Scenario: A branch IPsec tunnel reports Phase 1 established but no access to a new VLAN because the Phase 2 local selector still includes only the old LAN range.

Investigate FortiOS application detection logs and signature revisions before creating narrowly scoped exclusions, ensuring legitimate traffic and policy intent remain visible. This choice relates to Application control incident logging and false positive investigation, not the complementary implementation-and-evidence pair for the case. Implement: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Check: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: An application control profile has a block action but produces no detection events because it was attached to an inbound rule instead of the actual outbound user policy.

Compare application control profile actions, overridden signatures, policy match, UTM application logs, live client sessions and approval record. This choice relates to Application control monitor versus block actions and exceptions, not the complementary implementation-and-evidence pair for the case. Implement: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Check: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: An application control profile has a block action but produces no detection events because it was attached to an inbound rule instead of the actual outbound user policy.

Only connections with acceptable certificate and protocol parameters succeed under the intended inspection policy, and true trust failures remain blocked. This choice relates to TLS and mutual-certificate handshake fault isolation, not the complementary implementation-and-evidence pair for the case. Implement: Attach a current FortiGate application control profile to the correct matching firewall policy and assess SSL inspection requirements for applications that use encrypted or unusual ports. Check: Check application signature database freshness, policy ID, inspection profile, session protocol, application detection event and decryption scope. Scenario: An application control profile has a block action but produces no detection events because it was attached to an inbound rule instead of the actual outbound user policy.

Use FortiOS SD-WAN service rules with appropriate quality measurements and priority strategy to select links for latency-sensitive or bulk applications. This addresses SD-WAN application steering by performance SLA thresholds, but not the principal task of the described flow. A link showing the highest bandwidth is not necessarily the best choice for latency-sensitive traffic, and SD-WAN SLA measurements must match actual critical paths. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

Create supported FortiOS SD-WAN member links and zones with appropriate routes and performance health checks, validating per-member interface and gateway settings. This addresses FortiGate SD-WAN members, zones and health-check design, but not the principal task of the described flow. SD-WAN rules do not create physical connectivity or an underlay default route, and a green interface link is not proof the measured application path is healthy. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.

Attach supported FortiOS gateway or link-health checks to redundant routes and verify that route withdrawal or selection responds to actual upstream reachability failure. This addresses Link monitoring and static route failover triggers, but not the principal task of the described flow. Ethernet carrier status is insufficient to prove internet reachability past an ISP modem, and an incorrect monitor target can create false failovers. The better fit is: Configure valid FortiOS static and default routes for the approved next hops and outgoing interfaces, validating that gateways are reachable in the intended routing instance. Scenario: The primary WAN link is healthy but there is no active default route in the FortiGate routing table, causing destination lookup failures that are misreported as IPS blocks.